KeyPlus security design

This page describes the in-development KeyPlus 0.3 implementation. It is a technical description, not a claim that KeyPlus is secure against every threat. KeyPlus has not received an independent security audit or formal analysis.

Cryptographic design

For each new vault, KeyPlus generates a random 16-byte salt. It derives a 32-byte key from the UTF-8 master password with Argon2id using the parameters stored in the vault envelope. The current defaults are:

The derived key encrypts the serialized vault document with AES-256-GCM and a new random 12-byte nonce. Authenticated associated data covers the format name, format version, KDF name and parameters, and cipher name. The salt, nonce, KDF parameters, format metadata, and ciphertext are stored in the JSON envelope; credential records and their metadata are inside the encrypted payload.

KeyPlus does not store a separate password verifier in the 0.3 format. Successful AES-GCM authenticated decryption unlocks the vault. A wrong password and modified authenticated ciphertext both produce the same general unlock failure. Structural JSON or unsupported-version errors may be reported separately before password derivation.

Randomness and key handling

Salt and nonce generation use the operating system through os.urandom. Argon2id is provided by argon2-cffi; AES-GCM is provided by the cryptography library. KeyPlus does not implement a custom cipher.

After unlock, a mutable copy of the derived key and the decrypted vault document remain in the Python process so operations can run without repeatedly asking for the master password. Logout or timeout overwrites that mutable key buffer as a best effort and drops session references. Python, its dependencies, the operating system, and swap may create copies that KeyPlus cannot reliably find or erase. KeyPlus does not claim secure memory zeroization.

Files, clipboard, and displayed secrets

On POSIX systems KeyPlus explicitly applies mode 0700 to its private data directories and 0600 to vault and backup files. Windows access control is left to the user’s profile and operating-system defaults.

The GUI displays a selected entry’s password as readable text. Its read-only field can be copied using normal operating-system controls. The CLI view command prints the password. KeyPlus does not automatically clear the clipboard, terminal scrollback, screenshots, or clipboard-manager history.

Backups are encrypted vault files rather than plaintext exports. KeyPlus does not currently implement plaintext import/export, cloud synchronization, telemetry, analytics, crash reporting, remote APIs, or application-managed update checks. Package managers and Store clients may use the network outside the KeyPlus application process to install or refresh packages.

Security boundaries

Vault encryption does not protect secrets after they are displayed or while an unlocked process is using them. It does not defend against malware running as the user, keyloggers, screen capture, a compromised operating-system account, weak master passwords, malicious dependencies, or every software defect. Argon2id and AES-GCM describe the construction used; their presence alone does not establish overall application security.

Report suspected vulnerabilities through a private GitHub security advisory. Never attach a real vault, master password, or credential to a report.