Joe Julian
32 lines
1.7 KiB
Markdown
32 lines
1.7 KiB
Markdown
# KDBX Security Compatibility
|
|
|
|
KeePassGO supports the following KDBX security workflows today:
|
|
|
|
- open and save password-only vaults
|
|
- open and save key-file-only vaults
|
|
- open and save composite password-plus-key-file vaults
|
|
- select the active master-key mode in the product UI for create, open, and unlock flows
|
|
- change an existing session to a new master-key mode before saving
|
|
- preserve the original opened vault's KDBX format version during save
|
|
- preserve the original opened vault's cipher selection during save
|
|
- preserve the original opened vault's KDF selection during save
|
|
- choose the cipher family for new vault creation
|
|
- choose the KDF family for new vault creation
|
|
- change the cipher family and KDF family for an existing unlocked session before the next save
|
|
|
|
What "preserve" means:
|
|
|
|
- if a vault is opened through a managed session and then saved, KeePassGO reuses the opened vault's KDBX header configuration instead of replacing it with default header settings
|
|
- this applies to local and WebDAV-backed vault sessions
|
|
|
|
Current explicit limitations:
|
|
|
|
- KeePassGO currently exposes major cipher/KDF family choices, not every low-level tuning parameter from KeePass
|
|
- advanced KDF tuning such as custom Argon2 memory/parallelism and AES-KDF round-count editing is not yet a product-facing control
|
|
- unsupported or unknown header fields outside the preserved header structures are not guaranteed to round-trip if they are not represented by the underlying library
|
|
|
|
Practical expectation:
|
|
|
|
- existing KeePass/KeePass2Android-compatible vaults keep their major format, cipher, and KDF family when edited and saved through KeePassGO
|
|
- KeePassGO now lets a user select the major cipher/KDF family, while still avoiding a full low-level database-header editor
|