林徽因的人生，始于一场点亮灵魂的遇见。1920年，16岁的她随父亲旅居伦敦，本是懵懂青涩的少女，却在与一位英国女建筑师的交谈中，找到了一生的奔赴。那位建筑师告诉她，建筑从来不是冰冷的砖瓦堆砌，而是承载人间烟火、生活记忆、一生时光的温暖空间，是把美与生命凝固在天地间的艺术。这句话如同一盏明灯，彻底照亮了林徽因的人生方向，她毅然立下志向：此生要做一名建筑师，为中国构筑有温度、有风骨的建筑文明。在那个女性被束缚在深闺、求学择业都备受歧视的年代，一个少女敢于冲破世俗桎梏，选择冷门艰辛的建筑学，这份远见与勇气，早已超越了同时代的绝大多数人。
逐梦之路，从来布满荆棘，林徽因却从未有过半步退缩。怀揣建筑理想，她远赴美国宾夕法尼亚大学求学，却遭遇了最荒唐的性别偏见：校方以“建筑系需通宵绘图，男女共处画室不合时宜”为由，拒绝让她进入正式建筑系学习。明明心怀赤诚、天赋卓绝，却只因女儿身，被拦在理想的大门之外。这般不公，没有浇灭她的热爱，反而淬炼了她的坚韧。林徽因转而就读美术系，利用一切课余时间，旁听、自学、苦修，硬生生修完了建筑系全部核心课程，学业成绩名列前茅，凭借过硬的实力，被学校破格聘为建筑系助教。曾经被拒之门外的少女，最终站在讲堂上，为一众男生批改作业，用实力击碎了世俗对女性的偏见。
学成归国，林徽因没有沉溺于北平文人圈层的风雅生活，而是与梁思成携手，踏上了走遍华夏、寻访古建筑的漫漫征途。彼时的中国，战火渐起，民生凋敝，西方学界曾狂妄断言“中国无唐代木构建筑”，肆意贬低华夏建筑文明。为了驳斥谬论、抢救濒临消亡的古建筑遗存，林徽因与梁思成舍弃安逸，背着行囊、带着工具，深入荒山野岭、走遍穷乡僻壤。山西应县木塔、五台山佛光寺、河北赵州桥……那些被世人遗忘、在风雨中飘摇千年的古建筑，都留下了他们跋涉的足迹。
她不是养在深闺的娇弱名媛，而是攀屋顶、爬梁架、踏泥泞、冒寒暑的田野学者。风吹日晒、路途艰险，从未让她停下脚步，她用心测绘每一根梁柱、细致描摹每一片瓦当、潜心钻研每一处结构，更读懂了古建筑背后承载的华夏审美、民族文脉与历史精神。在她眼中，一塔一寺、一桥一宇，从来不是无生命的建筑，而是中华民族镌刻在大地上的文明记忆，是华夏儿女不可割舍的文化根脉。1937年，她与梁思成在五台山深处发现唐代佛光寺，一举打破西方学界的错误论断，为中国建筑史写下里程碑式的篇章。后来，北京城面临大规模旧城改造，大批千年古建、古城墙被划入拆除范围。林徽因与梁思成这份成就，是她用双脚丈量山河、用匠心坚守理想换来的。
《南渡北归》中最让我动容的，是林徽因在乱世流离中的坚守与风骨。抗战爆发，北平沦陷，山河破碎，生灵涂炭，林徽因和梁思成原本有机会离开。美国不少大学向他们抛出橄榄枝，那是多少人梦寐以求的生路。但林徽因只说了一句：“中国读书人总要守在自己的国土上。”于是，一家人踏上南渡逃难的漫漫长路。别人逃难，携金银、带细软，只为保全身家性命；而林徽因与梁思成，舍弃全部家产，唯独带走满满一箱手绘建筑图纸与田野考察笔记。那不是普通的纸张，而是他们数年心血凝成的文脉火种，是乱世中绝不丢弃的民族文化瑰宝。
一路颠沛，从长沙到昆明，再到四川李庄，战火纷飞、饥寒交迫、缺医少药，原本体弱的林徽因，不幸染上严重肺病，常年卧病在床，被病痛反复折磨。李庄阴冷潮湿、物资极度匮乏，她常常在昏暗的油灯下，裹着破旧衣衫，强忍病痛整理资料、撰写文稿、绘制图纸。最困难的时候，梁思成不得不当掉父亲留下的怀表，换回一些急需的药品。林徽因知道后哭着说：“那是你父亲留给你的唯一纪念啊！”梁思成却笑着回应：“怀表可以再买，你的命只有一条。”即便被贫困与病痛压得喘不过气，她也从未放弃古建筑研究，从未放下心中的家国担当。她在病榻上仍坚守学术，研读晦涩如天书的《营造法式》，协助梁思成完成《中国建筑史》，把半生所学、所见、所悟，尽数留给后世。她曾说，建筑是比文字更真实的文明载体，守护古建筑，就是守护中华民族的精神根基。这份在山河破碎时，依旧不肯低头、不肯放弃的文化自觉，便是中国知识分子最珍贵的风骨。
新中国成立后，林徽因依旧拖着病体，为国奉献。她参与中华人民共和国国徽设计，主张把中国最古老的玉壁元素融入其中，将传统纹样中的稻穗、齿轮与天安门元素精妙融合，让国家象征里流淌着民族文化的血脉。当时她咳着血，却坚持修改国徽图纸，丈夫梁思成抢走她的画笔，她轻声说：“这是我的战场，让我打完最后一仗。”最终定稿的国徽图案，融合了她诸多建议，她坚持要在齿轮中加入稻穗，象征工农联盟：“我们要让全世界看到，新中国是人民的国家。”她还投身人民英雄纪念碑纹样创作，以精湛的艺术手法，将近代以来的革命史诗凝固在汉白玉之上，让英烈精神永垂不朽。她带领团队抢救濒临失传的景泰蓝工艺，深入作坊调研、改良设计、创新技法，让这项千年技艺重焕生机，成为享誉世界的文化瑰宝。

As part of my efforts in reducing my dependency on Big Tech, I have been researching how to self-host my password manager. One solution that looks very promising is Vaultwarden, an open source clone of the Bitwarden cloud server. An interesting aspect of this server is that it stores all the secrets in a standard SQLite database, so in addition to having the self-hosted password server I could keep a backup copy of the database on my machine and query it directly. But of course, the secrets are encrypted in this database, so they are useless unless I learn how to decrypt them, similar to how the Bitwarden clients do it.

Speaking of the Bitwarden clients, while I was writing this article it came out that the official Bitwarden CLI client was compromised in a supply chain attack. This is a tool that I personally use and have on all my computers, so this feels like a wake up call to me. Luckily I did not install the compromised version myself, but I think there is an argument to be made about rolling your own secret management client instead of relying on the one all the hackers are after!

In this article I'll share how the encryption of secrets works in Bitwarden and its Vaultwarden clone. I'll also include working Python code, in case you want to tinker with this and like myself, would be interested in building your own tooling to keep your secrets safe.

The 10,000 foot view
Okay, let's get to it, first at a high enough level to keep things simple.

Bitwarden, Vaultwarden and pretty much any half decent password manager store all your secrets encrypted in the server. When I say "secrets" I do not mean just the passwords, but also the usernames, URLs, notes, attachments and everything else that you store that applies to each secret. Bitwarden even encrypts the name you give to each secret. Only the client knows how to encrypt or decrypt, and it always encrypts data before sending it to the server. The server only knows how to store and retrieve blobs of encrypted data from a database.

To encrypt and decrypt secrets, the client uses a master key that is associated with your account. The master key is a random sequence of bytes that is generated in the client at the time you create an account. Like the secrets, this master key is itself encrypted before it is sent to the server for storage. The encryption algorithm used to encrypt the master key is similar to that of the secrets, but they encryption key in this case is generated from the the passphrase chosen by the user to protect the account.

So you see, the account passphrase is not directly used to encrypt your secrets as many people think, it just encrypts the master key. To be able to decrypt your secrets, the Bitwarden client first uses your passphrase to decrypt the master key. Then it uses the master key to decrypt your actual secrets. When the client leaves your vault unlocked, it just means that it is keeping a copy of the decrypted master key in memory (or maybe the whole decrypted vault), so that it can return secrets to you without you having to type your passphrase again. To lock your vault, all the client needs to do is discard the master key.

The master key
I will now share the details of how things work, which as far as I know are not formally documented anywhere. I had to dig through the Bitwarden and Vaultwarden source code to figure out a lot of these details.


These three sections are all binary sequences written in base64 encoding, which ensures all characters are printable. Below you can see some more Python code to decode the secret into its parts:

from base64 import b64decode
# ...

version, payload = encrypted_secret.split('.', 2)
if version != '2':
raise ValueError('Unsupported encryption version')
fields = payload.split('|')
if len(fields) != 3:
raise ValueError('Invalid encrypted data')
iv = b64decode(fields[0])
ciphertext = b64decode(fields[1])
mac = b64decode(fields[2])
Before attempting to decrypt the secret, we need to ensure that the encrypted string isn't corrupted or altered in any way. For this we can independently calculate the MAC signature and then compare it against the mac value included in the secret. If the two are different, then we'll know that the encrypted string has been corrupted or tampered with, so in that case this secret should be discarded as invalid.

For the signature, Bitwarden computes a standard HMAC hash of the concatenation of iv and ciphertext, using the SHA-256 hash function. The secret key used to calculate this hash is the mac_key part of the master key. If you are not familiar with cryptographic functions then just know that this is a standard cryptographic calculation, so common that it is available in the Python standard library. Below you can see Python code that calculates the value of mac and then confirms that the calculated value is identical to the mac value that comes with the secret: