Fresh randomness
The operating system generates independent salts, nonces, CBC IVs, and random content master keys.
Security brief · Format 1.1
Designed to be inspected.
Cascade Vault is a conservative, documented construction: passwords protect random keys, keys are separated by purpose, and the entire stored container is authenticated before its contents are decrypted.
Primary path
01Primary passwordNFC UTF-8
02Argon2idbounded parameters
03AES-GCM enveloperandom primary CMK
04HKDF-SHA-512domain-separated keys
05AES-256-CBCinner layer
06Twofish-256-CBCmiddle layer
07Serpent-256-CBCouter layer
08HMAC-SHA-256header + ciphertext
PKCS#7 padding is applied once before AES. Twofish and Serpent add no padding. Independent HKDF labels prevent one derived key from being reused for another purpose.
Optional defense in depth
A second secret for the outer layer.
When enabled, a second password has its own Argon2id salt and parameters and unwraps an independently random secondary CMK. That CMK derives only the Serpent key. The primary CMK still derives AES, Twofish, and HMAC keys.
The primary password is always required. Cascade Vault authenticates the entire vault under the primary-derived HMAC before deriving the secondary key or decrypting any payload. A stolen vault still permits offline guessing of both secrets.
Implemented safeguards
Failure is part of the design.
Bound envelopes
AES-GCM wraps each CMK and authenticates a canonical form of the complete header as additional data.
Verify first
A primary-derived HMAC authenticates the exact stored header and every ciphertext byte before payload decryption.
One public result
Plaintext staging is created with owner-only permissions atomically, then promoted only after the complete authenticated operation succeeds.
Path containment
Traversal, absolute paths, collisions, symlinks, junctions, reparse points, special entries, and restoration-map name collisions are rejected or safely remapped.
Bounded extraction
Entry count, path depth and length, file size, and total extracted size are constrained before publication.
No silent overwrite
Existing vaults and destinations are never replaced implicitly; verified promotion is collision-safe.
Quiet failures
Fixed-time tag comparison and one generic unlock message reduce password and corruption oracles.
Exact source verification
Complete SHA-256 content hashes are compared during capture, authenticated readback, and source revalidation before optional removal.
Evidence, not certification
Internal controls around the format.
248.NET automated tests in the current verified source
5deterministic v1.0/v1.1 golden containers
2independent Rust compatibility tests
10kdeterministic mutation cases in the readiness run
The repository also bounds combined unauthenticated Argon2 work, warns on expensive profiles, checks cancellation around each indivisible derivation, and includes parser fuzz targets, locked dependencies, secret scanning, manual-build CodeQL with security-extended queries, and an independent read-only Rust format verifier. These are engineering controls—not an external audit.
Honest boundaries
Encryption has an edge.
Password strength is critical. Anyone with a copy of a vault can guess passwords offline. Argon2id raises the cost; it does not make weak secrets safe.
Endpoint malware, keyloggers, screen or clipboard capture, unlocked devices, administrators, swap, hibernation, backups, and cloud file histories sit outside the protection boundary.
Outer file size, location, timestamps, and access patterns may remain visible. Managed runtimes and operating systems cannot guarantee perfect memory erasure.
Cascade Vault is not FIPS validated, formally independently audited, quantum-resistant, or unbreakable. The three-cipher cascade is not a claim of 768-bit security.