Implement Zero-Knowledge Encryption Architecture (Argon2id + AES-256-GCM)

[TheKalpeshPawar]

Requirements / Acceptance Criteria

• Key Derivation: Implement Argon2id to derive a 256-bit encryption key from the user's passcode.

• Salt Generation: Generate a cryptographically secure random salt (minimum 16 bytes) for each vault.

• Encryption: Use AES-256-GCM for encrypting the passcode records.

• Initialization Vector (IV): Ensure a unique, random 12-byte IV is generated for every encryption operation.

• Integrity Verification: Verify the GCM authentication tag during decryption to ensure the data has not been modified.

• Memory Hygiene: Implement a mechanism to wipe the derived key and master passcode from memory immediately after use.

---

Technical Specification

• KDF: Argon2id

  • Recommended Parameters:
    • Iterations: 3
    • Memory: 64 MB
    • Parallelism: 4
  • (Adjust based on target device performance)

• Cipher: AES-256 (GCM mode)

• Storage Schema:
  Each record must store the following:

  • Salt
  • IV
  • Ciphertext
  • Authentication Tag