No invented ciphers, nothing exotic to get wrong: AES-256-GCM for content, Argon2id to turn your credential into a key, HKDF-SHA256 to separate the keys Kistvault needs, and X25519 for the pairing handshake.
The threat it solves
Hand-rolled or outdated crypto — weak KDFs, legacy modes, home-grown schemes. These are the classic ways vaults fail. Kistvault sticks to primitives you can look up and reason about.
The key hierarchy
- Content keys encrypt your files and metadata with AES-256-GCM (96-bit nonce, 128-bit tag).
- A key-encryption key comes from Argon2id over your password or pattern, and wraps the random master key.
- Subkeys are separated from one root with HKDF-SHA256 — including the key your Recovery Kit unlocks.
- Pairing establishes trust and moves key material with X25519, between your devices only.
What we won't pretend
A vault is only as strong as its weakest enrolled credential: a simple pattern and a strong password share one lock. Argon2id raises the cost of every guess, but it can't make a short secret long. And if you lose every credential and your Recovery Kit, there is no backdoor — that's the same math that keeps everyone else out, working as intended.
Questions
Why Argon2id over PBKDF2?
Memory-hard derivation resists GPU/ASIC cracking far better than iteration-count KDFs.
What's HKDF for?
Separating the keys Kistvault needs from one root, so a single leak doesn't expose all of them.
The honest limits?
Weakest-credential sets the strength; no backdoor if everything is lost.