package com.codename1.security.vault.spi

The single extension point a port implements to take part in Vault.

Everything else in the vault – the envelope format, the key derivation, the wrapping scheme, the policy rules – is shared code, because two platforms that derive different bytes from the same password do not interoperate and no amount of per-port care fixes that afterwards. What genuinely differs is where a device keeps the key that lets a vault reopen without a password, and that is DeviceProtection.

A port that does nothing gets SecureStorageDeviceProtection, which keeps a random key in SecureStorage. That is correct wherever SecureStorage is the operating system’s secret store and wrong in a browser, which is why the JavaScript port overrides it.