Merge pull request #84 from cryptomator/feature/12-fix

tobihagemann · web-flow · commit e6264eef81df · 2025-06-11T16:27:07.000+02:00
diff --git a/docs/security/architecture.md b/docs/security/architecture.md
@@ -139,6 +139,10 @@ The wrapped keys and the parameters needed to derive the KEK are then stored as
 }
 ```
 
+:::note
+When calculating the `versionMac`, the `version` value must be converted to a 32-bit unsigned integer and then encoded as a 4-byte big-endian representation before computing the HMAC-SHA256, regardless of the system's native byte order.
+:::
+
 When unlocking a vault the KEK is used to unwrap (i.e. decrypt) the stored masterkeys.
 
 <WhiteBox>

Original file line number	Diff line number	Diff line change
`@@ -139,6 +139,10 @@ The wrapped keys and the parameters needed to derive the KEK are then stored as`
`139`	`139`	`}`
`140`	`140`	```
`141`	`141`
	`142`	`+:::note`
	`143`	+When calculating the `versionMac`, the `version` value must be converted to a 32-bit unsigned integer and then encoded as a 4-byte big-endian representation before computing the HMAC-SHA256, regardless of the system's native byte order.
	`144`	`+:::`
	`145`	`+`
`142`	`146`	`When unlocking a vault the KEK is used to unwrap (i.e. decrypt) the stored masterkeys.`
`143`	`147`
`144`	`148`	`<WhiteBox>`