How Seal works
Seal generates a random 256-bit file encryption key on the host. It encrypts the file in AES-GCM chunks, then asks Enigma to encrypt that file key using an existing AES key on the stick.
The resulting .seal file contains the encrypted file key and encrypted chunks. Decryption asks Enigma to recover the file key, then uses that key on the host to decrypt the file.
The file encryption key exists in host memory. The persistent AES key used to protect it stays in the secure element. File contents are encrypted on your computer.
Build and prepare
Once the source is public, check out the host library beside Seal. The current Cargo configuration uses a sibling path dependency.
enigma/
├── enigma-host/
└── enigma-seal/cd enigma-seal
cargo build --release
./target/release/enigma-seal --helpCreate an AES-256 ENCRYPT key first, for example with the CLI. Seal looks up exactly one key matching the label you supply; it does not automatically create one.
Encrypt a file
These examples assume the binary is on your PATH and that a key labeled file-key exists on Enigma.
enigma-seal --encrypt --path notes.txt --label file-keySeal writes notes.txt.seal. It prompts for your PIN if the device is locked. The original plaintext file remains on disk.
Decrypt a file
enigma-seal --decrypt --path notes.txt.seal --label file-keyThe decrypted output is written to notes.txt. Keep a copy of your input files when experimenting: the current tool can overwrite the output path.
Current behavior
Seal is an early command-line application. Although the file format uses chunks, the current implementation reads the whole input file into memory. It is not a streaming implementation.
Decryption requires the encrypted file and the original AES key on Enigma. Generating another key with the same label will not recover the file. The firmware does not currently expose general private-key or symmetric-key backup/export.
See mechanisms and limits for the device-side operations.