# Decryptum threat model

Current development source reviewed 2026-10-07. Scope: Android app, its local storage and integrations, optional debug advisor, manual exports and the static presentation site. This is an engineering model of risks and controls, not a completed vulnerability audit or evidence that scenarios were exploited.

## Overview

Decryptum is a local-first Android vault/TOTP/generator with Autofill and Android 14+ Credential Provider entry points. Compose ViewModels/use cases read repositories backed by Room/SQLCipher. The field DEK is unlocked by a master-password-derived key or a supported biometric cipher. A separate Keystore-wrapped key opens the database. The local analyzer sees unlocked password models and produces local references/counts. The advisor receives a four-integer DTO, not vault objects. There is no hosted vault or sync backend.

| Component | Source (under `app/src/main/java/com/doffi4/doffisecure/`) | Role |
| --- | --- | --- |
| Startup/storage | `DecryptumApplication.kt`, `di/AppModule.kt`, `data/local/database/` | Native library, DI, database open/migration |
| Key/lock control | `security/PasswordCrypto.kt`, `DatabaseKeyManager.kt`, `AppLockManager.kt` | Distinct DB and field keys, unlock and lifetime |
| Vault repositories | `data/repository/PasswordRepositoryImpl.kt`, `PasskeyRepositoryImpl.kt` | Read/write and secret decryption |
| External entry points | `autofill/`, manifest | Framework binding, chooser/auth/save/assertion activities |
| Passkey crypto | `security/webauthn/WebAuthnCryptoEngine.kt` | Software P-256 key generation and WebAuthn structures |
| Export/import | `security/CsvManager.kt`, `ui/password/SettingsViewModel.kt` | Document-provider data transfer |
| Local analysis | `domain/security/`, `ui/security/` | Local heuristics and lifecycle-cleared findings |
| Remote advisor | `domain/advisor/`, `data/advisor/`, debug/release factories | Allowlist, consent, fixed HTTPS transport; release disabled |
| Other exposure | `security/FaviconFetcher.kt`, `SecureClipboard.kt`, `MainActivity.kt` | Icon networking/cache, clipboard and screen policy |

Effective resources and independently enforced boundaries:

| Workflow | Resource/capability | Configuration/precedence | Effective location/value | Readers/writers/recipients | Control / uncertainty |
| --- | --- | --- | --- | --- | --- |
| Database open | Random 32-byte SQLCipher key | `DatabaseKeyManager`; independent of master password | Wrapped blob/IV in private prefs; process cache | App/Keystore/SQLCipher | AES-GCM Keystore wrapper without user-auth requirement; root/app-process compromise exceeds sandbox |
| Modern vault unlock | 256-bit field DEK | Master Argon2id wrapper or biometric RSA-OAEP wrapper | Wrapped prefs; unwrapped key in RAM | Authorized app flow | Biometric CryptoObject in main flow; integration variants need fresh-auth verification |
| Passkey sign/export | Software private key | WebAuthn engine → DEK encryption → repository | Encrypted PKCS8 in DB; may be readable in CSV | App, selected RP/app, chosen export destination | Software/exportable; caller/origin binding and protocol interoperability unverified |
| Debug advisor | One aggregate request | Debug factory reads runtime private file only after consent | `files/claude-advisor.properties`; fixed `https://api.anthropic.com/v1/messages` | Anthropic; caller holds developer key | Four-Int DTO, explicit writer, no redirects/retries, bounded/cancellable response |
| Release advisor | No remote capability | Release factory constructs disabled service | No config read or remote call | None through this feature | Release gate unit test; deployment/provider enablement would change model |
| Icons | Domain fetch/cache | Caller `enabled`; setting not propagated everywhere | Google → DuckDuckGo → direct/apex; local caches | Providers, sites, possible redirect recipients | HTTPS; metadata disclosure persists; no comprehensive network-off control |
| HIBP | Retained range-query transport | Current UI/ViewModel no longer invokes it | Five-hex SHA-1 prefix if reconnected | HIBP | Current center not checked; validation/consent/coverage gate before reconnection |
| Manual export | Unencrypted credential file | User-selected SAF URI | Local or cloud-backed document provider | User/provider/any file reader | No independent encryption; success does not prove complete restore |
| Landing site | Static HTML/CSS/assets | Empty site URL = noindex preview; Pages workflow sets the public origin | `website/dist` | Browser/GitHub Pages; GitHub on navigation | No analytics/backend/remote fonts; theme localStorage only; host logging unknown |

## Assets, trust boundaries and assumptions

Protect vault passwords, account identities, TOTP seeds, private passkeys, DB/DEK/wrapping material, integrity of records/migrations, and exported copies. Availability and recoverability matter alongside confidentiality. A leaked TOTP seed/private passkey is not fixed by clearing an expired displayed code.

Trust boundaries include: device/OS sandbox ↔ app-private files; master/biometric authorization ↔ DEK access; locked ↔ unlocked session and every framework entry point; caller app/site ↔ selected credential; database ↔ import/export/document provider; decrypted source models ↔ local findings ↔ sanitized advisor DTO; network ↔ untrusted responses; maintained source ↔ signed APK/website artifact.

Expected invariants: secrets require current authorization, lock/stop clears sensitive session state, corrupted encrypted input fails visibly, migration never discards the last usable source, credential recipients are validated, network consent/payload matches user disclosure, AI cannot read identities/secrets or mutate the vault, and release artifacts match reviewed source/signing identity. These are goals; existing controls do not establish all of them.

