Cryptographic Architecture & Threat Model

Zero-Knowledge Envelope Security

Name: Lokker Vault
Author: Lokker

Lokker uses a 3-tier Envelope Encryption Model (VEK / KEK) designed so that plaintext data exists only in ephemeral client memory.

3-Tier Key Encryption Hierarchy

Decoupled authentication, recovery, and payload encryption

Envelope Model

  Master Password   ──────► Password KEK   ──────┐
  Recovery Key      ──────► Recovery KEK   ──────┼──► Unwrap VEK ──► AES-GCM Encrypted Vault
  Touch ID / PRF    ──────► Biometric KEK  ──────┘

Vault Encryption Key (VEK)

Random 256-bit symmetric key generated via crypto.getRandomValues(). Encrypts and authenticates the entire vault payload directly using AES-GCM 256.

Key Encryption Key (KEK)

Derived via PBKDF2 (SHA-256, 100,000 iterations, 16-byte random salt). Used to securely wrap and unwrap the VEK in client-side memory without exposing master password plaintext.

WebAuthn PRF Hardware Protection

Hardware-bound biometric unlock without password caching

Biometric unlock derives a Biometric KEK directly from hardware authenticator WebAuthn PRF evaluation bytes (eval: { first: salt }).

Your Master Password is NEVER stored or XORed in local storage.

Genuine Offline Recovery Key

256-bit emergency recovery key formatted in readable chunks

Generates an offline emergency key formatted as XXXX-XXXX-XXXX-.... Derives a Recovery KEK via PBKDF2 to unwrap the VEK.

Enables instant vault recovery without requiring server resets or vendor intervention.

AES-GCM Tag Tamper Resistance

Cryptographic authentication on every stored byte

AES-GCM provides authenticated encryption. Any 1-byte mutation of ciphertext, initialization vector (IV), salt, or wrapped VEK triggers immediate authentication tag rejection.

Guarantees that silent record alteration or tampering is mathematically impossible.

Extension Origin Allowlisting

Strict origin validation preventing credential theft

Extension synchronization and autofill messages are strictly filtered against an explicit origin allowlist. Unrelated origins or phishing sites are rejected.

Operates within an isolated Shadow DOM container to prevent host-page JavaScript injection.

Threat Model & Defense Matrix

Threat Vector	Cloud Managers Risk	Lokker Mitigation
Central Server Database Breach	Millions of encrypted vaults exposed in bulk	Zero central database exists; data stays on hardware
Subpoena / Vendor Coercion	Metadata & encrypted blobs seized from vendor	Vendor possesses zero custody or metadata
Malicious Page Script / DOM Scraping	Injects scripts into active credential forms	Isolated Shadow DOM + origin check authorization
Offline Brute Force	Vulnerable if weak KDF parameters used	PBKDF2 100,000 iterations (SHA-256) + 256-bit VEK

Zero-Knowledge Boundary: Optional Cloud & Teams

How our Fastify + Neon DB backend provides sync without compromising local-first privacy

Optional Layer

Client-Side Key Isolation

When you enable optional cloud sync, your device encrypts the vault locally using AES-GCM 256 prior to network transmission. The backend receives only opaque ciphertext blobs. Your master password and derived keys (KEK/VEK) are never transmitted.

RBAC & Team Workspaces

The upcoming team workspace layer enforces Role-Based Access Control (Admins, Managers, Members) at the server API level via Fastify middleware. Even with administrative rights, the server can only coordinate sharing of encrypted keys — plaintext remains strictly zero-knowledge.

Inspect the Cryptographic Source

Lokker is open source. Every primitive and boundary is transparent and auditable.