Technical Reference v1.0.0

System Architecture &
Cryptography

PWDnow is a zero-knowledge, local-first password manager designed to operate at NIST Security Level 5 with full CNSA 2.0 readiness. Explore the complete mathematical and architectural foundations.

Core Architectural Invariants

INVARIANT 01

Cryptographic Confinement

All key derivation, encryption, and decryption occur exclusively within the Rust daemon process. The web layer receives only opaque ciphertexts and session tokens.

INVARIANT 02

Defense in Depth

Data is encrypted at three independent layers before reaching persistent storage: individual DEK, overarching VMK, and a SQLCipher envelope.

INVARIANT 03

Post-Quantum Readiness

Utilizes a hybrid X448 + ML-KEM-1024 Key Encapsulation Mechanism and ML-DSA-87 signatures, maintaining both classical security and NIST Level 5 quantum resistance.

Cryptographic Primitives

PrimitiveImplementationPurpose in PWDnow
AES-256-GCMFIPS 197 / NIST SP 800-38DPrimary AEAD. Used for VMK, DEK, and Credential payload encryption.
Argon2idv1.3 (m=1GiB, t=4, p=2)Primary KDF. Key Encryption Key (KEK) derivation from master password.
ML-KEM-1024FIPS 203 (NIST Level 5)Post-Quantum Key Encapsulation Mechanism (used in hybrid with X448).
ML-DSA-87FIPS 204 (NIST Level 5)Post-Quantum Authenticator assertions and nightly audit log root signing.
HMAC-SHA-512FIPS 198-1Blind Indexes for searching encrypted fields securely without decryption.
XChaCha20-Poly1305RFC 8439Legacy secondary AEAD (24-byte nonces), supported for backward compatibility.

Daemon Key Hierarchy

Base Input
Master Password + YubiKey HMAC-SHA256
UTF-8 Bytes
KDF Layer (Argon2id)
KEK[32] = Argon2id(Input, Salt)
Key Encryption Key
(64 bytes total material)
VMK Layer (mlock'd memory)
VMK[32] = AES-256-GCM.Decrypt(KEK, encrypted_VMK)
Vault Master Key
PROT_NONE Isolated
Credential Data
DEK[32] = AES-GCM(VMK, random)
Blind Indexes
HKDF-SHA3-512(VMK) -> BI_Key[64]

Standards Compliance Matrix

NIST SP 800-63B-4

AAL3

Authentication and AAL3 memory-hard KDF. Satisfied by employing Argon2id with an intentional 1 GiB memory cost and execution tuning.

NSA CNSA 2.0

STRICT

Post-Quantum compliance. Integrates ML-KEM-1024, ML-DSA-87, AES-256-GCM, and strictly enforces SHA-384 as required by the 2030 CNSA deadline.

NIST SP 800-88 Rev. 2

ERASE

Complete media sanitization. Cryptographic erase implemented via zeroization of VMK key fields locally, rendering persistent data irrecoverable instantly.

FIDO2 / WebAuthn

LEVEL 3

Hardware passkey support. Integrates standard FIDO2 functionality along with WebAuthn PRF extensions for Quick Unlock key wrapping and binding.

Frequently Asked Questions

PWDnow derives the Key Encryption Key from your master password using Argon2id v1.3 with an intentional 1 GiB memory cost, time cost 4, and parallelism 2 — parameters chosen to resist GPU/ASIC brute-force attacks and aligned with NIST SP 800-63B-4 AAL3 guidance.
Yes. PWDnow integrates ML-KEM-1024 and ML-DSA-87 for post-quantum key encapsulation and signatures, uses AES-256-GCM for encryption, and enforces SHA-384 or stronger throughout — meeting NSA's CNSA 2.0 suite ahead of the 2030 deadline.
Deleting a vault triggers a cryptographic erase: the Vault Master Key is zeroized in memory and on disk per NIST SP 800-88 Rev. 2, which renders the remaining encrypted data unrecoverable without needing to overwrite the entire storage medium.
Yes — PWDnow implements FIDO2/WebAuthn Level 3, including the WebAuthn PRF extension, so a hardware key such as a YubiKey is bound directly into the key-derivation process rather than just gating a login screen.