Zero Cloud. Zero Telemetry.
Mathematically Private.

Modern digital security relies heavily on multi-factor authentication (MFA). However, the mainstream industry has introduced severe vulnerability vectors by forcing authenticators into centralized cloud ecosystems. Cloud-synced 2FA services create centralized honey pots vulnerable to server compromise, database breaches, SIM-swapping cascade attacks, and rogue internal access.

Nova Authenticator 2FA was architected with a singular mathematical axiom: what is never collected can never be leaked, stolen, coerced, or compromised. We operate under the cryptographic principle of Zero-Knowledge by Construction. The application functions as an autonomous, self-contained mathematical engine.

1.1 Architectural Contrast: Cloud 2FA vs. Nova Authenticator

To illustrate our strict air-gapped doctrine, review the structural data-flow comparison below:

Nova Authenticator 2FA implements the Internet Engineering Task Force (IETF) open cryptographic specifications: RFC 6238 (Time-Based One-Time Password Algorithm - TOTP) and RFC 4226 (HMAC-Based One-Time Password Algorithm - HOTP).

2.1 The TOTP Computation Pipeline

The generation of one-time passcodes occurs entirely within local volatile RAM and adheres to the following cryptographic formula:

// Step 1: Unix Timestamp to Discrete Time-Step Counter T
T = floor((CurrentUnixTime() - T0) / X)
Where T0 = 0 (Unix Epoch) and X = TimeStepPeriod (Standard: 30 seconds)

// Step 2: HMAC-Hash Computation over Big-Endian 64-bit Counter T
HMAC_Hash = HMAC-SHA-x(Base32_Decode(SecretKey), Int64ToBytes(T))
Supported Hash Functions: SHA-1 (RFC Standard), SHA-256, SHA-512

// Step 3: Dynamic Truncation (DT) extraction of 31-bit integer
Offset = HMAC_Hash[Length - 1] & 0x0F
BinaryCode = ((HMAC_Hash[Offset] & 0x7F) << 24) |
             ((HMAC_Hash[Offset + 1] & 0xFF) << 16) |
             ((HMAC_Hash[Offset + 2] & 0xFF) << 8)  |
             (HMAC_Hash[Offset + 3] & 0xFF)

// Step 4: Modulo Reduction to Desired Digit Length
TOTP_Code = BinaryCode % (10 ^ Digits)  // Digits standard: 6 or 8

2.2 Cryptographic Primitives Matrix

All cryptographic primitives employed by Nova Authenticator 2FA have been formally audited and adhere to NIST guidelines:

Unlike standard mobile applications that store secrets in unencrypted shared preferences or cleartext databases, Nova Authenticator 2FA binds its master encryption credentials directly to the host platform’s hardware security module (HSM):

• On Android: The AndroidKeyStore provider is leveraged via hardware-backed Keymaster / Keymint running inside a Trusted Execution Environment (TEE) or dedicated StrongBox Keymaster chip.
• On iOS: Secrets are protected by the Apple Secure Enclave processor (SEP) with kSecAccessControlBiometryAny access control policies.

3.1 Protection Against Memory Dumping & Cold-Boot Attacks

When one-time passcodes are calculated, plaintext secrets reside in allocated heap memory for only microseconds. Immediately following calculation, the application invokes explicit zero-fill byte scrubbing routines to overwrite buffer memory with 0x00 null bytes, preventing forensic extraction from OS swap files or RAM dumps.

In compliance with GDPR Article 5(1)(c) (Data Minimisation), Nova Authenticator 2FA takes the maximalist position: the minimum amount of data required to provide one-time code generation is zero bytes.

Nova Authenticator 2FA requests only the absolute minimum permissions strictly essential for user functionality. Each requested permission is isolated behind strict runtime user consent:

5.1 Camera Permission (android.permission.CAMERA / NSCameraUsageDescription)

Purpose: Used exclusively to scan optical two-factor QR barcodes formatted in the standard otpauth:// URI format.

5.2 Biometric Hardware Access (USE_BIOMETRIC / NSFaceIDUsageDescription)

Purpose: Optional vault authentication via FaceID, TouchID, or Android BiometricPrompt.

Biometric templates (fingerprint vectors or facial depth maps) never leave the device’s physical Secure Enclave. Nova Authenticator 2FA does not have access to your biometric data; it receives only a cryptographic challenge response (BiometricPrompt.CryptoObject) signed by the operating system kernel.

5.3 Absence of Network Permissions

Unlike 99% of modern apps, Nova Authenticator 2FA does not include background synchronization services. The app operates with full integrity even when placed inside a Faraday bag or with Airplane Mode enabled.

We reject proprietary, closed-source backup formats designed to lock users into walled gardens. In accordance with GDPR Article 20 (Right to Data Portability), Nova Authenticator 2FA implements the open-standard Aegis Authenticator JSON backup schema.

