27 lines
1.2 KiB
Markdown
27 lines
1.2 KiB
Markdown
# Security & Cryptography Specification
|
|
|
|
## 1. Master Key Derivation & Credential Management
|
|
|
|
- **Key Derivation Function**: Argon2id
|
|
- Memory: 64 MB (65536 KiB)
|
|
- Time Cost / Iterations: 3
|
|
- Parallelism: 4 threads
|
|
- Salt: Cryptographically secure random 16 bytes generated per initialization.
|
|
- **Key Ring Integration**:
|
|
- **Windows**: Encrypted via DPAPI (CryptProtectData) and stored in Windows Credential Manager.
|
|
- **Linux**: Managed via SecretService API (libsecret / Freedesktop SecretService DBus).
|
|
- **Android**: Generated inside Android KeyStore backed by Hardware-backed Trusted Execution Environment (TEE) / StrongBox.
|
|
|
|
## 2. Local Database Encryption
|
|
|
|
- **Engine**: SQLCipher 4.x
|
|
- **Cipher Algorithm**: AES-256-CBC
|
|
- **Key Derivation**: PBKDF2-HMAC-SHA512 (256,000 iterations default for SQLCipher 4).
|
|
- **Page Authentication**: HMAC-SHA512 per page.
|
|
|
|
## 3. P2P Mesh Network Encryption
|
|
|
|
- **Transport Security Protocol**: Noise Protocol Framework (Noise_XK_25519_ChaChaPoly_BLAKE2s).
|
|
- **Authentication**: Pre-shared 256-bit **Swarm Key** combined with Ed25519 node identity keys.
|
|
- **Peer Exchange Cipher**: Ephemeral Diffie-Hellman (X25519) key exchange + ChaCha20-Poly1305 AEAD payload ciphering.
|