feat(android): keep the decrypted vault locally under an Android Keystore key

Opening a container costs ~4 s and the iteration count belongs to the desktop format, so the fix is to stop repeating it: derive once per snapshot, then read a local AES file which the hardware accelerates. The key is generated inside the Keystore and never leaves it - the file alone is useless, even rooted. ETag and vault are encrypted together on purpose: an ETag outliving an unreadable vault would make the server answer 304 with nothing to show. A failed read wipes the cache rather than guessing. Also normalises every Delphi source to pure ASCII: Delphi reads a BOM-less file as ANSI, so accented comments came back as mojibake, and each PowerShell rewrite added another layer.
2026-08-15 00:37:59 +01:00
parent 3c1525e46f
commit 5fdb7f914e
5 changed files with 422 additions and 48 deletions
@@ -3,7 +3,7 @@ unit PMA.SyncClient;
  Lecture de l'instantane chiffre depuis l'endpoint PHP (server-php/sync.php).

  Ne dechiffre rien : il ramene des octets opaques et l'ETag qui les identifie.
-  Le dechiffrement est le travail de PMA.Crypto, et il coute 4 secondes — d'ou
+  Le dechiffrement est le travail de PMA.Crypto, et il coute 4 secondes - d'ou
  l'importance de l'ETag, qui evite de le refaire quand rien n'a change.

  Le serveur repond 404 aussi bien pour un jeton invalide que pour un