cadrumo.adapters.persistence.storage.master_key.kdf_params module

Canonical Argon2id parameter record and the window it validates against.

Strict pydantic v2 model declaring the Argon2id KEK-derivation parameters the substrate accepts. The KdfParams.default() classmethod materialises the OWASP 2024 Password Storage Cheat Sheet baseline:

  • algorithm = "argon2id"

  • version = 19 (Argon2 v1.3)

  • memory_cost = 19 * 1024 KiB (19 MiB)

  • time_cost = 2 iterations

  • parallelism = 1 lane

  • salt = 16 bytes

  • output_length = 32 bytes

Validators reject parameter sets outside the supported window, so no supplied parameter set can drive the KDF into a weaker regime at unlock.

The window constants live here rather than in a package-level module of their own. They were separated originally because a second, manifest-side record declared the same axes and could not import this package without closing a cycle. Both that record and the on-disk key store it validated have since been deleted with the shared-master surface, leaving this record as the window’s only reader.

Widening the window is a deliberate edit here; a cost bump raises a store’s enrolled parameters within it and stays non-breaking.

This window is a KIBIBYTE, continuously-bounded one, deliberately distinct from the finite mebibyte grid profile custody enrols under: that grid is a strictly narrower shape, not a wider one, and every value an already-enrolled store carries must stay readable here.

Argon2Version

Argon2 version 1.3, the only version this substrate derives under.

alias of Literal[19]

KdfOutputLength

Derived KEK length in bytes, fixed by AES-256-GCM.

alias of Literal[32]

MIN_MEMORY_COST_KIB: Final

OWASP 2024 Password Storage Cheat Sheet baseline, and the floor.

class KdfParams(**data)[source]

Bases: BaseModel

OWASP-baseline Argon2id parameters with strict validation.

The constructor for a new enrolment. It reads the window declared above rather than restating one. It once shared that window with an on-disk record validating the same axes; that record is deleted, so the window now has a single reader and the agreement it enforced is no longer at risk.

Parameters:

data (Any)

algorithm: Literal['argon2id']
version: Argon2Version
memory_cost: int
time_cost: int
parallelism: int
salt: bytes
output_length: KdfOutputLength
classmethod default()[source]

Return a KdfParams instance with the canonical OWASP 2024 Argon2id baseline parameters.

Return type:

KdfParams