SERVICE #07 • CREDENTIALS & HYGIENE

Passwords & Auto-Lock Protocol

⏱️ 6 min read 🎲 CSPRNG Diceware (77+ bits) 🧹 Ephemeral Memory Zeroization

Even the strongest military-grade AES-256 cipher is vulnerable if protected by a weak, guessable password or if an unlocked laptop is left unattended at a coffee shop or office desk. ZevSafe combines CSPRNG Diceware Passphrase Generation with an aggressive Auto-Lock Inactivity Protocol and cryptographic memory scrubbing.

🟢 Simple User Guide

Creating Passphrases and Session Protection

STEP 01

Generate High-Entropy Diceware Passphrases

Click the Dice icon (🎲) next to the password box. ZevSafe generates a memorable, high-entropy 5 or 6-word phrase (e.g. correct-horse-battery-staple-galaxy). These phrases are easy for humans to remember but mathematically impossible for supercomputers to brute-force.

STEP 02

Monitor the Live Strength Meter

As you type, the strength bar calculates Shannon Entropy in real time. It grades your passphrase from Weak (< 40 bits) to Unbreakable (80+ bits) and warns you if common patterns or dictionary words are detected.

STEP 03

Configure Auto-Lock Inactivity Timer

Choose your preferred auto-lock timeout (5, 15, or 30 minutes). If you step away from your device, ZevSafe automatically locks the vault, clears your files from the screen, and wipes all keys from memory.

STEP 04

Save to Browser or Password Manager (Phase 14)

ZevSafe integrates directly with your browser's native password manager and popular extensions (Chrome, Bitwarden, 1Password, Apple Keychain). It automatically labels your password with the encrypted folder or vault filename (e.g., Financial_Archive.zev), prompts you to save it upon encryption, and lets you autofill with 1 click when unlocking.

💡

Instant Lock Hotkey: You can also lock your active vault instantly at any time by pressing Esc twice or clicking the lock icon in the top header.

🔵 Technical Specification

CSPRNG Diceware Generator Engine

ZevSafe strictly prohibits insecure pseudo-random generators like Math.random(). Word selection relies entirely on the operating system's cryptographic entropy source via crypto.getRandomValues():

CSPRNG Diceware Implementation

// app.js: Generate cryptographically secure passphrase
function generateDicewarePassphrase(wordCount = 5, separator = '-') {
    const randomIndices = new Uint32Array(wordCount);
    window.crypto.getRandomValues(randomIndices);
    
    const words = [];
    const dictLength = DICEWARE_WORDLIST.length;
    
    for (let i = 0; i < wordCount; i++) {
        // Unbiased modulo mapping
        const wordIndex = randomIndices[i] % dictLength;
        words.push(DICEWARE_WORDLIST[wordIndex]);
    }
    
    return words.join(separator);
}

Shannon Entropy Mathematical Formulation

The information-theoretic entropy $H(X)$ is computed based on character frequencies across the candidate string:

📐

$$H(X) = - \sum_{i=1}^{n} P(x_i) \log_2 P(x_i)$$
For a Diceware passphrase composed of $k$ independent words selected uniformly from a dictionary of size $W$: $$E_{\text{dice}} = k \cdot \log_2(W)$$ With $W = 7,776$ (standard wordlist) and $k = 6$: $$E_{\text{dice}} = 6 \cdot \log_2(7776) = 6 \cdot 12.925 = 77.55 \text{ bits of entropy}$$ An adversary requires on average $2^{76.55}$ operations to guess the passphrase, rendering brute-force attacks computationally infeasible.

Auto-Lock Protocol & Buffer Zeroization

When user inactivity exceeds the configured threshold, lockV3VaultSession() is dispatched:

Cryptographic RAM Scrubbing

function lockV3VaultSession() {
    // 1. Zeroize master key and PBKDF2 derived buffers
    if (activeSession.derivedKeyBytes) {
        activeSession.derivedKeyBytes.fill(0);
        activeSession.derivedKeyBytes = null;
    }

    // 2. Wipe chunk cache and decrypted overlay files
    if (activeSession.chunkCache) {
        for (const chunk of activeSession.chunkCache.values()) {
            if (chunk.data) chunk.data.fill(0);
        }
        activeSession.chunkCache.clear();
    }

    // 3. Purge DOM references and reset UI
    activeSession = null;
    renderLockedState();
}

🔵 Technical Specification

W3C Credential Management API & Autofill Integration

To bridge zero-knowledge vaults with modern credential managers without compromising air-gap boundaries, ZevSafe implements the W3C Credential Management API alongside standards-compliant semantic autofill forms:

W3C Credential Management Storage (app.js) W3C Standard

if (window.PasswordCredential && navigator.credentials) {
    const cred = new PasswordCredential({
        id: vaultIdentifier,       // e.g. "Personal_Vault.zev"
        password: vaultPassword,   // High-entropy passphrase
        name: vaultIdentifier      // Human-readable vault label
    });
    await navigator.credentials.store(cred);
}

Browser Extension Form Dispatch

Browser extensions (Bitwarden, 1Password, Dashlane) listen for DOM submit events rather than Credential API calls. ZevSafe embeds semantic hidden forms with standard autocomplete tokens:

Username Token: <input name="username" autocomplete="username"> (populated with vault filename)
Encryption Password Token: <input name="password" autocomplete="new-password">
Decryption Password Token: <input name="password" autocomplete="current-password">

Security Invariants

Invariant	Guarantee	Status
Entropy Verification	Dice generation uses 100% CSPRNG hardware entropy; never predictable pseudo-randomness.	VERIFIED
Memory Zeroization	All sensitive TypedArrays wiped with `.fill(0)` before release to garbage collection.	VERIFIED
Zero Remote Telemetry	Password strings and entropy calculations never leave browser RAM.	VERIFIED