SPECIFICATION C127G // v2.1.0 STABLE RELEASE

Air-Gapped Steganographic Password & .env Secret Vault.

Name: C127G Sovereign Cryptographic Vault
Availability: InStock
Author: Cyzog

Conceal AES-256-GCM encrypted credentials, hardware seed phrases, and developer .env files inside the Least Significant Bits (Bit-0) of standard lossless PNG images. Protected by 256 MiB Argon2id memory-hard key derivation and plausible-deniability duress decoy mounts.

Download Windows .exe ($0+ PWYW) Inspect Cryptographic Spec

KDF MEMORY HARDNESS

256 MiB Argon2id

RFC 9106 · t=4, p=4

CARRIER OPTICAL DELTA

0.39% Max Shift

Bit-0 RGB PNG Weave

AUTH CIPHER PRIMITIVE

AES-256-GCM

96-bit Nonce · 128b Tag

SOCKET TELEMETRY

0.00 KB/s

100% Air-Gapped EXE

KDF: 262,144 KB MATRIX

LSB BIT-0: AUTHENTICATED

DURESS MOUNT: READY

§ 01 // STEGANOGRAPHIC BIT-PLANE & DURESS ARCHITECTURE

REFERENCE SPEC WALKTHROUGH // SAMPLE VECTOR

Inspect How Ciphertext Hides Inside Ordinary Pixels

Click any carrier pixel coordinate below to inspect its 8-bit RGB channels, or switch vault authentication modes on the right to compare the Primary .env Vault against the Plausible Deniability Duress Mount.

CARRIER FILE: alpine_telemetry_raw.png

LOSSLESS 24-BIT RGB · 3.42 MB

Lossless PNG Carrier Image Concealing C127G Encrypted Payload

OPTICAL HISTOGRAM DELTA: 0.39% (INVISIBLE TO HUMAN EYE)

LOUPE COORD: PX [0,0]

SELECT CARRIER PIXEL COORDINATE TO DISSECT RGB BIT-0: 8 BITS = 1 CIPHERTEXT BYTE

BLUE CHANNEL BYTE (42 → 43) // BIT-0 INJECTED:

0 0 1 0 1 0 1 1

ASSEMBLED CIPHERTEXT BYTE:

0xB5 (10110101₂) · AES-GCM STREAM

AUTHENTICATED VAULT EXTRACTION ENGINE

Switch authentication keys below to verify primary .env extraction or plausible deniability decoy mounting.

GCM TAG VERIFIED // PRIMARY PRODUCTION VAULT MOUNTED

SECRET_KEY_01 // AWS PRODUCTION IAM AES-256-GCM

AWS_SECRET_ACCESS_KEY="wJalrXUtnFEMI/K7MDENG/bPxRfiCYzogKey"

SECRET_KEY_02 // CORE DATABASE CLUSTER AES-256-GCM

DATABASE_URL="postgresql://admin:9f8a7d6c5b@10.0.0.42:5432/prod_ledger"

SECRET_KEY_03 // HARDWARE WALLET BIP-39 SEED 24-WORD ENCLAVE

ETH_COLD_RECOVERY="abandon ability able about above absent absorb..."

SECRET_KEY_04 // PAYMENT GATEWAY LIVE AES-256-GCM

STRIPE_LIVE_SECRET="sk_live_51NxCyzogSovereignVault994120"

KDF TIME: 410ms (256 MiB Argon2id) CLIPBOARD AUTO-SCRUB: ARMED (15s)

DURESS KEY ENTERED // DECOY STAGING VAULT MOUNTED

INDEPENDENT ARGON2ID SLOT

When unlocked under coercion with your secondary Duress Password, C127G derives an independent 256-bit AES-GCM key from a separate 128-bit CSPRNG salt (m=256 MiB Argon2id)—mounting only the benign staging vault slot while primary production records remain cryptographically sealed.

DECOY_ENTRY_01 // LOCAL SANDBOX DB DECOY VAULT SLOT

STAGE_DB_URL="sqlite:///C:/dev/local_test_sandbox.db"

DECOY_ENTRY_02 // MOCK API TOKEN DECOY VAULT SLOT

SANDBOX_API_KEY="pk_test_0094812_non_sensitive_staging_token"

DECOY_ENTRY_03 // PUBLIC DEMO SSH DECOY VAULT SLOT

DEV_VM_LOGIN="vagrant@192.168.56.101 (port 2222)"

SEPARATE 128-BIT SALT + GCM TAG DECOY ISOLATION: VERIFIED

SAMPLE LSB BIT-0 PAYLOAD // AES-256-GCM FRAME LAYOUT

12-BYTE NONCE + CIPHERTEXT + TAG

// 128-BIT ARGON2ID SALT (16B) + 96-BIT GCM NONCE (12B)

0x0000: B5 4A E2 91 0C 7F 3B 88 D4 19 6E A0 55 C2 09 4F

0x0010: 71 8D 33 F0 6A 2C 9E 14 B8 05 E7 41

// AES-256-GCM CIPHERTEXT PAYLOAD (RGB BIT-0 LSB WEAVE)

0x001C: 44 9C 1F 77 E0 23 B6 58 0D F4 8A 31 C9 62 10 EB

0x002C: 89 04 D2 6F 3A B1 57 C8 90 2E 7B 15 F3 4C A6 3D

0x003C: 1C 75 E8 42 9B 0E 63 D7 5A F1 28 84 3E C0 97 6B

// 128-BIT GCM POLYVAL AUTHENTICATION TAG (16B)

0x004C: E9 32 7C 0B 85 D1 46 F8 2A 93 60 BC 17 E4 59 A1

Every decryption guess requires a full 256 MiB Argon2id memory allocation (t=4, p=4) before AES-256-GCM tag verification—defeating multi-GPU offline cracking clusters.