Assume ordinary Android sandbox and Keystore behavior for the baseline attacker. A malicious local app initially lacks the app UID/private filesystem and must use exposed framework/user-authorized surfaces. A filesystem thief does not automatically have live Keystore execution. Root/OS and injected unlocked-process attackers have stronger capabilities and can observe keys/plaintext. A remote provider initially sees only data actually sent; no remote vault-read endpoint is implemented. A network attacker can deny service and observe metadata, but HTTPS limits ordinary transport tampering absent compromised trust/configuration.

No tenant/admin/hosted account model exists. No claim of universally hardware-backed keys, guaranteed zeroization, encrypted portable recovery, proven WebAuthn compliance, independent audit or complete network isolation is made. Historical legacy formats/native migration, actual hardware properties, OEM behavior, accessibility, device/browser compatibility and full restore need verification. [SECURITY.md](../SECURITY.md) lists known gaps; none is a blanket accepted-risk exclusion.

## Attacker stories and mitigations

Priorities below guide investigation, not confirmed vulnerability severity. Source anchors refer to the implementation; native validation remains incomplete.

| Priority | Scenario and capability gain | Prerequisites / impact | Existing controls | Required mitigation/evidence | Source |
| --- | --- | --- | --- | --- | --- |
| Critical gate | Migration failure loses the last usable vault | Legacy plaintext DB; failed conversion or interrupted replacement; availability loss | Source preserved until validated atomic replacement; WAL/schema/export checks | Native crash/low-space/upgrade and rollback fixtures | `data/local/database/DatabaseMigrator.kt` |
| High | Stolen locked phone leaks secret material | File access or bypassed integration authorization; account takeover | DB encryption, modern DEK wrapper, guarded password reads, lock | Verify every auth entry point and legacy path, rate limits and snapshot cleanup; OS lock remains essential | `PasswordCrypto`, `DatabaseKeyManager`, repositories, `autofill/` |
| High | Stolen unlocked phone enables copying/export/signing | App already unlocked; user authority is available | Auto-lock timing and optional integration auth | Minimize unlocked exposure and test fresh-auth/export paths; do not promise protection after authorized unlock | `AppLockManager`, `SettingsViewModel`, auth activities |
| High | Malicious local app receives the wrong credential | Framework selection, heuristic recipient match or incorrect caller/origin binding | Bind permissions, non-exported helper activities, user selection | Validate package/certificate/origin/RP binding; adversarial device/browser tests; consider capability gate | Manifest, `AutofillMatcher`, provider/save/auth activities |
| High | Rooted/compromised OS reads active keys/plaintext | Privileged filesystem/process/input access | Encryption at rest reduces a narrower offline-file threat | Explicitly outside full protection guarantee; minimize plaintext lifetime, test ordinary boundaries separately | Key managers, repositories, UI |
| High | Filesystem theft exposes metadata or enables password attack | Copy of app files; Keystore availability varies | SQLCipher, wrapped field/DB keys | Verify device hardware/legacy behavior and KDF performance; inspect favicon caches/settings exposure | `DatabaseKeyManager`, `PasswordCrypto`, `FaviconFetcher` |
| High | Compromised export exposes all exported credentials | Reader of unencrypted SAF export/provider copy | User chooses destination | Prominent plaintext boundary; implement/test independent encrypted recovery later; verify complete round trip | `CsvManager.export`, `encodePasskeyFields` |
| Medium/High | Clipboard observer copies a secret before clearing | OS-permitted clipboard observation or compromised keyboard/accessibility | Sensitive flag and best-effort ~30s cleanup | Test OS/OEM behavior; avoid unnecessary copies; no guarantee against an observer | `SecureClipboard`, clipboard receivers |
| Medium/High | Screenshot/log observer obtains sensitive context | Other activities, diagnostic logs, accessibility or external camera | MainActivity default FLAG_SECURE | Shared sensitive-screen/log policy; redaction/release checks and real-device tests | `MainActivity`, `autofill/`, existing logs |
| Medium | Network attacker/provider learns service metadata or blocks requests | Icon resolution; HIBP only if reconnected; configured debug advisor | HTTPS, icon cache; advisor time/size limits | Complete caller consent/toggle propagation, strict parsing, traffic capture; no automatic reassuring success | `FaviconFetcher`, `PwnedPasswordsRepository`, advisor transport |
| Medium | Compromised remote AI gives malicious advice or attempts data extraction | Consented configured debug request | No vault dependency, four counts only, no tools/writes/clickable generated links, strict response shape, release disabled | Keep guidance untrusted/manual; transport/lifecycle tests; changing payload/auth model requires review | DTO, codec/service/controller/panel, release factory |
| High | Compromised build/distribution swaps an artifact | Dependency/build/signing or hosting access | Source/lockfile/wrapper hash; static build | Real release key, certificate continuity, checksums, reproducibility and reviewed provenance | `app/build.gradle.kts`, Gradle wrapper, website build |

## Severity calibration

Critical: reachable loss of the only usable vault or unauthorized broad secret/key access. High: recipient-trust/auth bypass, leaked recovery/TOTP/passkey material, unrecoverable upgrades, or unsafe artifacts with concrete exposure. Medium: conditional metadata exposure, incomplete screen/clipboard policy, misleading error/coverage state or untrusted guidance with a plausible consequence. Low: narrowly scoped hardening with no established new privilege or sensitive asset loss.

An already-rooted attacker having privileged access is not itself a new app vulnerability, but reachable ordinary-privilege failures remain reportable. Unknown runtime behavior must stay unknown until tested; source tests alone do not certify AndroidKeyStore, native SQLCipher or framework caller trust.