SeedPass/memory-update.md

Memory Update (2026-02-25)

Security Item 2 Progress

• Raised PBKDF2 default policy for new profiles from 50_000 to 200_000 via ConfigManager.DEFAULT_PBKDF2_ITERATIONS.
• Added policy-floor enforcement in PasswordManager._get_kdf_iterations() so downgraded configured values are ignored during normal seed-key derivation.
• Kept unlock backward compatibility for legacy profiles by preserving fallback attempts for 50_000 and 100_000 iterations.

KDF Metadata Consistency

• Added PasswordManager._build_seed_kdf_config(...) and wired all seed re-encryption callsites to persist explicit KDF metadata (pbkdf2 or argon2id) matching active derivation policy.

Plaintext Export Safeguard

• Hardened handle_export_database interactive flow: plaintext export now requires explicit warning + second confirmation.
• Added audit metadata for backup exports (encryption_mode field).

Nonce Lifecycle Decision

• Removed CRC32 nonce tracking from EncryptionManager.encrypt_data.
• Policy now relies on fresh random 96-bit AES-GCM nonces per encryption call to avoid CRC false positives and in-memory collision bookkeeping.

Added/Updated Tests

• Expanded src/tests/test_kdf_modes.py with negatives for:
  • wrong Argon2 params on unlock,
  • tampered KDF wrapper payload,
  • downgraded KDF policy attempt (floor enforcement).
• Added src/tests/test_export_plaintext_policy.py for double-confirm plaintext export guard.
• Updated expectations in test_config_manager.py and test_kdf_strength_slider.py for new PBKDF2 baseline.

Validation

• Ran targeted suite:
  • src/tests/test_kdf_modes.py
  • src/tests/test_export_plaintext_policy.py
  • src/tests/test_config_manager.py
  • src/tests/test_kdf_strength_slider.py
  • src/tests/test_noninteractive_init_unlock.py
  • src/tests/test_password_unlock_after_change.py
• Result: 28 passed.