otpGarmin/source/storage/Vault.mc, branch v0.3.0OTP Wallet for Garmin Connect IQ: offline one-time passwords and barcodes.https://git.cirakg.xyz/otpGarmin/atom?h=v0.3.02026-10-19T13:27:37+00:00feat(storage): add the encrypted vault, PIN keys, lockout, session and migrations2026-10-19T13:27:37+00:00cirakgcirakg@cirakg.xyz2026-10-19T13:27:37+00:00urn:sha1:dd5d0f68726fe56ee4d199867d414aea81905cc4
Records are one ByteArray each: a readable TLV header plus an
encrypt-then-MAC box whose aad binds the entry ID and the header. The
device key seals unlocked entries and pending items; a random master key,
wrapped under a PBKDF2 PIN key, seals locked ones. Wrong PINs are counted
before the check, with delays on the trusted clock and an uptime fallback.
Bytes.toUtf8 validates UTF-8 first, because the native conversion crashes
on invalid input.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>