maneuler / vaultOptional encrypted sync relay
Proposal, not an available feature. No network permission or new data collection is enabled. These RFCs are locally prepared; remote review/merge awaits the owner repository.
Current architecture
Current Wi-Fi sync approves complete KDBX replacements. There are no accounts, billing, remote vault storage or cloud identity keys.
Design under review
Keep the existing local workflow permanent and free. A separate opt-in service may store only client-encrypted KDBX and signed revision envelopes; authentication credentials must be independent of the master passphrase. Review rollback, replay, device revocation and account-recovery protocols before exposing a network endpoint. The service can see ciphertext sizes, timing, device/account metadata and IPs; disclose those honestly. Removing subscription must preserve local unlock and export.
Milestones
- M1: protocol, metadata/retention/cost review and local-only regression suite
- M2: isolated opaque-blob relay with device identity, revision compare-and-swap and rollback detection
- M3: independent audit, deletion/recovery drills, billing separation and explicit opt-in beta
Required acceptance tests
- Local mode makes no relay requests and remains usable with no subscription
- Server compromise never obtains decryption keys or passphrases
- Replayed/stale revisions are rejected and conflicts preserve both encrypted copies
Limits
KDBX encryption alone is not a complete sync protocol. No paid cloud service or account signup is enabled by this RFC.
Any implementation must preserve local unlock/export, add KDBX/KeePassXC regressions for crypto/format changes and update privacy disclosures before new data flows begin.