§ 02 // SIX-MODULE SOVEREIGN VAULT ARCHITECTURE

Six-Module Local Vault Architecture

Built for software engineers, cryptographic key custodians, and security researchers who refuse to synchronize production .env keys or recovery seeds to third-party browser extensions.

[MOD.01 // LOCAL ENCLAVE] 0.00 KB/s EGRESS

Air-Gapped Master Credential Store

Store seed phrases, SSH keys, and banking credentials in an offline database that never binds a network socket.

STORAGE: LOCAL DISK / USB NO CLOUD SYNC

[MOD.02 // DEVSECOPS PIPELINE] 1-CLICK .ENV

One-Click Developer .env Generator

Select multiple key-value secrets and export a strictly formatted .env configuration file directly into your local repository.

FORMAT: .ENV · K8S · TFVARS ZERO GIT LEAKS

[MOD.03 // OPTICAL CARRIER] Δ 0.39% MAX

Lossless PNG LSB Steganography

Weaves authenticated ciphertext into Bit-0 of RGB color channels inside standard .png images with a 0.39% maximum optical delta.

CARRIER: 24-BIT / 32-BIT PNG BIT-0 WEAVE

[MOD.04 // COERCION DEFENSE] DUAL KEYSPACE

Plausible Deniability Duress Mounts

Configure a secondary duress master key that mounts a believable decoy vault populated with non-sensitive staging keys.

KDF: INDEPENDENT SALT DECOY ENCLAVE

[MOD.05 // OFFLINE P2P SHARE] .C127G CAPSULE

Encrypted Peer-to-Peer .c127g Containers

Export key-locked, offline .c127g transfer containers to share secrets across internal channels without plaintext exposure.

TRANSPORT: AIRDROP / LAN / USB GCM SEALED

[MOD.06 // WIN64 NATIVE] STANDALONE .EXE

Native Compiled Windows Executable

Packaged as a standalone Windows x64 binary with zero Electron/Chromium bloat, zero external runtime dependencies, and stripped symbols.

TARGET: WIN 10 / 11 (x86_64) PORTABLE BINARY

§ 03 // CRYPTOGRAPHIC PRIMITIVES & MEMORY HARDENING

Cryptographic Parameter Specification

Engineered to defeat offline GPU cracking clusters and "Store Now, Decrypt Later" traffic harvesting through strict adherence to peer-reviewed RFC and FIPS primitives.

Argon2id Key Derivation (RFC 9106)

m=262,144 KB

Enforces a 256 MiB (262,144 KB) memory-hard matrix across 4 iterations and 4 parallel lanes per key-derivation attempt—neutralizing ASIC and multi-GPU dictionary parallelism.

Authenticated AES-256-GCM (FIPS 197)

256-BIT + 128-BIT TAG

256-bit symmetric cipher with 128-bit GCM authentication tag and 96-bit CSPRNG nonce—detecting any single-bit tampering before decryption output is released.

Zero-Residue Memory Scrubbing

VOLATILE ZEROIZE

Clears plaintext buffers and clipboard allocations immediately upon vault lock or window minimization to prevent cold-boot or crash-dump leakage.

C127G CRYPTOGRAPHIC PIPELINE TRACE

# [STAGE 01] MEMORY-HARD KEY DERIVATION

ALGORITHM: Argon2id v1.3 (RFC 9106) PARAMETERS: m = 262,144 KB (256 MiB) · t = 4 · p = 4 SALT ENTROPY: 128-bit OS CSPRNG

# [STAGE 02] AUTHENTICATED SYMMETRIC SEALING

PRIMITIVE: AES-256-GCM (AEAD) + Win32 DPAPI IV / NONCE: 96-bit Unique Nonce + 128-bit Auth Tag DURESS SLOT: Independent Salt + Argon2id Decoy Vault Slot

# [STAGE 03] CARRIER BIT-PLANE WEAVING

CARRIER MEDIA: Lossless 24-bit RGB PNG INJECTION TARGET: RGB Channel Least Significant Bit (Bit-0) Weave OPTICAL SHIFT: ±1 / 255 Intensity (0.39% Max Delta)

PORTABLE WIN64 BINARY · STRIPPED SYMBOLS

EXECUTABLE PACKAGE // WINDOWS 10 & 11 (x64)

Acquire C127G Vault v2.1.0

Standalone Windows 10/11 x64 executable. Pay-what-you-want licensing ($0+ community access or supporter contribution) with zero subscriptions and zero telemetry.

PACKAGE: C127G_Vault_v2.1.0_x64.exe • LICENSE: PERPETUAL PWYW ($0+) • TELEMETRY: 0.00 KB/s

Download Windows (.exe) — $0+ PWYW

Delivered via Gumroad · Verify binary integrity via SHA-256 Manifest in header.