feat(anti-forensics): implement incremental auto-vacuum, chunk shredding, and plausible deniability

src/recovery.rs

@@ -8,7 +8,7 @@ use serde::{Deserialize, Serialize};
 use crate::crypto::{
     derive_kek, mnemonic_to_dek, wrap_dek, KdfParams, FORMAT_VERSION,
 };
-use crate::storage::{ContainerMeta, Database};
+use crate::storage::{ContainerMeta, Database, SlotMeta};
 
 pub const HEADER_BACKUP_MAGIC: &str = "SANCTUM_HEADER_BACKUP";
 pub const CURRENT_BACKUP_VERSION: u32 = 1;
@@ -79,6 +79,16 @@ impl HeaderBackup {
         let mut header_tag = [0u8; 16];
         header_tag.copy_from_slice(&tag_bytes);
 
+        let slot0 = SlotMeta {
+            slot_id: 0,
+            version: self.container_format_version,
+            kdf_salt,
+            kdf_params: self.kdf_params.clone(),
+            wrapped_dek: wrapped_dek.clone(),
+            header_nonce,
+            header_tag,
+        };
+
         Ok(ContainerMeta {
             version: self.container_format_version,
             kdf_salt,
@@ -86,6 +96,7 @@ impl HeaderBackup {
             wrapped_dek,
             header_nonce,
             header_tag,
+            slots: vec![slot0],
         })
     }
 }
@@ -166,6 +177,16 @@ pub fn restore_header_from_recovery_key(
     let (wrapped_dek, header_nonce, header_tag) =
         wrap_dek(&kek, &dek).context("Verschlüsseln des DEK fehlgeschlagen")?;
 
+    let slot0 = SlotMeta {
+        slot_id: 0,
+        version: FORMAT_VERSION,
+        kdf_salt: salt,
+        kdf_params: kdf_params.clone(),
+        wrapped_dek: wrapped_dek.clone(),
+        header_nonce,
+        header_tag,
+    };
+
     let meta = ContainerMeta {
         version: FORMAT_VERSION,
         kdf_salt: salt,
@@ -173,6 +194,7 @@ pub fn restore_header_from_recovery_key(
         wrapped_dek,
         header_nonce,
         header_tag,
+        slots: vec![slot0],
     };
 
     // 4. In Container schreiben