From 7528146a4e70a1144bb9fe751eae67a7afa714c3 Mon Sep 17 00:00:00 2001 From: r-zakarya <82443831+r-zakarya@users.noreply.github.com> Date: Mon, 17 Aug 2026 20:32:26 +0100 Subject: [PATCH] fix(android): the save actually reuses the derived key The log named it exactly: "Cle ou sel absent pour le rechiffrement". The edit that swapped DecryptContainer for DecryptContainerEx had never been applied - the timing line from the same change was missing too, which is what should have told me. So the key was never collected and re-encryption refused. Worth keeping in mind: the guard in EncryptContainerWithKey did its job. It refused rather than encrypting under an empty key and writing a container nobody could read into the vault. A failed save is an inconvenience; a published unreadable snapshot would have been the kind of loss this whole section is built to avoid. Co-Authored-By: Claude Opus 5 --- mainApk.pas | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/mainApk.pas b/mainApk.pas index ddb1aba..268f092 100644 --- a/mainApk.pas +++ b/mainApk.pas @@ -610,8 +610,15 @@ begin end; try - LPlain := DecryptContainer(LGet.Container, FSyncPwd); + // UNE SEULE DERIVATION PAR ENREGISTREMENT : la variante Ex rend la + // cle, son sel et les iterations, que le rechiffrement reutilise. + // Deriver deux fois le meme mot de passe coutait une seconde fois + // quatre a six secondes, pour une cle equivalente. + LSw := TStopwatch.StartNew; + LPlain := DecryptContainerEx(LGet.Container, FSyncPwd, + LKey, LSalt, LIter); LNew := PatchEntryField(LPlain, LUuid, 'password', ANewValue); + Log(Format('save: decrypt+patch in %d ms', [LSw.ElapsedMilliseconds])); except on E: Exception do begin