ArcaSafe 🔐

ArcaSafe is a privacy-focused, cross-platform encrypted vault designed to protect files and folders using modern cryptographic standards.

The goal of ArcaSafe is simple: give users full control over their data by allowing them to create secure encrypted containers protected by their own password.

Your files. Your key. Your control.

---

✨ Features

Current goals

• 🔒 Encrypt individual files or complete folders
• 🔑 Password-based access control
• 🌍 Cross-platform support
• 💾 Storage independent (NTFS, FAT32, exFAT, ext4, APFS, etc.)
• 🛡️ Integrity verification to detect data modification
• 📦 Portable encrypted vault format
• 🔄 Secure password change mechanism

---

🔐 Cryptographic design

ArcaSafe does not use the user password directly as an encryption key.

The architecture follows a modern key management approach:

User password
      |
      v
   Argon2id
      |
      v
 Key Encryption Key (KEK)
      |
      v
 Protects the data encryption key
      |
      v
 AES-256-GCM
      |
      v
 Encrypted files

Cryptographic components

Component	Purpose
Argon2id	Password-based key derivation
AES-256-GCM	Authenticated file encryption
Secure random generator	Salt and nonce generation
Zeroization	Secure removal of sensitive data from memory

---

📦 Encrypted vault format

ArcaSafe uses a dedicated encrypted container format.

Example:

MyDocuments.vault

A vault contains:

+----------------------+
| Header               |
| Version              |
| Algorithm metadata   |
| Salt                 |
| Nonce                |
| Encrypted key data   |
+----------------------+
| Encrypted content    |
+----------------------+
| Authentication tag   |
+----------------------+

The vault can be stored on:

• Local disks
• USB drives
• External drives
• NAS
• Cloud storage

The underlying filesystem is not relevant because encryption happens at the application level.

---

🏗️ Technology stack

Core

• Language: Rust

• Cryptography:

  • Argon2id
  • AES-256-GCM
  • Secure random generation

Interface

Planned:

• Tauri desktop application
• Windows / Linux / macOS support

---

🚀 Roadmap

Phase 1 — Core engine

• Create encrypted vault
• Encrypt files
• Decrypt files
• Password verification
• Vault integrity checking

Phase 2 — User experience

• Graphical interface
• Drag & drop encryption
• File explorer integration
• Automatic vault locking

Phase 3 — Advanced features

• Multiple users
• Recovery key
• Secure sharing
• Public key cryptography support
• Mobile support

---

� Testing

Building the project

cargo build

For a release build (optimized):

cargo build --release

Running the CLI

Display the help menu:

./target/debug/arcasafe --help

The ASCII banner and all available commands will be displayed.

Testing individual commands

Create a new vault

./target/debug/arcasafe create my-vault.vault

You will be prompted to enter and confirm a password.

Encrypt a file

./target/debug/arcasafe encrypt my-vault.vault /path/to/file.txt

You will be prompted for the vault password. The file will be encrypted and added to the vault.

List files in a vault

./target/debug/arcasafe list my-vault.vault

Displays all files stored in the vault with their original and encrypted sizes.

Display vault information

./target/debug/arcasafe info my-vault.vault

Shows vault metadata: version, algorithm, number of files, and Argon2id parameters.

Verify vault integrity

./target/debug/arcasafe verify my-vault.vault

Validates that the vault structure and cryptographic parameters are correct.

Running tests

Run all tests (library and integration tests):

cargo test

Run tests with output:

cargo test -- --nocapture

Run a specific test module:

cargo test kdf::tests

Example workflow

# 1. Build the application
cargo build

# 2. Create a new vault
./target/debug/arcasafe create documents.vault

# 3. Create a test file
echo "Secret data" > secret.txt

# 4. Encrypt the file
./target/debug/arcasafe encrypt documents.vault secret.txt

# 5. List files in the vault
./target/debug/arcasafe list documents.vault

# 6. Verify vault integrity
./target/debug/arcasafe verify documents.vault

# 7. Display vault information
./target/debug/arcasafe info documents.vault

---

�🧩 Security principles

ArcaSafe follows these principles:

• No plaintext password storage
• User-controlled encryption keys
• Modern authenticated encryption
• Minimal metadata exposure
• Open design for future security review

---

⚠️ Security status

ArcaSafe is currently under development.

It should not be considered a replacement for audited security software until the code has undergone independent review.

---

🤝 Contributing

Contributions are welcome.

Areas where help is appreciated:

• Cryptography review
• Rust development
• Cross-platform testing
• UI/UX improvements
• Security auditing

---

📜 License

This project is licensed under the GNU General Public License v3.0 (* GPL-3.0).

See the LICENSE file for details.

---

Author

Created with the goal of building a transparent and user-controlled data protection tool.

ArcaSafe