cadrumo.adapters.persistence.storage.master_key.master_key_derivation module

Argon2id derivation with explicit, caller-supplied parameters.

The cost constants and the no-parameter convenience wrapper that used them are deleted with the file-backed master-key provider they belonged to. Every surviving caller states its own Argon2id parameters, because those parameters are persisted beside the material they protect and must be read back from it rather than re-derived from a module constant that may since have moved.

derive_kek_with_params(passphrase, salt, *, memory_cost, time_cost, parallelism)[source]

Derive a 32-byte KEK with explicit persisted Argon2id parameters.

Raises:

StorageValidationError – When the library refuses the supplied material. The callers’ records validate their parameters before reaching here, so this is the backstop for whatever those records do not constrain – it exists because the alternative is an argon2.exceptions type escaping the storage boundary into a CLI that cannot render it.

Return type:

bytes

Parameters: