SECURITY.md

# Security Notes

HVCE v4 includes password-based authenticated encryption, but it is a reference implementation, not a professionally audited security product.

## Password mode

The archive encrypts the private manifest and payload together. File names and directory structure are not visible without the password.

Primitive stack:

```text
PBKDF2-HMAC-SHA256 -> 64 bytes
32-byte key 1 -> ChaCha20 stream encryption
32-byte key 2 -> HMAC-SHA256 authentication
```

Default KDF iterations: `300000`.

Use:

```bash
python hvce.py compress folder secure.hvce --ask-password --recovery-percent 10
python hvce.py extract secure.hvce restored --ask-password
```

## Why symmetric-only is used

The v4 “post-quantum” security stance avoids RSA/ECC public-key wrapping in the archive format. Symmetric 256-bit keys retain a large margin against generic quantum search, assuming strong passwords and sufficient KDF work.

## Threat model

Provides:

- confidentiality against attackers without the password;
- filename and metadata privacy when encrypted;
- tamper detection before decryption;
- extraction verification with SHA-256;
- recovery against limited storage corruption when recovery records are present.

Does not provide:

- protection from weak passwords;
- protection from malware on the machine that captures passwords;
- deniable encryption;
- independently audited cryptographic assurance;
- legal/compliance certification.

## Recommended use

For important personal archives, use:

```bash
python hvce.py compress input output.secure.hvce --profile balanced --ask-password --recovery-percent 10
```

Keep at least one external backup. Recovery records are not a substitute for backups.