cadrumo.adapters.persistence.storage.custody._kdf_records module

The Argon2id parameter grid and wrapped-DEK shape, as plain wire rules.

One declaration of the custody v1 KDF grid and of the canonical base64 rule. The pydantic records in records annotate with these aliases and call canonical_b64(); the supervised key-derivation worker, which is started for every wrap and unwrap and must not import pydantic, validates its request with kdf_parameters_from_wire() and wrapped_dek_from_wire(). Standard library and cryptography constants only.

Every refusal is a ValueError, which the worker already turns into its failure frame, exactly as it did for the pydantic ValidationError.

canonical_b64(value, *, field_name, expected_bytes)[source]

Return value if it is the canonical base64 of exactly expected_bytes bytes.

Return type:

str

Parameters:

  • value (str)

  • field_name (str)

  • expected_bytes (int)

class KdfParameterValues(algorithm, version, memory_mib, iterations, parallelism, salt_b64, output_bytes)[source]

Bases: object

A validated KDF parameter set, as the worker consumes it.

Parameters:

  • algorithm (str)

  • version (int)

  • memory_mib (int)

  • iterations (int)

  • parallelism (int)

  • salt_b64 (str)

  • output_bytes (int)

algorithm: str
version: int
memory_mib: int
iterations: int
parallelism: int
salt_b64: str
output_bytes: int
class WrappedDekValues(nonce_b64, ciphertext_b64, tag_b64)[source]

Bases: object

A validated wrapped-DEK record, as the worker consumes it.

Parameters:

  • nonce_b64 (str)

  • ciphertext_b64 (str)

  • tag_b64 (str)

nonce_b64: str
ciphertext_b64: str
tag_b64: str
kdf_parameters_from_wire(value)[source]

Validate a KDF parameter record received as JSON-shaped data.

Return type:

KdfParameterValues

Parameters:

value (object)

wrapped_dek_from_wire(value)[source]

Validate a wrapped-DEK record received as JSON-shaped data.

Return type:

WrappedDekValues

Parameters:

value (object)