Documentation
¶
Overview ¶
Package kdf holds the Argon2id settings that turn a password into a key: the vault's master password and an encrypted export's password.
Index ¶
Constants ¶
const ( DefaultMemoryKiB = 256 * 1024 DefaultTime = 3 DefaultThreads = 4 KeyLen = 32 )
The settings sesh uses unless configured otherwise: 256 MiB, 3 passes, 4 threads, a 32-byte (AES-256) key.
const ( MaxMemoryKiB = 1 << 20 // 1 GiB MaxTime = 10 MaxThreads = 16 )
The most an unlock or an import accepts, so a damaged or hostile record can't make sesh use unbounded memory or time; configured settings can't go above them either, so whatever sesh makes it can open.
const ( MinMemoryKiB = 19 * 1024 MinTime = 2 MinThreads = 1 )
The least that can be configured: OWASP's minimum for Argon2id (19 MiB, 2 passes, 1 thread). Lower would make guessing passwords cheap.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Params ¶
type Params struct {
Time uint32 `json:"time"` // passes over the memory
Memory uint32 `json:"memory"` // KiB
Threads uint8 `json:"threads"` // lanes computed in parallel
KeyLen uint32 `json:"key_len"` // derived key length in bytes
}
Params are Argon2id's settings. They're stored with what they protect (the vault's key record, an export's envelope), so changing the configured ones never stops anything already made from opening.
func Default ¶
func Default() Params
Default returns the settings sesh uses unless configured otherwise.
func (Params) CheckBounds ¶
CheckBounds refuses settings read from a vault or an export that are zero or above the maximums, or a key length other than KeyLen.
func (Params) MarshalParams ¶
MarshalParams serialises the settings to JSON. The fields are all fixed-width integers, so json.Marshal can't fail; a failure here is a programming bug.
Source Files