- AES-256-CBC encryption with PKCS7 padding using pycryptodome
- HMAC-SHA256 of ciphertext prepended to blob (mac_key, 32 bytes)
- Encrypted blob layout: HMAC(32) + IV(16) + ciphertext
- IV is 16 bytes (corrected from STACK.md documentation error of 32 bytes)
- Detection.xml with all 8 EncryptionInfo sub-elements and correct namespace
- Inner ZIP uses DEFLATE compression; outer ZIP uses STORED compression
- All 14 byte-level tests pass including crypto roundtrip verification
- 14 tests covering outer ZIP structure, Detection.xml schema, key sizes
- Cryptographic roundtrip: HMAC-SHA256, AES-256-CBC decryption, file digest
- IV size assertion: must be 16 bytes (critical correction from RESEARCH.md)
- Tests serve as format specification for build_intunewin() implementation
kawa