aeat.adapters.persistence.storage.master_key._kdf_params module

Canonical Argon2id parameter record.

Strict pydantic v2 model declaring the Argon2id KEK-derivation parameters the substrate accepts. The KdfParams.default() classmethod materialises the OWASP 2024 Password Storage Cheat Sheet baseline:

  • algorithm = "argon2id"

  • version = 19 (Argon2 v1.3)

  • memory_cost = 19 * 1024 KiB (19 MiB)

  • time_cost = 2 iterations

  • parallelism = 1 lane

  • salt = 16 bytes

  • output_length = 32 bytes

Validators reject parameter sets outside the supported window so a tampered manifest cannot drive the KDF into a weaker regime at unlock.

class KdfParams(**data)[source]

Bases: BaseModel

OWASP-baseline Argon2id parameters with strict validation.

Distinct from the manifest-side adapters.persistence.storage.bucket.ManifestKdfParams record: that record carries whatever parameter set the bucket was enrolled under (so a future cost-bump is non-breaking); this record pins the parameter window the substrate accepts for new enrolments and rejects anything outside it.

Parameters:
algorithm: Literal['argon2id']
version: Literal[19]
memory_cost: int
time_cost: int
parallelism: int
salt: bytes
output_length: Literal[32]
classmethod default()[source]

Return a KdfParams instance with the canonical OWASP 2024 Argon2id baseline parameters.

Return type:

KdfParams

to_manifest_params()[source]

Return this canonical parameter set as a ManifestKdfParams bucket-manifest shape.

Return type:

ManifestKdfParams