From bc228753bfb4a2faea540cddb20fc39ebd265db5 Mon Sep 17 00:00:00 2001 From: cirakg Date: Tue, 20 Oct 2026 01:51:05 +0200 Subject: feat(storage): add keyed secret fingerprints to record headers An 8-byte HMAC of kind, type and secret (key derived from the device key) in header tag 13 lets imports find duplicates of locked entries while the watch is locked. Vault gains anyHeader() and storage(). Co-Authored-By: Claude Opus 5.5 --- source/storage/Entry.mc | 3 +++ 1 file changed, 3 insertions(+) (limited to 'source/storage/Entry.mc') diff --git a/source/storage/Entry.mc b/source/storage/Entry.mc index 57e0309..23c95c0 100644 --- a/source/storage/Entry.mc +++ b/source/storage/Entry.mc @@ -52,6 +52,9 @@ class Entry { var counter as Long = 0l; var created as Long = 0l; var namesEncrypted as Boolean = false; + // Keyed fingerprint of the type and secret (or payload), set by the + // vault: finds duplicates without decrypting (docs/SECURITY.md). + var fingerprint as ByteArray? = null; // Sensitive fields (encrypted at rest). var algorithm as Number = Hashes.SHA1; -- cgit v1.2.3