cadrumo.application.user_profile.bundle_encryption module

Passphrase encryption for portable profile-bundle exports.

class EncryptedProfileBundleExport(**data)[source]

Bases: BaseModel

Encrypted transport envelope for a serialized profile-bundle payload.

The ciphertext wraps the exact UserProfilePortableExport JSON bytes. The envelope schema is transport metadata only; after decryption, callers still validate the original bundle model and its bundle_schema_version.

Every marker that routes how the ciphertext is interpreted – encrypted_bundle_schema_version, payload_model, kdf and kdf_version – is required and compared for equality on the read path. The first three carry no default, and a default equal to the accepted value makes that comparison blind to the one payload it exists to catch: a stored envelope omitting the key hydrates AS the accepted value and passes a check the writer never actually made. Every field on this record is stamped explicitly by encrypt_profile_bundle_for_passphrase().

The three Argon2 cost axes and the salt length carry the same window as the composed persistence KDF policy that the writer stamps them from. They were bare integers and a bare string, which made this the one storage KDF record that could describe an arbitrarily weak derivation: eight kibibytes, one iteration, a one-byte salt. The writer never emitted such a set, so nothing this build wrote was weak – what the looseness cost was that a re-exported envelope could circulate as an application-grade encrypted bundle while being brute-forceable, and that a structurally invalid salt was indistinguishable at the boundary from a wrong passphrase, sending an operator to recover a passphrase that was never wrong.

Reading the window through the application crypto port rather than restating it is what keeps the bound this record validates against from drifting away from the parameters the writer stamps.

Parameters:

data (Any)

encrypted_bundle_schema_version: int
payload_model: str
payload_schema_version: int
kdf: str
kdf_version: int
memory_cost: int
time_cost: int
parallelism: int
salt_b64: str
ciphertext_b64: str
encrypt_profile_bundle_for_passphrase(bundle, *, passphrase)[source]

Encrypt bundle under passphrase and return a transport envelope.

Return type:

EncryptedProfileBundleExport

Parameters: