lvthn

SECURITY DETAILS

ciphers

Serpent-256-CBC + HMAC-SHA256, XChaCha20-Poly1305, AES-256-GCM-SIV, selectable per encryption and auto-detected on decrypt via header byte

kdf

scrypt (N=32768, r=8, p=1, dkLen=32) for passphrase mode; raw 32-byte keys for keyfile mode, byte-compatible with the lvthn CLI

key

32 bytes (256-bit); HKDF-SHA-256 derives per-stream subkeys inside the seal pool

streaming

SealStreamPool: 64 KiB chunks with TAG_FINAL counter nonce; chunk reordering or truncation fails authentication

format

LVTHN v3: 41-byte header (magic, version, cipher, kdf, flags, salt) + pool output. Same on-disk format as the lvthn CLI