Info

  • Hardware + cryptography
  • Use case
  • Giantommaso Fogli

Table of contents

  1. I send my accounts over Gmail. Only my partner in New York can open them.
  2. The procedure
  3. What you have now
  4. Why it works
  5. The physical moment is not a flaw
  6. How it works in practice
  7. One last thing, stated precisely
I send my accounts over Gmail. Only my partner in New York can open them.I send my accounts over Gmail. Only my partner in New York can open them.

I send my accounts over Gmail. Only my partner in New York can open them.

02/09/2026 / 5 minutes to read / Tags: hardware, architettura, use case, Crypt-in, crittografia

lake8.dev — Journal | 2 September 2026

There is a way of using Crypt-in that is not in the official documentation, and that works perfectly.

Two twin dongles. An encrypted channel over Gmail.

The procedure

Buy two ESP32-S3 boards for 5 euros each. Flash both with the Crypt-in firmware.

On the first: register, activate the licence, pay the 30 euros a year. On the second: make a backup of the first — the procedure asks for the 24 words of the main dongle and derives an identical one from them, same key material, same PIN. The app then registers the second chip with the server and transfers the entitlement: two operations, a single guided procedure. At this point you have two chips that, as far as encryption is concerned, are the same thing.

Ship the second dongle to your partner in New York. Once. By any courier, registered post, in person if you happen to be going. It does not matter how — what matters is that it arrives physically.

After that, nothing else is ever shipped.

What you have now

You can encrypt a contract in Rome. Attach it to a Gmail message. Upload it to a shared Drive. Copy in anyone you like. Send it out as a broadcast.

Only the dongle in New York can open it. In the rest of the world there is no other chip that can.

Not Google. Not lake8.dev. Not your bank. Not an eavesdropper in the middle, by whatever means. The encrypted file is an opaque object to anyone who does not physically hold one of the two chips.

The public channel no longer matters at all.

Why it works

The two dongles share the same seed. From that seed comes K_identity, the key that identifies the dongle. From K_identity and a random per-file salt comes K_file, the actual encryption key — via HKDF-SHA256, on the chip, without ever leaving the chip.

When New York receives the .crin file, its dongle recognises K_identity as its own, recomputes K_file from the same key material and decrypts. There is no key exchange over the network. There is no handshake. There is no server in the middle. The channel was established the moment the second dongle arrived in New York.

The physical moment is not a flaw

Physically shipping the second dongle looks like a step backwards. It is not.

Any secure exchange system has to establish trust somewhere. Modern systems establish it over the network, with key exchange protocols that protect that initial phase. Crypt-in establishes it physically, once. After that the channel needs no protection at all: the file can travel over Gmail, over WhatsApp, over an FTP server from 1997.

If anything: the more public the channel, the easier it is to use. Nothing to configure. No VPN. No shared server. All that is needed is for the .crin file to reach the other side — by any means whatsoever.

One thing that does not travel with the dongle: the PIN. It has to be communicated separately, by any means, before or after shipping. A dongle intercepted in transit is a useless object without it.

How it works in practice

Before it can work, the second dongle has to be registered once through the app — the procedure transfers the entitlement to the new chip and recognises it by its unique K_attestation. That transfer is included in the 30 euros a year: one backup per calendar year, resetting on 1 January. One licence covers two chips in total — from the third onwards you need a separate licence.

After that step the two chips share the same cryptographic identity and the same licence. Both encrypt. Both decrypt. Rome sends to New York, New York sends to Rome: the channel is bidirectional by nature, and does not require a second licence.

After registration there is no handshake, no periodic check-in, no network dependency. Even if the licence expires, files already encrypted remain openable — the licence governs new encryption, not the decryption of what already exists.

A year of a bidirectional encrypted channel between Rome and New York: 30 euros and two 5-euro chips. No permanent server. No VPN. No NDAs with any infrastructure provider.

One last thing, stated precisely

This setup protects the contents of files on a public channel. It does not protect metadata: who emails you, when, how often — that is visible to Gmail as always, and someone can ask your partner in New York why he is receiving .crin files from Rome.

Nor does it protect the physical dongle: whoever holds one of the two chips can open everything. The threat model lists physical compromise among the things Crypt-in does not solve, because no technology solves them. It is worth knowing before deciding where to keep the dongle and who to share it with.

The honest version of the claim is this: the channel is exactly as secure as the two physical chips. The file on Gmail is irrelevant. The chip in the drawer is the one worth thinking about.

Crypt-in is a product of lake8.dev, a sole-trader software house in San Pietro in Casale, Bologna. The beta starting on 30 September 2026 is for developers: you bring your own ESP32-S3 and flash it yourself. The user-facing version, with ready-made hardware kits and the 30-euro-a-year licence described here, arrives in April 2027. cryptin.lake8.dev

lake8.dev | San Pietro in Casale, Bologna

Written by Giantommaso Fogli for lake8.dev

Rights and attributions

Images, logos and photographs cited or shown in this article are the property of their respective owners. No rights are intended to be violated: materials are used in relation to third-party sources and for commentary purposes.

← Back to journal