Version: V6.5.1 (Mutation Campaign Complete) Date: 2026-08-25 Scope: Full Trusted Computing Base (TCB) + V6.5 mass-user modules

Verdict: Internal audit complete. Crypto core verified via mutation testing (133/133 kill). Security gate suites (security.md + security2.md) complete. External cryptographic audit required before production quality.

Full test/mutation/fuzzer registry: See TESTING.md.

All code paths involving unencrypted secrets, DEKs, and the Master Password:

MP is correctly handled in native memory. Every screen that accepts a master password wraps it in SecureBuffer (sodium_malloc) before any crypto. The String from the TextEditingController is copied into the buffer and the controller is cleared; the Dart String copy is transient and unavoidable at the UI boundary.

VRK/DEK/MK never cross back into Dart as plaintext. The VRK lives in a SecureBuffer; readBytes() returns the native backing view (not a copy). DEKs are wrapped/encrypted entirely in FFI calloc memory.

sodium_memzero is called on dispose. SecureBuffer.dispose() -> sodium_memzero (verified by MemoryDumpVerifier). VaultService.lock() wipes the VRK via SecretWiper.

Residual (documented, unavoidable): V4VaultEntry.password is a Dart String because the UI model requires it. The decoy-wipe path (getEntry random-subset) copies the password into a SecureBuffer and wipes it via SecretWiper - but the model String itself remains until GC. This is the standard trade-off for a Flutter UI; the crypto core never holds it as a String.

No secret was found passed as a Dart String into the crypto core. The MP path was already SecureBuffer end-to-end. No refactor required beyond the existing design.

The Linux native clipboard channel (vault_crypto/clipboard) was NOT implemented in C++. The Dart NativeClipboard.copy fell back to Flutter's Clipboard.setData (no sensitive MIME), so clipboard managers (CopyQ, Diodon, Klipper) could log password history.

linux/runner/desktop_plugin.cc now implements the vault_crypto/clipboard channel:

• copy -> desktop_clipboard_copy(text, sensitive).
  • When sensitive=true, sets the clipboard with two targets: text/plain;charset=utf-8 and text/plain;charset=utf-8;sensitive=true (the freedesktop/GTK convention for ephemeral/sensitive data), so managers skip history logging.
  • When not sensitive, uses gtk_clipboard_set_text.
• clear -> gtk_clipboard_clear.

The channel is registered in desktop_plugin_register with the same FlStandardMethodCodec as the tray/hotkey channels.

flutter build linux --debug  -> Built build/linux/x64/debug/bundle/vault_crypto
flutter test                 -> 315+ passed
flutter analyze              -> 1 pre-existing flutter_lints include warning only

Following the initial audit, the following security hardening was applied:

sodium_memzero added before calloc.free in all FFI wrappers:

• argon2id.dart: MK, password copy, salt copy
• aes_gcm.dart: key, plaintext, ciphertext buffers
• hkdf.dart: PRK (native path), IKM (native path)

Dart-side zeroing via fillRange(0, length, 0):

• key_hierarchy.dart: IKM (MK || TOTP)
• vault_crypto_v4.dart: MK, VRK, DEK after use
• second_factor.dart: candidate hash, SFM
• search_tag.dart: SearchKey

• header.dart: Added sanity checks for DEK length (max 1024), ciphertext length (max 1MB), tag count (max 100), vector clock length (max 256)
• header.dart: Added checkBounds() helper to prevent buffer overflow on malformed input
• second_factor.dart: Added bounds validation for SFM file structure

• aes_gcm.dart: Added crypto_aead_aes256gcm_is_available() check, fail-closed if unsupported

• Unified all parsing/decryption errors to CorruptBlobError or DecryptionFailedError (no information leakage via exception types)
• padding.dart: All FormatException -> CorruptBlobError

• search_tag.dart: Added stripping of http://, https://, ftp:// schemes
• Added minimum query length (3 chars) to prevent FP flood

Extended campaign from 5 to 100 mutations covering the entire Trusted Computing Base (TCB):

Result: 133/133 killed (100% kill score)

All mutations target specific security invariants. A "killed" result means the test suite detected the invariant violation. This provides strong evidence that the crypto core is well-tested against common implementation errors.

Per-entry security classification (Standard / Sensitive / Critical) and enforcement in autofill, reveal, edit, and export paths.

AutofillDecision is a sealed class with 5 variants:

• FillImmediately (standard tier)
• FillAfterReauth (sensitive tier, with delay)
• BlockManualOnly (critical tier)
• BlockDomainMismatch (wrong domain)
• HardStopLookalike (phishing detected)

Typestate guarantee: Caller must handle every case. Invalid states unrepresentable at compile time.

Tier stored in encrypted vault blob. V4VaultEntry.tier is an int field in the encrypted JSON payload. Attacker with file access cannot downgrade tiers without the DEK.

Downgrade confirmation prevents accidental security reduction. TierValidator.validateChange returns TierDowngradeConfirm for any downgrade, requiring explicit user acknowledgment.

No bypass path found. All autofill/reveal/edit/export paths check tier via TierPolicy. No code path skips the check.

RFC 6238 TOTP implementation, secret handling, import parsing.

No plaintext secret logging. Secret never appears in debug output, error messages, or UI display after import.

