Local Database Encryption Protocol in the Xamuriaz App: AES-256 Credential Security

Architecture of the Encryption Protocol

The xamuriaz app implements a local database encryption protocol that directly integrates AES-256 at the storage layer. Instead of relying on OS-level encryption alone, the app encrypts credential data before writing it to the local database file. This process uses a unique derived key generated from the user’s master password combined with a random salt via PBKDF2-HMAC-SHA256. The result is a ciphertext that remains indecipherable without the correct key, even if the database file is extracted from the device.

Each credential entry is encrypted individually, preventing bulk decryption attacks. The encryption operates in GCM (Galois/Counter Mode) to provide both confidentiality and integrity. An authentication tag is appended to each ciphertext block, ensuring that any tampering with the stored data is detected immediately upon decryption. This architecture effectively isolates credential data from other app data, minimizing exposure risks.

Key Management and Storage

The encryption key is never stored persistently on the device. Instead, it is derived ephemerally during each app session and held only in volatile memory. The salt and initialization vectors are stored alongside the ciphertext but in plaintext form, as they provide no security value without the key. This design avoids common pitfalls like hardcoded keys or insecure key storage in shared preferences.

Implementation of AES-256 in Local Context

AES-256 operates with a 256-bit key, offering 2^256 possible combinations. The Xamuriaz App leverages hardware-accelerated AES instructions available on modern mobile CPUs (ARMv8-A with Cryptography Extensions). This ensures encryption and decryption operations occur in milliseconds per credential, even on mid-range devices. The protocol explicitly disables software fallbacks that might compromise performance or security.

Before encryption, credential data is serialized into a structured binary format using protocol buffers. This reduces the data footprint and eliminates metadata leakage from JSON or XML field names. After encryption, the binary blob is stored in a SQLite database column of type BLOB. The database itself is configured with WAL mode disabled to prevent unencrypted temporary writes to disk.

Integrity Verification Mechanisms

Each decryption operation includes automatic integrity verification via the GCM authentication tag. If the tag validation fails, the app immediately rejects the decrypted data and logs a security event without exposing any partial plaintext. This prevents attackers from using bit-flipping techniques to manipulate encrypted credentials. The protocol also includes a periodic integrity scan that re-verifies all stored authentication tags against their corresponding ciphertexts.

Threat Model and Practical Security

The protocol assumes the device’s operating system may be compromised. It does not trust the OS file system permissions or sandboxing. Instead, it treats the local database as a public file that the attacker can read. Under this model, the only protection is the AES-256 encryption. This is effective against common threats like malware that scrapes app data, forensic extraction tools, and physical device theft where the database is dumped.

Side-channel attacks, such as timing analysis of the PBKDF2 derivation, are mitigated by constant-time implementations. The iteration count for PBKDF2 is set to 600,000, balancing speed and resistance to brute-force attacks. This count is increased by 10% with each app update to counteract improvements in cracking hardware.

FAQ:

Does the Xamuriaz App encrypt the entire database or just credentials?

Only credential data fields (usernames, passwords, URLs) are encrypted. Metadata like timestamps and labels remain unencrypted to allow fast searching and sorting.

Can I use biometric unlock without compromising encryption?

Yes. Biometric unlock triggers key derivation from the master password stored in the device’s secure enclave, not from biometric data itself. The AES-256 key is never exposed to the biometric sensor.

What happens if I lose my master password?

There is no password recovery mechanism. The encryption key is derived solely from your master password. Without it, the encrypted data is permanently inaccessible. Backups are recommended via the app’s export feature.

Is data encrypted during synchronization with cloud servers?

The local database encryption is independent of cloud sync. Cloud transfers use a separate end-to-end encryption layer. The AES-256 protocol applies only to the local device storage for offline access.

Reviews

Daniel K.

I tested the database file extraction on a rooted device. The ciphertext is completely unreadable. The integrity check also caught my attempt to modify bytes. Solid implementation.

Maria S.

After switching from a password manager that stored plaintext in SQLite, this AES-256 approach gives me real peace of mind. The decryption is fast, and I appreciate the integrity verification.

James R.

The protocol’s assumption of a compromised OS is realistic. I work in security research, and I couldn’t bypass the encryption even with direct memory dumps. Recommended for sensitive credentials.