Security Architecture
Two-factor authentication secrets are sensitive credentials. This document details AuthG's offline architecture, cryptographic primitives, and threat model.
No cloud sync, no central databases, no telemetry pingbacks.
Authenticated encryption ensures ciphertext cannot be modified without invalidating the MAC tag.
TOTP codes match Google Authenticator mathematically based on UNIX epoch time.
Cryptographic Specifications
1. Key Derivation (PBKDF2-HMAC-SHA256)
Master PIN encryption keys are derived using PBKDF2 with SHA-256 and 600,000 rounds. This ensures that brute-force dictionary attacks against a PIN are computationally unfeasible.
2. Authenticated Encryption (AES-256-GCM)
Vault serialization samples a fresh 96-bit random IV from the operating system's CSPRNG (/dev/urandom on macOS/Linux, BCryptGenRandom on Windows).
3. Google Authenticator Migration Protocol
Google Authenticator exports multi-account backups as a custom URI (otpauth-migration://offline?data=...). AuthG decodes the Base64 Protobuf payload directly inside the native Rust core without external dependencies or cloud parsers.
Threat Model Analysis
The local vault authg_vault.enc is encrypted with AES-256-GCM. Without your master PIN, TOTP secrets cannot be extracted from disk.
AuthG contains zero HTTP network code for syncing data. No packets containing secrets are ever transmitted over the network.
Privacy Mode applies a blur filter to all 6-digit TOTP codes until you hover over them, keeping codes hidden while sharing screens.
Copied 2FA codes are wiped from the clipboard automatically after 30 seconds to minimize exposure.
Audit the Source Code
AuthG is open-source under the MIT license. Inspect the cryptographic primitives and Rust engine.