When building KryptVault, our core security invariant was simple: **the server must never be able to decrypt user data, even under complete infrastructure compromise.**
Why XChaCha20-Poly1305?
Standard AES-GCM requires strict nonce uniqueness. If a 96-bit nonce is ever reused under the same key, catastrophic key recovery is possible. In a distributed multi-device client environment, managing 96-bit nonces without central coordination is error-prone.
We chose **XChaCha20-Poly1305** because it features a **192-bit extended nonce**. With 192 bits of entropy, nonces can be generated safely using a cryptographically secure random number generator (CSPRNG) with negligible collision probability across trillions of encryptions.
Architecture with Tauri & Rust
Rather than executing cryptographic routines in JavaScript where garbage collection may leave plaintext keys lingering in heap memory, KryptVault executes all cryptographic operations inside a compiled Rust process:
- **Argon2id Key Derivation**: Master passphrases derive master keys using high-memory Argon2id parameters.
- **Libsodium Key Wrapping**: Subkeys are derived per folder and wrapped using authenticated AEAD headers.
- **Zeroization**: Sensitive byte slices implement the `Zeroize` trait, forcing explicit memory wiping upon drop.
The result is a desktop storage client that is both exceptionally fast and provably secure.