aeat.adapters.persistence.storage.master_key._kdf_params module¶
Canonical Argon2id parameter record.
Strict pydantic v2 model declaring the Argon2id KEK-derivation parameters
the substrate accepts. The KdfParams.default() classmethod
materialises the OWASP 2024 Password Storage Cheat Sheet baseline:
algorithm="argon2id"version=19(Argon2 v1.3)memory_cost=19 * 1024KiB (19 MiB)time_cost=2iterationsparallelism=1lanesalt= 16 bytesoutput_length= 32 bytes
Validators reject parameter sets outside the supported window so a tampered manifest cannot drive the KDF into a weaker regime at unlock.
- class KdfParams(**data)[source]¶
Bases:
BaseModelOWASP-baseline Argon2id parameters with strict validation.
Distinct from the manifest-side
adapters.persistence.storage.bucket.ManifestKdfParamsrecord: that record carries whatever parameter set the bucket was enrolled under (so a future cost-bump is non-breaking); this record pins the parameter window the substrate accepts for new enrolments and rejects anything outside it.- Parameters:
- algorithm: Literal['argon2id']¶
- version: Literal[19]¶
- memory_cost: int¶
- time_cost: int¶
- parallelism: int¶
- salt: bytes¶
- output_length: Literal[32]¶
- classmethod default()[source]¶
Return a
KdfParamsinstance with the canonical OWASP 2024 Argon2id baseline parameters.- Return type:
- to_manifest_params()[source]¶
Return this canonical parameter set as a
ManifestKdfParamsbucket-manifest shape.- Return type: