Architecture & Security

KeyPlus is an evolving, local-first security tool. We believe in absolute transparency: here is exactly how your data is handled in the current release (v0.2.9.1), the architectural choices made, and how we plan to harden the vault.

Current Cryptographic Blueprint

KeyPlus enforces a strictly offline, local-at-rest encryption flow. Your passwords never touch a network card, and we collect zero cloud telemetry.

🔐 Master Password Verification

When you set up your vault, your master passphrase is processed using PBKDF2-HMAC-SHA256 with a randomly generated 16-byte salt and 100,000 stretching iterations. This derived hash and its salt are saved together locally to verify your identity on future launches, making basic offline brute-force attacks computationally slow.

🔒 Vault Encryption & Fernet

Once authenticated, KeyPlus handles data storage through standard cryptographic primitives rather than custom logic:

• Plaintext JSON entries are encrypted using Fernet (authenticated symmetric encryption).
• The encryption key is derived by hashing your short-lived session token with SHA-256.
• Fernet provides built-in integrity verification. If an outside process tampers with or corrupts even a single byte of your encrypted vault file, KeyPlus catches the signature mismatch and cleanly blocks the payload from loading.

🧠 Short-Lived In-Memory Sessions

To protect your vault from being left completely open on an unattended machine, the session key only lives in active application memory for 60 seconds. Once the timer expires, the session is flushed, and you are immediately prompted to re-enter your master passphrase before running further commands.

Sandbox Confinement & Isolation

Shipping KeyPlus via the Linux Snap Store adds a powerful boundary of runtime security through native app confinement policies:

• File System Sandboxing: Under strict confinement, KeyPlus can only read and write files inside its own explicitly assigned system user directory. It is barred by the kernel from snooping through other software profiles.
• Network Isolation: The app operates without explicit network plug-in permissions. Even if someone managed to inject malicious code into the client workspace, the system physically prevents it from exfiltrating your vault data out to the internet.

Architectural Trade-offs & Security Roadmap

KeyPlus is a lightweight, personal tool under active development. In its current early-stage architecture, there are known trade-offs that we are actively working to harden. We treat these gaps as our engineering roadmap:

1. Key Derivation Hardening (Moving to Argon2id)

• Current State: The vault key is derived via a direct SHA-256 hash of the session text, and verification relies on PBKDF2.
• Roadmap: We are actively refactoring the auth layer to adopt Argon2id for both verification and key derivation, establishing a memory-hard key encryption key (KEK) model decoupled from the password string.

2. Storage Path Consolidation

• Current State: Legacy file modules look for local JSON file tracks in the active runtime directory, while the new relational system builds out a user-local SQLite database.
• Roadmap: Streamlining all storage handlers to strictly map into a single, unified user configuration path (~/.config/keyplus/) to eliminate path risk.

3. CLI Secret Exposure Risk

• Current State: The interactive workspace accepts arguments directly (e.g., add <name> <domain> <password>), which can inadvertently leave plaintext remnants in terminal session command history buffers.
• Roadmap: Introducing hidden, secure standard input prompts for credentials to ensure secrets are never leaked to shell logs or process strings.

Operational Verdict: KeyPlus is built for developers who want a completely minimal, transparent, and understandable offline vault for basic personal organization. It is an evolving tool—not an enterprise cloud service—giving you absolute local ownership over your files.