Crypt-in developer beta — 2026-10-14

Hardware-backed file encryption on an ESP32-S3 dongle. Read the
README before running anything — in particular what a -dev unit
means and which findings carry over to the product.

This release changes the app, not the firmware

The firmware inside is byte-identical to beta-2026-10-13 (90d0cd9, sha256
below). What changed is the Windows app and the updater: fixes found while we ran the
update from beta-2026-09-24 ourselves, on a beta unit, against production.

• Your dongle runs beta-2026-10-13? Replace the app folder with this package.
  Nothing to flash, no transfer: your dongle, your licence and your files stay as
  they are.
• Your dongle still runs beta-2026-09-24? Update it from this package's
  Transfer license, as described in the README under Updating from beta-2026-09-24.
  Not with the command-line updater.

What changed

where	what it did before	what it does now
Setup → Program, on a chip that is already a dongle	Asked before overwriting, without saying that an update is done elsewhere. Answering yes gave the dongle 24 new words and no licence.	The question says it: updating a dongle you already use → answer No and use Transfer license.
Transfer license → Program	Same question, same words.	Says that for an update of the same dongle Yes is the right answer.
Command-line updater, on a chip that is already a dongle	Refused, without saying what to do instead.	Refuses, and says: do not add --force, use Transfer license.
Setup, when programming fails	Always "try another USB port" — even when the updater had refused the image before touching the chip.	Shows the updater's own reason, as Transfer license and Backup already did.
Updater error messages	Seven of them were still in Italian, and they reach the app's dialogs.	English.
Licence step, right after an activation	If the dongle refused the new licence token while the server check did not see the licence yet, the refusal was not shown.	Shown, in red, under Activate now.
End of Transfer license	The expiry date was shown in local time, unlike the rest of the app.	UTC, like everywhere else.
Recovery, step 1	A dashed box that said "Photo of the UART socket goes here".	A drawing of the board with the cable in the UART socket.

Seen running on a beta unit: the setup question and the drawing, from this package;
the failure reason and the English messages, from the same code in a development build.
Compiled and reviewed only: the Transfer license wording and the command-line
updater's new sentence (we did not walk those paths again for this release), and the
licence-token message and the expiry date (seeing them means spending a real licence
transfer in production).

Not a defect, and nothing to fix: if your dongle seems to vanish after a reset and
you run VMware Workstation, its USB Arbitration Service is holding the device
while it waits for you to choose host or VM. Set Edit → Preferences → USB to connect
new devices to the host.

Files

file	what it is	sha256
cryptin-beta-2026-10-14-1131.zip	the product. Talks to production	640796c1167c4a416413f967d5b948a28289cd20abafd87995b67e6ed9bf2582
SHA256SUMS.txt	published separately on purpose — you should be able to check the hashes without having to trust the archive you just downloaded	—

The firmware inside, firmware\firmware.factory.bin, has sha256
f66a17cd7a03a13fa11e1e98babfface423d00e69114d1ae8b25526f9e94df9d (version 90d0cd9),
the same as in beta-2026-10-13.

Verify before you run

Select-String -Path .\SHA256SUMS.txt -Pattern '([0-9a-f]{64})\s+(.+)' | ForEach-Object {
  $h = $_.Matches[0].Groups[1].Value
  $f = $_.Matches[0].Groups[2].Value.Trim()
  $a = (Get-FileHash $f -Algorithm SHA256).Hash
  "{0}  {1}" -f $(if ($a -eq $h) { 'OK     ' } else { 'DIFFERS' }), $f
}

Six OK lines — one more than before: the drawing, uart_cable.png. Five is not a pass.

Before you double-click

• The executables are not signed: "Windows protected your PC" → More info →
  Run anyway.
• Do not run as administrator. It bypasses nothing and makes the prompt worse.
• Windows 11 or later, 64-bit. Nothing to install.

Hardware

ESP32-S3 with native USB, flash ≥ 8 MB sustaining QIO 80 MHz, and
two USB-C ports (flashing goes over UART, where RTS drives EN). Reference
board: N16R8 — and neither the 16 MB nor the PSRAM is required. Details in
the README.

Found something?

Open an issue. Security-relevant reports follow the disclosure policy:
7 days to acknowledge, 21 to assess, 90 to fix.

Crypt-in developer beta — 2026-10-13

Superseded by beta-2026-10-14 — same firmware, fixed app. If your dongle runs this release, replace the app folder: nothing to flash.

Hardware-backed file encryption on an ESP32-S3 dongle. Read the
README before running anything — in particular what a -dev unit
means and which findings carry over to the product.

