Skip to content

Vault Encryption

Jump to bottom
Eugeny edited this page Aug 24, 2021 · 2 revisions

Storage

The Vault is stored as a part of the YAML config file in the vault attribute. Ciphertext (base-64), IV (hex), key salt (hex) and format version are saved.

Cryptography

Vault contents are encrypted using AES-256-CBC. Key is derived from the passphrase using PBKDF2 (SHA-512, 64 bit salt). Both IV and key salt are generated from a cryptographically safe random source.

You can review the implementation here: https://github.com/Eugeny/tabby/blob/master/tabby-core/src/services/vault.service.ts#L55-L94

Config encryption

When config encryption is enabled, all config attributes except vault and encrypted are removed from the config and stored inside the vault data instead. Vault must then be decrypted at the app start to load the config.

Clone this wiki locally