Write new backups as MDD2 envelopes with per-file scrypt salts, random IVs, and AES-256-GCM authenticated encryption. Authenticate the versioned header and normalize malformed or tampered payload failures without exposing protected data.
Keep MDD1 decryption as read-only migration compatibility and add regression coverage for known legacy imports, truncation, unsupported versions, nondeterministic output, and tampering across every protected envelope field.
Sucukdeluxe