1. DataHandler.DeviceIdentifier

DeviceIdentifier Class

Derives a stable, cached master key from a shared-secret string. The SecretManager uses this to turn a SharedSecretKey (plus a per-vault salt) into the actual encryption key.

Earlier versions of this class exposed board-serial helpers (device binding), but that was dropped — the motherboard serial is readable by any local program, so binding to it added no real protection. The key now comes purely from the shared secret you provide.

Methods

GetUserBoundMasterSecret(string xruiosUserId, string vaultContext = "")

Derives (and caches) a 32-byte key from xruiosUserId using PBKDF2-SHA512 at 600,000 iterations, salted with vaultContext.

  • Parameters:

    • xruiosUserId: The shared secret / user id the key is derived from. Required (null or whitespace throws).
    • vaultContext: Extra salt material mixed in per vault. The SecretManager passes each bank's random salt here; when empty, the original base salt is used.

  • Returns: SecureData — the derived key.

  • Notes: Results are cached per (id + vaultContext), so repeated calls with the same inputs return the same key without re-running the (deliberately slow) PBKDF2 each time.