In modern cloud engineering, credential security is non-negotiable. Storing server passwords and unencrypted SSH private keys in flat configuration files on developer laptops exposes infrastructure to credential theft, malware, and unauthorized lateral movement.
How CATerm Implements Zero-Knowledge Vaults
CATerm employs a military-grade cryptographic envelope architecture. Your master password is never stored anywhere on disk or memory. Instead, it derives a Key Encryption Key (KEK) using Argon2id with high memory-cost parameters.
All server records, SSH keys, SFTP connection strings, and custom snippets are encrypted into an on-disk SQLite database using AES-256-GCM authenticated encryption. When CATerm locks or closes, encryption keys are immediately zeroized from RAM.
Trust On First Use (TOFU) & MITM Prevention
CATerm features automatic TOFU host-key pinning. When a remote server identification changesāwhether due to legitimate OS reinstallation or an adversarial Man-in-the-Middle interceptāCATerm immediately blocks connection attempts with a security warning.
With v2.1.24, administrators can securely clear cached host keys with a single click right from the host context menu once reinstallation has been verified.