r-zakarya
2bd0fcfbf8
Phase 1 of CODE_AUDIT §1.2 — additive, no live account uses Argon2id yet. - Vendor @noble/hashes@2.2.0 argon2id as js/argon2.js (esbuild IIFE exposing globalThis.NobleArgon2). Pure-JS, not WASM: CSP is script-src 'self' with no wasm-unsafe-eval, so WASM would require weakening it. Verified against the RFC 9106 §5.3 test vector. Server needs zero Argon2 (zero-knowledge: it only ever SHA256-wraps the client verifier). - app.js: deriveKeyBytes(pwd, salt, algo, iters, argonParams) branches Argon2id vs PBKDF2; deriveKeyAndVerifier refactored around it. New markers HASH_ALGO_ARGON2='argon2id-v2' + ARGON2_DEFAULT_PARAMS (OWASP m=19MiB,t=2,p=1, ~0.65s/unlock). isDecoupledVerifierAlgo() generalises the decoupled-verifier rule to any '-v2' scheme so argon2id-v2 inherits it. AES key is still ALWAYS the raw KDF output → entries decryptable, legacy accounts untouched. - index.html loads js/argon2.js before app.js; added to BuildAssets whitelist; test harness loads it into the sandbox first. - Tests: +5 (RFC 9106 vector via vendored bundle, argon2 branch derives Argon2 key not PBKDF2, decoupled verifier, AES round-trip under Argon2 key). 40/40. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