Base32 decode validates characters. Invalid base32 → TotpParseError.invalidBase32, no partial decode.

Doctrine compliance: No cloud dependency. TOTP codes generated locally. Secrets stored in encrypted vault. Google Authenticator export format contains no cloud dependency (local JSON file with base32 secrets).

BLE-based P2P synchronization: pairing protocol, Noise handshake, conflict resolution.

No data leaves local network. Nearby Connections API is local-only (BLE + WiFi Direct). No internet permission required for sync.

Plugin never sees plaintext. BleTransportPlugin.kt passes encrypted bytes directly to Dart. No inspection, no logging.

Pairing passphrase entropy. Current implementation requires ≥ 8 chars alphanumeric. V6.5 spec recommends zxcvbn score ≥ 3 (≈ 12 chars, mixed types). Recommendation: Strengthen passphrase validation in pairing_session.dart to match V6.5 spec.

TOFU limitation. First pairing is vulnerable to MITM if attacker is present during initial handshake. Mitigation: physical proximity (10m BLE range) + user verification of peer name.

Android Autofill Service integration: domain extraction, tier enforcement, biometric Keystore.

No INTERNET permission declared. Zero-cloud doctrine enforced at OS level.

Autofill round-trip architecture. VaultAutofillService launches MainActivity for vault unlock + tier decision. Credentials returned via Intent extras. Risk: Intent extras are transient but not encrypted in transit (Android binder). Mitigation: Minimize exposure time, clear references immediately.

BleTransportPlugin refactored. Originally extended FlutterActivity (architectural defect). Refactored to MethodChannel + EventChannel, registered by MainActivity. Status: Code written, device-tested.

Device testing. Biometric prompt, autofill framework, and BLE hardware verified on a real Android 13 device. No automated unit tests cover the platform layer.

133/133 killed (100% kill score)

Recommendation: Extend mutation campaign to cover V6.5 modules before external audit. Priority: tier_autofill_enforcer.dart (security-critical decision logic), totp_generator.dart (crypto primitive).

1. V4VaultEntry.password is Dart String in UI model. Flutter limitation. Crypto core never holds it as String. Decoy-wipe path copies to SecureBuffer and wipes.

2. Mutation testing covers only encoded mutations. Does not replace external cryptographic audit. Equivalent mutants (security-only, not functional) documented but not counted as gaps.

3. RESOLVED: V6.5 modules mutation-tested. 20/20 mutants killed (M101-M120), 100% score.

4. Android autofill has no automated unit tests. Device-tested on Android 13 (biometric, autofill, BLE, FLAG_SECURE). Automated coverage is not present for the platform layer.

5. P2P sync requires both devices online simultaneously. No async sync. Honest limitation of P2P architecture (zero-cloud doctrine).

6. BLE range ~10m is physical, not software-enforced. Determined attacker with signal amplifier could extend range. Mitigated by high-entropy passphrase + rate limiting.

7. TOTP secrets stored in vault (single point of failure). If vault compromised, all TOTP codes compromised. Recommendation: use hardware tokens (YubiKey) for critical accounts.

8. Security tiers are advisory. Determined user can bypass UI enforcement. Tier stored in encrypted blob (attacker cannot downgrade), but user can change tier before autofill.

9. TOFU first-pairing vulnerable to MITM. If attacker present during initial pairing handshake, can intercept. Mitigated by physical proximity (10m BLE) + user verification.

10. Autofill Intent extras not encrypted in transit. Android binder carries credentials from MainActivity to VaultAutofillService. Exposure time minimized, references cleared immediately.

• Extend mutation campaign to V6.5 modules (especially tier_autofill_enforcer.dart, totp_generator.dart)
• Complete Android device testing (biometric, autofill, BLE)
• Strengthen pairing passphrase validation to zxcvbn ≥ 3 (currently ≥ 8 alphanumeric)

• Add fuzzing for totp_import.dart parser (malformed otpauth:// URIs)
• Add fuzzing for tier_autofill_enforcer.dart lookalike detection (edge-case domains)
• Document BLE transport threat model in SECURITY.md (done)

• Formal verification of tier policy (Lean 4 / Dafny) - small surface, high value
• Noise protocol formal verification (existing research available)
• Reproducible builds for Android APK

The crypto core handles all secrets in native/FFI memory with immediate memzero. The only Dart-String secret is the UI-model password (documented, unavoidable). The Linux clipboard advertises the sensitive MIME type. Extended mutation testing (133/133 killed) plus the advanced verification suite (security2.md gates 21-32) and six fuzzers (0 crashes) provide strong evidence that the core implementation correctly enforces security invariants.

V6.5 mass-user features (security tiers, TOTP, P2P sync, Android autofill) pass unit tests, code review, and Android device testing. No vulnerabilities found in internal audit. Key security properties verified: critical tier blocks autofill, TOTP secrets zeroed after use, P2P sync uses Noise with TOFU pinning, Android manifest enforces zero-cloud (no INTERNET permission).

Full registry: See TESTING.md.

External cryptographic audit is required before production trust. Internal audit (mutation testing + code review) is strong evidence but not a substitute for independent verification. See AUDIT_BRIEF_V65.md for audit scope and TCB file list.