A puncturable-key system with an iOS emergency-puncture companion
Puncturable encryption is the kind of cryptographic primitive that sounds esoteric until the moment you need it, at which point it is the only thing that does what you want. The construction is straightforward: a key generator that lets you "puncture" past tags — after which the key no longer decrypts anything that was encrypted under those punctured tags, but still decrypts everything else. Goldreich-Goldwasser-Micali trees make this efficient. The forward-security property is precisely the one you want for "I lost control of this device and need to revoke past-window access without rotating everything."
puncture is the Go implementation, plus the operational surface around it.
The architecture is unusual on purpose:
goapp/cmd/server— headless HTTP server on port 9122. Provides the GGM puncturable key manager via an API. This is the thing that actually runs.goapp/cmd/desktop— a macOS desktop app that embeds the same server plus a webview and ships as a.dmgfor normal installation. This is the thing a primary user runs.goapp/internal/crypto— the GGM tree itself, the core primitive. Punctures, derivations, and the tag-set bookkeeping.goapp/internal/app— the state machine: providers (key-holders), keys, assets (the encrypted things), and the lifecycle that ties them together.goapp/internal/server— HTTP API plus an embedded web UI for normal operation.goapp/ios/EmergencyPuncture— a native iOS app whose only function is to remotely puncture a provider in an emergency. No browse, no compose, no read. One button. One assertion.
That last component is the design claim. Emergency access surfaces should be different from primary access surfaces. If your primary admin interface and your emergency revocation interface look the same, you have one attack surface, not two. The iOS app deliberately can't do anything except call the puncture API, signed with a key the desktop app provisioned at setup. There is no recovery from a puncture — once a tag is punctured, the corresponding decryption capability is gone forever, including from the puncturing device.
The forward-security property is what makes this safe to put in your pocket. If your phone is stolen the day after you punctured a provider, the attacker gets the iOS app and a phone PIN — neither of which lets them un-puncture anything, because the cryptography doesn't permit it.
goapp/dist/Puncture.app ships as a notarized macOS binary. The DMG installer is built by ./packaging/macos/build_dmg.sh. Persistence is local: frontier, puncture state, provider list, asset metadata all survive restarts in a SQLite file. Nothing leaves the device unless you tell it to.
What becomes possible: a key-management posture where "I lost the device" is a survivable event, not a project.