spt-vault

Quantum-resistant password vault with AES-256-GCM encryption and redb storage

Overview

spt-vault provides a secure password management system using AES-256-GCM authenticated encryption with Argon2id key derivation (64MB memory, 3 iterations) and redb-backed crash-safe persistent storage. It supports categorized secret organization, hardware key attestation with trust tiers, and automatic zeroization of sensitive data on drop. A pq feature flag is reserved for future ML-KEM/ML-DSA integration.

Key Features

• AES-256-GCM encryption -- authenticated encryption for all stored secrets
• Argon2id KDF -- memory-hard password-based key derivation (64MB, 3 iterations)
• Redb storage -- persistent, crash-safe secret storage with category organization
• Hardware attestation -- SecureKeyStore with trust tiers (SE/TPM/StrongBox/TEE/software)
• Memory safety -- SensitiveString and VaultKeyPair with automatic zeroization on drop
• PQ-ready -- pq feature flag for future post-quantum integration

Dependencies

No internal SPT crate dependencies. Uses aes-gcm for encryption, argon2 for KDF, redb for storage, zeroize for memory safety.

Usage

use spt_vault::{Vault, VaultError};

let mut vault = Vault::create("my.vault", "master_password")?;
vault.add_secret("email/work", "user@example.com", Some("password123"))?;
let secret = vault.get_secret("email/work")?;

API Reference

Core Types

Type	Description
Vault	Main vault struct -- create, open, add/get/list secrets
VaultCrypto	AES-256-GCM encryption/decryption operations
VaultKeyPair	Encryption key pair with zeroize-on-drop
SecretEntry	A stored secret with username, password, metadata
SecretMetadata	Timestamps, category, and notes for a secret
SensitiveString	Zeroize-on-drop string wrapper
SecureKeyStore	Hardware-backed key storage with attestation
TrustTier	Hardware trust level (SE, TPM, StrongBox, TEE, Software)
KeyAlgorithm	Supported key algorithms
VaultError	Crate error type

Feature Flags

Feature	Default	Description
storage	yes	Redb-backed persistent storage
pq	no	Reserved for future ML-KEM/ML-DSA integration