Cryptographic Specifications

Component	Specification
Key Derivation Function (KDF)	Argon2id (`t=3`, `m=64MB`, `p=4`, `len=32`)
Salt	Cryptographically secure random 16 bytes per database
Cipher	AES-256-GCM (Galois/Counter Mode)
Nonce / IV	12 bytes cryptographically secure random per field
Authentication Tag	16 bytes authentication tag per field
Asymmetric Ciphers	Ed25519 (SSH), X25519 (WireGuard), RSA-4096, PGP
Certificate Engine	X.509 Self-Signed TLS with SAN extension support
In-Memory Protection	Zeroized upon lock or application termination
Clipboard Sanitization	Automatic 30-second wipe for all copied secrets

Updated 2026-10-31