Scheduled
8 min read By NT²
Wrong password must fail closed
Tech
Unlock is not a best-effort decrypt of everything you own. NT² checks a small local verifier first. Wrong password fails closed: the vault stays locked, and the UI stays honest.
Tagged: aes-gcm
5 posts
Scheduled
9 min read By NT²
CBF is how structured fields leave RAM
Tech
A credential is a map of fields while you edit it. The moment those fields must survive a lock, a restart, or a replica, they need a portable ciphertext shape—not a JSON dump waiting for the next reader.
Scheduled
8 min read By NT²
Share passphrase ≠ master password
Tech
A share that opens with the same secret that unlocks the vault is not a handoff. It is a remote unlock of everything. NT² keeps those boundaries apart.
Scheduled
7 min read By NT²
Metadata in SQLite, ciphertext in BlobStore
Tech
A vault needs to know which files belong to which items, how large they are, and how to unwrap their keys. It does not need those encrypted bytes sitting inside the relational database that answers those questions.
9 min read By NT²
One key per object: envelope encryption inside NT² Vault
Tech
A vault can encrypt everything with one key and still claim that its data is encrypted. We wanted a more useful boundary: each item and attachment gets its own content encryption key, while the vault key protects those keys.