References.

Every external source the documentation relies on, with the caveats that matter. Where a specification is commonly miscited, the correct citation is given instead.

Not for production secrets yet. There is no public installable release; everything below builds from source and is pre-release. Do not put a credential you care about into it.

Cryptography#

Primitives, the parameters in use, and the specification each comes from.
PrimitiveParametersSpecification
Argon2id 64 MiB, 3 passes, 4 lanes, 16-byte salt, 32-byte output RFC 9106, section 4, second recommended option. Original paper: Biryukov, Dinu and Khovratovich, IEEE EuroS&P 2016. Reference implementation and specification from the Password Hashing Competition.
HKDF-SHA256 Three distinct domain-separation strings RFC 5869
XChaCha20-Poly1305 256-bit key, random 192-bit nonce, associated data on every operation The extended-nonce variant of the construction in RFC 8439. See the caveat below.
ChaCha20 20 rounds Bernstein, ChaCha, a variant of Salsa20
Poly1305 128-bit tag Bernstein, the Poly1305 message-authentication code
HMAC-SHA256 Two separate domains: bearer verification and authorization binding RFC 2104 and FIPS 198-1; SHA-256 from FIPS 180-4
TLS 1.3 Operating-system trust roots, no bundled fallback RFC 8446

XChaCha20-Poly1305 is not specified by RFC 8439, and citing it that way is wrong. RFC 8439 defines the 96-bit-nonce construction. The 192-bit extended-nonce variant used here comes from an IRTF Internet-Draft, draft-irtf-cfrg-xchacha-03, which expired without becoming an RFC and is standardized in practice by libsodium.

Tokens and encoding#

The Vault Secret Key and Locker tokens are encoded with Crockford Base32, which excludes I, L, O and U so a key can be transcribed by hand without ambiguity, and carries a checksum.

Agent protocol#

Application security guidance#

Prior art#

The two-factor unlock is directly descended from the account-password-plus-Secret-Key model described in the 1Password Security Design white paper. The difference worth naming: that design uses PBKDF2 because vault cryptography has to run in a browser client. Slifer does no vault cryptography in a browser, so it uses Argon2id instead.

On verifying these#

Every link above was checked to resolve at the time of writing. Two notes on precision. The Argon2 paper is cited without page numbers because published sources disagree on them. RFC 9106 is an Informational document on the IRTF stream, not an IETF standards-track RFC, which is worth knowing before describing anything as "standards compliant".