v0.5.0 — three implementations, one format

Client-side encrypted vault for Google Drive: an Android app, a web console, and an Avalonia desktop app over one format — implemented three times independently (TypeScript, Kotlin, C#) and held to shared test vectors plus a live three-way interop pass over one real folder.

Pre-alpha, unaudited, and it has never talked to real Google. The format is complete and verified across the three implementations, but nothing here has had an independent security review, and both Drive backends have only ever run against fakes. Do not put data in this that you cannot afford to lose. If you want a vault today, use Cryptomator.

What's in v0.5.0

The OBSCURA-1 format. Content in 256 KiB AES-256-GCM chunks bound to the file header, the chunk index, and the total chunk count; filenames under AES-256-GCM-SIV keyed per directory; the folder tree flattened into HMAC-derived buckets, so the storage provider holds opaque blobs with opaque names. Master keys are generated on-device and wrapped once per unlock method — password (Argon2id), 24-word BIP-39 recovery phrase, WebAuthn PRF, Android Keystore.

Three clients. A web console (crypto in a Web Worker, strict CSP), an Android app in two flavours — foss compiles zero Google code, asserted by scanning the built APK's dex — and a desktop app. A vault written by any one of them opens in the other two; CI proves it on every push with a live C# → TypeScript → Kotlin → C# pass over a real folder.

A zero-knowledge server. Accounts, MFA, and opaque wrapped key blobs. Compromising it yields no plaintext and no keys. Sessions rotate with reuse detection; the key-wrap endpoint is MFA-gated, rate-limited, and audited.

Sealed key backups. An offline file cannot be rate-limited, so the lever is cost per guess: backups seal under Argon2id at 512 MiB — roughly 8× the vault's interactive cost — or under the recovery phrase, where there is no password to guess at all.

A security pass with teeth. Five real findings fixed this cycle, including over-long filenames that were stored but invisible to every listing and silently omitted from vault export, and Argon2 cost parameters accepted unchecked from attacker-editable files — a permanent-lockout denial of service. Details in docs/ENGINEERING-NOTES.md.

The Reactive UI. An optional high-motion console mode — off by default, remembered per browser, scoped so switching it off restores the classic interface exactly.

Verified

pwsh tools/verify.ps1 → ALL CHECKS PASSED: 255 crypto tests · 59 server tests · 212 Kotlin checks · 98 C# vector checks · both Android variants + lint · desktop build · live three-way interop · secret scan. The same gate runs in CI on every push.

Known limits

The Android app runs on an emulator, not yet on a phone — Keystore/StrongBox and biometric enrolment are unexercised. WebAuthn typechecks but has no browser E2E. No release binaries are attached: build from source (npm ci && npm run verify, ./gradlew :app:assembleFossDebug, dotnet run --project desktop/Obscura.Desktop).

Licensed AGPL-3.0-only. Under §13, serving a modified copy over a network obliges you to offer its source to the people using it.