Security Limitations & Cryptographic Disclaimer

Published by Blue Horizon Traders, Mumbai, India

Honest Engineering Notice: In accordance with industry-standard cryptographic ethics, Blue Horizon Traders explicitly does NOT claim "unbreakable" or "absolute" security. No computational system is completely infallible against sophisticated hardware physical compromise or compromised operating system kernels.

1. Cryptographic Standards Implemented

CoreSeal employs standard, audited, peer-reviewed cryptographic primitives:

AES-256-GCM: Authenticated symmetric encryption with random unique 96-bit initialization vectors (nonces) per encrypted segment to guard against ciphertext tampering.
Argon2id / PBKDF2 Key Derivation: Password stretching with salt to substantially elevate the cost of offline brute-force attacks.
Zeroize Hygiene: Explicit memory clearing routines applied to cryptographic keys upon locking or emergency panic gestures.

2. Realistic Memory Limitations

While CoreSeal employs best-effort memory wiping (overwriting cryptographic structures with zeros when a vault is closed or panic gesture is triggered), modern Android OS runtime environments (including garbage collection, JVM/ART compaction, swap, and flash wear-leveling) prevent any user-space application from offering a 100% mathematically guaranteed wipe of volatile memory.

3. Rooted Devices & OS Compromise

If your Android device is rooted, infected with kernel-level malware, or operating with an unlocked bootloader susceptible to physical DMA/JTAG extraction, security guarantees provided by CoreSeal are impaired. We strongly recommend using CoreSeal on modern, non-rooted Android 9.0+ devices with active lock screens.

4. User Sole Custody of Passcodes

Because CoreSeal has zero backdoors, Blue Horizon Traders cannot reset your PIN, 10-digit calculator code, or decrypt your Lifeboat backup files. You are solely responsible for memorizing your access credentials and maintaining offline .securevault backups.