id: b22a9b7c8f5f489ea8bc594f436b1df8
parent_id: 
item_type: 1
item_id: a5535547f87f42deaa4af07f34f928f1
item_updated_time: 1786726740613
title_diff: "[{\"diffs\":[[1,\"Clypeum Crypto Container Binary Format\"]],\"start1\":0,\"start2\":0,\"length1\":0,\"length2\":38}]"
body_diff: "[{\"diffs\":[[1,\"# Clypeum Crypto Container Binary Format\\\n\\\nReference: Clypeum CryptoContainerService Cryptographic Data Format Specification\\\n\\\n## General Structure\\\nContainer = Header + Payload (encrypted) + Signature\\\n\\\nAll multi-byte fields are **big-endian**.\\\n\\\n## Container Header\\\n\\\n### Version 0x1 (current)\\\n| Offset | Size | Field | Description |\\\n|--------|------|-------|-------------|\\\n| 0 | 4 | File Start Code | `0x53454301` |\\\n| 4 | 4 | Version | `0x00000001` |\\\n| 8 | 4 | Header Length | Bytes |\\\n| 12 | 4 | Payload Length | Bytes (of encrypted payload, includes padding) |\\\n| 16 | 4 | Signature Length | Bytes |\\\n| 20 | 1 | Signature Algorithm | `0x00`=None, `0x01`=Sha256WithRSA (0x100 bytes) |\\\n| 21 | 2 | Crypto Data Type | e.g. `0x0900` for our production container |\\\n| 23 | 1 | Encryption Algorithm | `0x00`=None, `0x01`=AES-256-CBC, `0x02`=RSA-OAEP-SHA256 |\\\n| 24 | 1 | Hash Algorithm | `0x00`=SHA-256, `0x01`=SHA-512, `0x02`=SHA-3-384, `0x03`=SHA-4-512 |\\\n| 25 | 32/64 | Payload Hash | SHA-256=32 bytes, SHA-512=64 bytes (of plaintext payload) |\\\n| 57/89 | 4 | Time-to-Live | POSIX timestamp (30 days from generation) |\\\n| 61/93 | 64 | Crypto Container ID (CID) | Unique identifier |\\\n\\\n### Header parsing code\\\nSee `crates/kf-dev-station/src/container_parser.rs` — `ParsedContainer::parse()`\\\n\\\n## Payload (encrypted)\\\nThe payload (header + data) is encrypted first, then hash is computed on the **plaintext** and stored in the container header.\\\n\\\n### Decryption order\\\n1. Verify signature (RSA/ECDSA over entire container)\\\n2. Decrypt payload using AES-256-CBC (key derived from seed?)\\\n3. Verify payload hash matches header hash\\\n4. Parse payload\\\n\\\n## Payload Header\\\n| Size | Field | Description |\\\n|------|-------|-------------|\\\n| 4 | Payload Start Code | `0x50415901` |\\\n| 4 | CRC32 | Polynomial `0x04C11DB7`, over \\\"Header Version\\\" through end of data |\\\n| 4 | Header Version | Starts at `0x00000002` |\\\n| 4 | Payload Type | See table below |\\\n| 4 | Payload Data Length | Bytes |\\\n\\\n### Payload Types\\\n| Value | Description |\\\n|-------|-------------|\\\n| 0x01 | M-format keys (SHE) |\\\n| 0x05 | M-format keys (SHE+) |\\\n| 0x04 | UCB Block TC3XX |\\\n\\\n## Signature\\\n- Calculated over entire container (header + encrypted payload + signature itself is the final step)\\\n- Minimum RSA 2048-bit, ECC 256-bit\\\n- Algorithm `0x01` = Sha256WithRSAEncryption, signature length 0x100 (256 bytes)\\\n\\\n## Container Type 0x0900\\\nProduction key bundle container for our use case. Structure TBD — likely M-format keys or custom format. The Extra JSON sent with the generation request includes transaction metadata, fob UID/SCP03 data.\\\n\\\n## Test Containers\\\n- Dummy crypto data but all fields correctly generated and consistent\\\n- Keys have known values, included in clear text\\\n- For our type: `keyBundleType: \\\"dev\\\"`\\\n\\\n## Verification Steps (per spec)\\\n1. Verify payload hash (decrypt first, then compare)\\\n2. Verify payload CRC32\\\n3. Authenticate signature\\\n\\\n## Current State\\\n- Parser implemented (`container_parser.rs`) — parses header, extracts encrypted payload and signature\\\n- Payload decryption not yet implemented (need to determine AES key derivation from seed)\\\n- Signature verification not yet implemented (need Clypeum public key)\"]],\"start1\":0,\"start2\":0,\"length1\":0,\"length2\":3169}]"
metadata_diff: {"new":{"id":"a5535547f87f42deaa4af07f34f928f1","parent_id":"beb251c3b3f9490285e6cb68942a5145","latitude":"0.00000000","longitude":"0.00000000","altitude":"0.0000","author":"","source_url":"","is_todo":0,"todo_due":0,"todo_completed":0,"source":"joplin-desktop","source_application":"net.cozic.joplin-desktop","application_data":"","order":1786528809081,"markup_language":1,"is_shared":0,"share_id":"","conflict_original_id":"","master_key_id":"","user_data":"","deleted_time":0},"deleted":[]}
encryption_cipher_text: 
encryption_applied: 0
updated_time: 2026-08-14T17:00:00.671Z
created_time: 2026-08-14T17:00:00.671Z
is_locked: 0
type_: 13