Encrypted CBOX storage
Developer encryption: open Keyboxes → Encryption, select an XML or ZIP file, choose an XML entry from ZIP, or paste XML.
Where to find it: Keyboxes. Where is each feature?
What to do
- Use the Encryption panel to create a CBOX from authorized XML.
- Store or export it, and keep the unlock information separate.
- CBOX encryption does not make an invalid keybox valid.
Details and limits
Save writes a password-protected .cbox to /data/adb/cleverestricky/Encrypted with private permissions; Save Backup exports it. This does not install, activate or unlock a keybox. Use the separate Keybox upload flow when you intend to activate a container. Detailed Pages guide
Purpose
CBOX provides encrypted storage and transfer for keybox material. It reduces exposure from plain XML while preserving the verification requirements of Keybox Manager.
Container protection
CBOX uses authenticated AES 256 GCM encryption. Authentication data binds container metadata to the encrypted content, so modified data fails before key material is accepted.
Password based containers derive their encryption key through a bounded key derivation process. Device protected local caches use a key stored in the private configuration area. Sensitive byte arrays are cleared after use where the runtime allows it.
Unlock behavior
Unlock requests are accepted only through the native module manager WebUI transport. The selected file name, password data, and optional public key information are validated. Successful decryption does not bypass keybox verification. The resulting material must still pass private key, certificate, chain, date, algorithm, and revocation checks.
Locked files remain visible as locked state without exposing their content. Unlocked material is tracked separately from server supplied material so the interface can report a clear source and status.
Limits
Encryption does not make unauthorized key material legitimate. A running root process can access module state, and a compromised operating system can observe data after it is unlocked. Device security, root access control, and backup handling remain important.
Use a unique password for exported containers. Do not send a password through the same channel as the encrypted file when operational separation is required.