{
  "version": 1,
  "header": {
    "slots": null,
    "params": null
  },
  "db": {
    "version": 1,
    "entries": [
      {
        "type": "totp",
        "uuid": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
        "name": "developer@company.com",
        "issuer": "GitHub",
        "note": "Production Key",
        "favorite": true,
        "info": {
          "secret": "JBSWY3DPEHPK3PXP",
          "algo": "SHA1",
          "digits": 6,
          "period": 30
        }
      }
    ]
  }
}

6.1 Export & Import Security Protocol

When you export your vault, the JSON payload is produced strictly within local volatile memory and handed to the native OS system share sheet or clipboard. Nova Authenticator 2FA never uploads, caches, or analyzes your exported files. Users are strongly advised to store exported backups on encrypted media (such as LUKS, BitLocker, or FileVault drives).

A common vulnerability in modern mobile apps is the inclusion of third-party SDKs that secretly harvest telemetry, advertising IDs (IDFA/GAID), and network fingerprints.

Nova Authenticator 2FA contains ZERO third-party marketing, tracking, or analytical SDKs. The table below serves as a formal audit of what is explicitly absent from our compiled binaries:

Because Nova Authenticator 2FA processes all data strictly on client hardware and never transmits data to any external party, it achieves natural “Compliance by Architecture” across all major data protection jurisdictions:

8.1 European Union GDPR Compliance (Regulation EU 2016/679)

• Article 5(1)(c) - Data Minimisation: 100% compliant. Zero personal data collected or stored externally.
• Article 25 - Data Protection by Design and by Default: 100% compliant. Architecture is air-gapped by default.
• Article 17 - Right to Erasure: 100% compliant. Users can execute instantaneous cryptographic erasure in 1 tap.
• Article 20 - Right to Data Portability: 100% compliant. Aegis standard JSON export available at any time.

8.2 California Consumer Privacy Act & CPRA

• Sale / Sharing of Personal Information: Nova Authenticator 2FA does not sell, rent, or share personal information with any commercial entity, broker, or advertiser.
• Opt-Out Rights: Not applicable because zero data collection or sale occurs.

8.3 App Store Privacy Declarations

Nova Authenticator 2FA is a general-audience utility for securing online credentials. We do not knowingly collect, solicit, or process personal data from children under the age of 13 (or under 16 in the European Union), nor do we collect data from any adult user.

Because no user accounts, profiling, behavioral targeting, or servers exist, the application is inherently compliant with the United States Children’s Online Privacy Protection Act (COPPA), the UK Age Appropriate Design Code (AADC), and equivalent global child protection statutes.

Nova Authenticator 2FA provides an irreversible self-destruction feature labeled “Erase All Accounts” within the Settings modal. When triggered:

1. The local SQLite / AsyncStorage vault payload is overwritten with cryptographically random garbage before unlinking.
2. The OS Keystore master key reference is permanently deleted from the hardware security enclave.
3. Volatile RAM token state is wiped with zeroes.
4. Uninstalling the application causes the mobile OS sandboxing system to completely delete all application directories.

We welcome independent audits and responsible security vulnerability disclosures from the cryptographic research community. To report security observations or submit cryptographic reviews, encrypt your communication using our official PGP key:

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: Nova Security Enclave Key v2.4
Comment: Dedicated Security Contact: security@nova-auth.io

mQINBGY/1Y8BEAC0XlA1p3fCg9qR2m8sT4vU7wY1z5a6B8cD9eF0gH1jK2lM3nO4
p5qR6sT7uV8wX9yZ0a1B2cD3eF4gH5jK6lM7nO8p9qR0sT1uV2wX3yZ4a5B6cD7e
F8gH9jK0lM1nO2p3qR4sT5uV6wX7yZ8a9B0cD1eF2gH3jK4lM5nO6p7qR8sT9uV0
wX1yZ2a3B4cD5eF6gH7jK8lM9nO0p1qR2sT3uV4wX5yZ6a7B8cD9eF0gH1jK2lM3
nO4p5qR6sT7uV8wX9yZ0a1B2cD3eF4gH5jK6lM7nO8p9qR0sT1uV2wX3yZ4a5B6c
D7eF8gH9jK0lM1nO2p3qR4sT5uV6wX7yZ8a9B0cD1eF2gH3jK4lM5nO6p7qR8sT9
uV0wX1yZ2a3B4cD5eF6gH7jK8lM9nO0p1qR2sT3uV4wX5yZ6a7B8cD9eF0gH1jK2
=9xY3
-----END PGP PUBLIC KEY BLOCK-----

This Privacy Manifesto constitutes a legally binding covenant between Nova Authenticator 2FA and the end user. Any prospective modification to this policy that would introduce cloud storage, network telemetry, or third-party analytics is strictly prohibited by our core governance charter.

Should any future operating system update require technical changes to permission handling, this document will be updated with an incremented version number and public cryptographic changelog.