Home

Secure Package V14 Wiki

Secure Package V14 is an open-source encrypted project package engine built around authenticated cryptography, explicit key separation, fail-closed parsing, resource-bounded processing, safe restore semantics, and a separately isolated browser compatibility boundary.

Current application version: 14.1.0
Server package format: SECURE-PKG-V14
Portable package extension: .spkg14
Legacy browser format: SECURE-BROWSER-V13 / .spk13
Runtime: PHP 8.2+ with Sodium and Zip required for the main server workspace
License: MIT
Author: ElmanCod110

---

What is Secure Package V14?

Secure Package is designed to protect project directories as portable encrypted packages while treating cryptography, metadata parsing, archive handling, filesystem operations, authentication, resource limits, and release integrity as one security boundary.

The central design decision in V14 is that user credentials are not used directly as the long-lived file-encryption key. Instead:

1. A fresh random 256-bit package root key is generated for every package.
2. The password and pattern independently derive credential keys with Argon2id13.
3. Those credential-derived values are combined with HKDF-SHA-256 into a credential wrapping key.
4. The wrapping key protects the random package root key inside an authenticated primary key slot.
5. A separate random recovery key can independently wrap the same package root key.
6. HKDF derives dedicated subkeys for manifests, encrypted filenames, and file encryption.
7. Each file receives a dedicated key derived from the file key root and its record identifier.
8. File contents are encrypted as authenticated secretstream records.
9. The complete ciphertext inventory is hashed and represented by a Merkle root.
10. Restore is allowed only after package, metadata, ciphertext, Merkle, hierarchy, and path-safety checks succeed.

This architecture deliberately separates concerns rather than relying on a single "master password directly encrypts everything" construction.

Security model at a glance

Secure Package V14 is designed to defend against attackers who can manipulate package bytes, submit malformed metadata, tamper with ciphertext, replay operation identifiers, attempt unsafe archive paths, perform repeated credential attempts, or replace release artifacts.

Important non-goals include protection against a fully compromised host, malware already executing with equivalent privileges, recovery of forgotten credentials, recovery of a lost recovery key, or a universal guarantee against every side channel or implementation flaw.

V14 is a security-engineering baseline, not a certification claim and not a percentage security score.

Documentation map

Start here

• Getting Started — run the project locally and create your first V14 package.
• Architecture — understand the application layers and the end-to-end data flow.
• Cryptography V14 — deep explanation of the cryptographic construction.
• Package Format V14 — exact package layout and record model.

Security internals

• Key Management — credential wrapping, root keys, recovery, subkeys, and zeroization.
• Integrity and Tamper Detection — header binding, authenticated records, blob hashes, and Merkle verification.
• Secure Restore — preflight validation, path safety, no-overwrite behavior, and atomic output.
• Archive and Upload Security — resumable uploads, ZIP inspection, nested archive controls, and resource limits.
• Authentication and Web Security — sessions, CSRF, origin checks, rate limiting, ownership, and browser security headers.
• Threat Model — assets, adversaries, goals, non-goals, controls, and residual risk.

Integration and operations

• API Reference — actions exposed by public/api.php.
• CLI Reference — command-line helpers and release utilities.
• Browser V13 Compatibility — the intentionally separate browser vault boundary.
• Storage and Data Lifecycle — what is stored, where it lives, and how temporary data is handled.
• Deployment — production configuration and operational hardening.
• Testing and Validation — regression, adversarial, syntax, and environment evidence.
• Release and Supply Chain — signing, verification, Composer policy, and release gates.
• Migration V13 to V14 — explicit compatibility and migration rules.
• Development Guide — repository conventions and safe contribution workflow.
• Troubleshooting — common environment and runtime problems.

Core properties

Property	V14 behavior
Credential KDF	Argon2id13 through libsodium
Credential separation	Independent password + pattern derivation
Package root key	Fresh random 256-bit key per package
Key wrapping	XChaCha20-Poly1305-IETF
Metadata encryption	XChaCha20-Poly1305-IETF
File encryption	secretstream_xchacha20poly1305
Key separation	HKDF-SHA-256
Filename protection	Authenticated encrypted names
Ciphertext integrity	SHA-256 per blob
Package integrity	SHA-256 Merkle root
Restore policy	Fail closed; no overwrite
Archive safety	Path validation + entry/size/depth limits
Uploads	Resumable, owner-bound, optional SHA-256 verification
Audit trail	JSONL + SHA-256 hash chain
Release trust	Ed25519 signatures + optional external trust root
Browser compatibility	Isolated V13 design

Security principle

The project does not assume that encryption alone is sufficient. The actual security boundary extends from the moment untrusted bytes arrive at the server through parsing, authentication, cryptographic verification, filesystem restoration, and release distribution.

A useful mental model is:

untrusted input -> validation -> authenticated state -> authenticated decryption -> integrity verification -> preflight -> atomic restore

Any failure on that path should stop the operation rather than silently producing partial or ambiguous output.