An exported container is wonderfully portable — which means it can also be tampered with or corrupted in transit. So on the way back in, Kistvault treats it as untrusted input and makes it earn trust before anything is opened.
The threat it solves
A malformed or malicious archive shouldn't be able to confuse the app into unsafe behaviour, and a stray import shouldn't quietly destroy the vault you're using right now. Import is where a portable format meets a careful parser.
How it works
- Shape-check first. Entry paths are validated against an allow-list of known container shapes before processing.
- Authenticate, don't just checksum. The header MAC authenticates the structure; per-chunk AEAD authenticates the content and rejects any altered chunk.
- Never overwrite. An import never replaces a live container — your active vault is protected from an accidental clobber.
The key difference
Integrity is authenticated, not merely hashed. The archive's SHA-256 is a transfer check for "did all the bytes arrive"; the real guarantee that the content is genuine comes from the MAC and AEAD already baked into the container.
Questions
Could a tampered container harm my device?
It's untrusted input: allow-listed shapes, per-chunk AEAD rejects altered data.
Does import overwrite my vault?
No — a live container is never overwritten by an import.
How is integrity verified?
Header MAC + per-chunk AEAD; the SHA-256 is only a transfer check.