2. Cryptographic Protocol Specification

Key Derivation Function (KDF)

To translate a user-supplied token password into cryptographic keys, HIDEBAF employs scrypt key derivation:

• Default Work Factor (N): 16384
• Paranoid Mode Work Factor (N): 65536
• Block Size (r): 8
• Parallelization (p): 1
• Output Key Length: 64 bytes (split into a 32-byte Encryption Key and a 32-byte Authentication Verifier)

Key Slot Architecture (Slot Size: 212 Bytes)

Each slot in the archive represents a potential door. The slot is composed of:

1. Token Salt (16 bytes): Random cryptographic salt generated using CSPRNG.
2. Verifier (32 bytes): Generated by hashing the derived scrypt key with SHA-256. This is matched during decryption to locate the appropriate key slot.
3. Slot IV (12 bytes): Initialization vector for GCM encryption of the sector reference metadata.
4. Slot Tag (16 bytes): Authenticated decryption tag of the GCM block.
5. Slot Ciphertext (136 bytes): Encrypted Sector Reference Metadata containing sector offset, sector length, and sector key.

3. Advanced Operational Protections

3.1 Anonymize Mode (Metadata Scrubber)

When Anonymize Mode is enabled, the system wipes operational forensics:

• Filename Schematization: Original filenames are replaced in the archive's internal manifest with sequential mappings: file_0.ext, file_1.ext, etc.
• Path & Username Cleansing: Directory structures, user-profile paths, and system-specific metadata are omitted from the bundle.
• Header Hint Suppression: Any header hint parameters are stripped to prevent plaintext leaks.
• Timestamp Sanitization: Upon extraction, the modification and access timestamps of the resulting files are set to the Unix Epoch (1970-01-01 00:00:00 UTC).

3.2 Self-Destruct Mode (Failsafe Payload Erasure)

Self-destruct protects local archives against offline brute-force attempts:

• Fail Attempt Counter: Tracks successive incorrect password attempts on a target archive.
• Threshold Limit: Customizable parameter max_attempts (defaults to 5).
• Execution Rules: Supports always, firstTime, or custom numeric limits.
• Shredding Payload: Wipes archive binary payload, replacing it with inline base64 decoy dragon logo content.

4. Installation & Setup

1. Install Bun
   curl -fsSL https://bun.sh/install | bash
2. Install Dependencies
   bun install
3. Compile Standalone Binary
   bun build --compile c:\hidebaf\hidebaf.js --outfile c:\hidebaf\hidebaf.exe

5. Command Reference

hide [options] <files...>

• -o, --output <file>: Output archive path
• --token <token>: Provide a real token non-interactively
• --hint <text>: Store a plaintext hint in the archive header
• --no-compress: Disable zlib payload compression
• --decoy <password>: Add a decoy token
• --export-tokens <path>: Export all tokens to a .EBFATs file

settings

Open settings configuration menu to toggle secret modes, theme styles, self-destruct thresholds, and command blocking routes.

6. Settings Configuration

# HIDEBAF Settings Configuration
theme: dragon
secret_modes:
  scorched_earth: false
  ghost: false
  paranoid: false
  anonymize: false
features:
  default_compress: true
  auto_redirection: false
  verbose_audit: true
  export_warnings: true
self_destruct:
  active: false
  max_attempts: 5
  mode: firstTime
disabled_plugins: []
disabled_commands: []

Frequently Asked Questions

Can I decrypt my archive without the token?

No. Access depends on a correct slot verification key. Decoy keys lead to junk sectors.

How does Self-Destruct trigger?

When active, each unsuccessful decryption attempt increments the failure counter. If the maximum attempt limit is hit, the archive is permanently overwritten with decoy image base64 data.