Data File Security

Password Prompting

On each run, the application will prompt for a password the first time data file access is required. After that, it caches the password for the duration of the current run.

File Encryption

Each time the data file is saved, it's encrypted as follows:

• A random 16 byte salt is generated using a cryptographically secure random number generator
• The user secret (password) is hashed with this salt using Argon2 to generate a 32-byte AES encryption key
• The data to be stored is encrypted using AES using the generated key, with CBC block cipher mode and PKCS7 padding mode
• The salt is written as the first 16 bytes of the file followed by the encrypted data

The Argon2 parameters are specified in the application settings file as follows:

Parameter	Setting	Value
Degree of Parallelism	KeyGenerationParallelism	4
Memory Size	KeyGenerationMemory	262144
Iterations	KeyGenerationIterations	10

These values are designed to provide good protection against brute force attacks while still remaining practical for most desktop machines.