Magic Box
An experimental file-encryption container. AES-256-GCM encrypts the contents; the key is locked behind an embedded repeated-squaring time-lock puzzle. There is no password and no separate key file.
- Current state
- Experimental
- Discipline
- Cryptography
- Built with
- Python / AES-256-GCM / HKDF-SHA256
The idea
Seal a file so that opening it costs a chosen amount of computation: the puzzle, the wrapped key, the nonce and the authenticated ciphertext travel in one .mbox file, and opening needs only the box and its public decoder.
How it works
A fresh 256-bit AES key encrypts the file under AES-256-GCM, which also authenticates the entire header. The key is masked with an HKDF-SHA256 value derived from the end of a repeated-squaring chain modulo a fresh 3072-bit RSA modulus — an RSW time-lock. The sealer, briefly holding the factors, computes the chain's end efficiently; the box records neither the factors nor the plaintext key.
What’s implemented
- seal, inspect and open commands, also runnable as python -m magicbox; sealing requires an explicit --work
- AES-256-GCM authenticates the whole header, including the lock parameters and the wrapped key
- Opening refuses boxes above its work budget (1,000,000 squarings by default) unless the budget is raised explicitly
- Contents are streamed and the format adds exactly 854 bytes; a decrypted destination becomes visible only after its tag verifies
Where it stands
Experimental container · v1
- The lock is a computation delay, not access control: anyone holding the box can solve the public lock and open it
- The work parameter is a computation count, not a guaranteed duration
- Experimental and unaudited; it does not promise secure erasure of Python process memory
Source & resources
Documentation behind this project page
Reviewed October 1, 2026. Project descriptions reflect a source review; repository validation claims were not independently reproduced.