# KeePassXC Password Vault Integration & Security Guide

Subsystem: Snigdha Privacy Suite
Application: KeePassXC 2.8.0
Distribution: Snigdha OS Decentralized

---

# 1. Overview & Capabilities

KeePassXC provides local, encrypted password management using the open-standard KDBX v4 format, hardened with memory-hard key derivation functions.

---

# 2. Cryptographic Architecture

• Database Format: KDBX 4.0.
• Key Derivation Function (KDF): Argon2id (memory-hard, resistant to GPU and ASIC brute-force attacks).
• Encryption Cipher: AES-256 (default) or ChaCha20.
• Master Password: Never cached on disk, never stored in plaintext configuration files.

---

# 3. Strict Offline Sandboxing

Password managers must never initiate or accept network connections.

• Bubblewrap Policy: network: "offline" (--unshare-net).
• AppArmor Policy: deny network inet, deny network inet6.
• Enforcement: Sockets opened inside the KeePassXC sandbox immediately fail with EPERM or ENETUNREACH.

---

# 4. Clipboard Security & X11 Boundaries

• Automatic Clipboard Clearing: Configured to automatically wipe copied credentials after 30 seconds.
• Display Timeout: Password fields remain masked (HidePasswordFields=true).
• Shared X11 Trust Boundary: Under standard X11, any connected client can monitor the global clipboard. Users must not run untrusted or unconfined applications while holding decrypted vaults in memory.
• Auto-Type: Disabled by default. Relies on X11 fake key events which can be intercepted by malicious window clients.

---

# 5. Storage & Persistence Integration

• Ephemeral Mode (Default): Vault files saved to ~/Documents/Passwords/ reside in RAM tmpfs and disappear on reboot.
• Persistent Mode: When Snigdha Persistence is unlocked, databases can be saved under ~/Persistent/Passwords/.
• Database Backups: Always retain an encrypted backup copy of your KDBX database on an independent external storage device.