Advanced inner-database ciphers

Managed sorng-db version 1 containers support twofish-256-eax and serpent-256-eax as optional advanced alternatives. AES-256-GCM remains the default; AES-256-GCM and ChaCha20-Poly1305 remain recommended. These identifiers describe the exact authenticated construction, not bare block ciphers and not VeraCrypt-compatible volumes.

Both alternatives use a random 32-byte database data key, a fresh random 16-byte nonce for each payload write, and a full 16-byte EAX authentication tag. The authenticated header continues to bind the format/version, database identity, key identity, security revision, selected algorithm, and complete key-slot manifest. An algorithm change uses the existing verified transaction and CAS barrier. Unsupported algorithms or invalid nonce lengths fail closed. Existing AES/ChaCha containers retain their 12-byte data nonces. Password and OS-vault key slots still use AES-256-GCM with 12-byte nonces; global artifact encryption is unchanged. Older builds that do not recognize the new algorithm IDs cannot open these containers; migrate to a supported algorithm before using an older build.

Dependencies and limitations

The pinned implementation is RustCrypto eax = 0.5.0 (alloc, aead 0.5 / cipher 0.4), twofish = 0.7.1 (zeroize) and serpent = 0.5.0 (zeroize). EAX is an established generic authenticated mode; no cipher, mode, or crypto dependency is vendored or modified. The private Serpent256 adapter changes only the type-level key size from Serpent 0.5’s 16-byte default to 32 bytes and delegates key initialization and block encryption to that crate’s existing implementation.

These are software-only alternatives. We do not claim an independent security audit of these combinations, constant-time execution, stronger protection than the defaults, or complete key-memory zeroization. The block-cipher zeroize features clear their key schedules on drop, but EAX 0.5 retains an internal, short-lived raw-key copy without its own zeroizing drop implementation. This limitation is not concealed by the application’s zeroizing database-key wrapper. Keep the recommended defaults unless you specifically need an alternative.

Primary implementation references: EAX generic mode API, Twofish 0.7.1 source, Serpent 0.5.0 manifest, and the EAX authors’ publication.

Independent fixed-vector verification

src-tauri/crates/sorng-encryption/tests/fixtures/database-eax-bouncycastle-2.6.2.json contains eight fixed vectors independently generated by Bouncy Castle C# 2.6.2: empty data, AAD-only, a partial block and multiple blocks for each algorithm. All use 256-bit keys and 128-bit nonces/tags. The fixture records the exact NuGet package URL plus SHA-256 hashes of the package and the net6.0 oracle assembly. scripts/crypto/generate-database-eax-vectors.ps1 rejects a mismatched assembly, reproduces the vectors on stdout and independently decrypts each result. It uses only public fixture bytes and never reads databases or credentials. The oracle is a development-only tool, not a runtime or Rust-test dependency.

To reproduce, extract BouncyCastle.Cryptography 2.6.2 to a temporary directory, then run the script in PowerShell 7 with -AssemblyPath <directory>/lib/net6.0/BouncyCastle.Cryptography.dll. Compare its JSON to the committed fixture. Rust tests check byte-for-byte encryption and decryption through the production cipher dispatch, tampering, nonce/algorithm validation, persisted save/reopen, destination re-wrapping and password-slot replacement with data-key rotation. Test vectors are not an audit or a claim of external volume-format compatibility.