⚠️ This release replaces beta-2026-09-24 — update your dongle

Seven red-team rounds (8–11 October 2026) found defects in the firmware of
beta-2026-09-24, two of them rated High (F1: Ed25519 nonce reuse in
CMD_CHALLENGE; H1: a malformed USB control request replayed the last report,
VERIFY_PIN included). This release fixes all nine. The full list, with
severities, is in the README under What changed in beta-2026-10-13.

Update from the new app's Transfer license, not with the command-line updater.
It writes the new firmware, puts your 24 words back and moves your licence; your PIN
and your files stay yours. Steps in the README under Updating from beta-2026-09-24.

Also in this release: .crin format version 2 (standard AES-GCM, authenticated
header). Version 1 files still open; the dongle writes only version 2.

Files

file	what it is	sha256
cryptin-beta-2026-10-12-1719.zip	the product. Talks to production	b787a555c69cd394746854ef31b0e47b743ca718777259b5ebfee18ea0d2ec7f
SHA256SUMS.txt	published separately on purpose — you should be able to check the hashes without having to trust the archive you just downloaded	—

The firmware inside, firmware\firmware.factory.bin, has sha256
f66a17cd7a03a13fa11e1e98babfface423d00e69114d1ae8b25526f9e94df9d (version 90d0cd9).

Verify before you run

Select-String -Path .\SHA256SUMS.txt -Pattern '([0-9a-f]{64})\s+(.+)' | ForEach-Object {
  $h = $_.Matches[0].Groups[1].Value
  $f = $_.Matches[0].Groups[2].Value.Trim()
  $a = (Get-FileHash $f -Algorithm SHA256).Hash
  "{0}  {1}" -f $(if ($a -eq $h) { 'OK     ' } else { 'DIFFERS' }), $f
}

Five OK lines. Four is not a pass.

Before you double-click

• The executables are not signed: "Windows protected your PC" → More info →
  Run anyway.
• Do not run as administrator. It bypasses nothing and makes the prompt worse.
• Windows 11 or later, 64-bit. Nothing to install.

Hardware

ESP32-S3 with native USB, flash ≥ 8 MB sustaining QIO 80 MHz, and
two USB-C ports (flashing goes over UART, where RTS drives EN). Reference
board: N16R8 — and neither the 16 MB nor the PSRAM is required. Details in
the README.

Found something?

Open an issue. Security-relevant reports follow the disclosure policy:
7 days to acknowledge, 21 to assess, 90 to fix.

Crypt-in developer beta — 2026-09-24

⚠️ Superseded by beta-2026-10-13. The firmware in this package has known defects, two rated High. If you flashed a dongle from it, update — see the README.

Hardware-backed file encryption on an ESP32-S3 dongle. Read the
README before running anything — in particular what a -dev unit
means and which findings carry over to the product.

Files

file	what it is	sha256
cryptin-beta-2026-09-24-2208.zip	the product. Talks to production	bde28b01bd2d2ec0407178f70390e438142d71bddaddfba981610f469aee2bed
SHA256SUMS.txt	published separately on purpose — you should be able to check the hashes without having to trust the archive you just downloaded	—

⚠️ Use the SHA256SUMS.txt to verify before running — see the README. The zip
contains unsigned executables that flash hardware, which is exactly what a careful
person checks first.

Verify before you run

Select-String -Path .\SHA256SUMS.txt -Pattern '([0-9a-f]{64})\s+(.+)' | ForEach-Object {
  $h = $_.Matches[0].Groups[1].Value
  $f = $_.Matches[0].Groups[2].Value.Trim()
  $a = (Get-FileHash $f -Algorithm SHA256).Hash
  "{0}  {1}" -f $(if ($a -eq $h) { 'OK     ' } else { 'DIFFERS' }), $f
}

Five OK lines. Four is not a pass.

Before you double-click

• The executables are not signed: "Windows protected your PC" → More info →
  Run anyway.
• Do not run as administrator. It bypasses nothing and makes the prompt worse.
• Windows 11 or later, 64-bit. Nothing to install.

Hardware

ESP32-S3 with native USB, flash ≥ 8 MB sustaining QIO 80 MHz, and
two USB-C ports (flashing goes over UART, where RTS drives EN). Reference
board: N16R8 — and neither the 16 MB nor the PSRAM is required. Details in
the README.

Found something?

Open an issue. Security-relevant reports follow the disclosure policy:
7 days to acknowledge, 21 to assess, 90 to fix.