TECHNICAL SPECIFICATIONS

Nu11VLT uses Argon2id via libsodium for all password and PIN hashing. Argon2id is the winner of the Password Hashing Competition (2015) and is specifically designed to resist GPU/ASIC cracking attacks.

// PIN hashing with interactive parameters (fast)
func hashPIN(_ pin: String) -> String? {
	guard let pinData = pin.data(using: .utf8) else { return nil }
	
	let sodium = Sodium()
	return sodium.pwHash.str(
		passwd: Bytes(pinData),
		opsLimit: sodium.pwHash.OpsLimitInteractive,
		memLimit: sodium.pwHash.MemLimitInteractive
	)
}

// Archive password hashing with moderate parameters (stronger)
func deriveArchiveKey(password: String, salt: Data) -> SymmetricKey? {
	guard let passwordData = password.data(using: .utf8) else { return nil }
	
	let sodium = Sodium()
	guard let keyBytes = sodium.pwHash.hash(
		outputLength: 32,
		passwd: Bytes(passwordData),
		salt: Bytes(salt),
		opsLimit: sodium.pwHash.OpsLimitModerate,
		memLimit: sodium.pwHash.MemLimitModerate,
		alg: .argon2id13
	) else { return nil }
	
	return SymmetricKey(data: Data(keyBytes))
}

Argon2id stores the salt, algorithm, and parameters in a PHC string format. No separate salt storage needed for PINs.

Nu11VLT implements NIST 800-88 Rev. 1 "Clear/Purge" standard for secure file deletion on modern SSDs. This Pro feature performs a single-pass random data overwrite before deletion.

// NIST 800-88 Single-Pass Random Overwrite
func secureWipeFile(at url: URL) {
	guard FileManager.default.fileExists(atPath: url.path) else { return }
	
	do {
		let attributes = try FileManager.default.attributesOfItem(atPath: url.path)
		guard let fileSize = attributes[.size] as? UInt64, fileSize > 0 else {
			try FileManager.default.removeItem(at: url)
			return
		}
		
		let fileHandle = try FileHandle(forWritingTo: url)
		defer { try? fileHandle.close() }
		
		// Single-pass cryptographically secure random overwrite
		var randomData = Data(count: Int(fileSize))
		_ = randomData.withUnsafeMutableBytes { 
			SecRandomCopyBytes(kSecRandomDefault, Int(fileSize), $0.baseAddress!) 
		}
		
		try fileHandle.seek(toOffset: 0)
		fileHandle.write(randomData)
		fileHandle.synchronizeFile()
		
		// Finally delete the file
		try FileManager.default.removeItem(at: url)
	} catch {
		// Fallback to standard deletion
		try? FileManager.default.removeItem(at: url)
	}
}

Optional Pro feature. Slower and more battery-intensive than standard deletion. Primary security comes from cryptographic erasure (key destruction).