otpGarmin/source/storage/KeyManager.mc, branch v0.6.0OTP Wallet for Garmin Connect IQ: offline one-time passwords and barcodes.https://git.cirakg.xyz/otpGarmin/atom?h=v0.6.02026-10-19T23:51:05+00:00feat(storage): add keyed secret fingerprints to record headers2026-10-19T23:51:05+00:00cirakgcirakg@cirakg.xyz2026-10-19T23:51:05+00:00urn:sha1:bc228753bfb4a2faea540cddb20fc39ebd265db5
An 8-byte HMAC of kind, type and secret (key derived from the device key)
in header tag 13 lets imports find duplicates of locked entries while the
watch is locked. Vault gains anyHeader() and storage().
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
feat(storage): add the encrypted vault, PIN keys, lockout, session and migrations2026-10-19T13:27:37+00:00cirakgcirakg@cirakg.xyz2026-10-19T13:27:37+00:00urn:sha1:dd5d0f68726fe56ee4d199867d414aea81905cc4
Records are one ByteArray each: a readable TLV header plus an
encrypt-then-MAC box whose aad binds the entry ID and the header. The
device key seals unlocked entries and pending items; a random master key,
wrapped under a PBKDF2 PIN key, seals locked ones. Wrong PINs are counted
before the check, with delays on the trusted clock and an uptime fallback.
Bytes.toUtf8 validates UTF-8 first, because the native conversion crashes
on invalid input.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>