Module encryption 

Symmetric encryption utilities.

Constants

ARGON2_TAG

Tag byte for Argon2id-derived encryption blobs.

NONCE_LEN

Byte size of the nonce used in both AES-GCM and ChaCha20Poly1305.

PASSPHRASE_POLICY_HINT

Human-readable statement of the passphrase policy validate_passphrase enforces. Shown before an interactive prompt so the rule is known up front, not learned by violating it. Single source of truth: the prompt hint and the validator read the same policy from here.

PRODUCTION_KDF_M_COST_KIB

Production Argon2id memory cost in KiB (64 MiB). Exposed as a const so the strength of the at-rest KDF can be asserted regardless of build profile (test builds derive keys with deliberately weak params for speed).

PRODUCTION_KDF_P_COST

Production Argon2id parallelism.

PRODUCTION_KDF_T_COST

Production Argon2id time cost (iterations).

SALT_LEN

Byte size of the salt used in key derivation.

SYMMETRIC_KEY_LEN

Length in bytes of a symmetric encryption key (256-bit).

TAG_LEN

Byte size of the algorithm tag prefix.

Functions

decrypt_bytes

Decrypts data using a tagged encryption format and a user-provided passphrase.

encrypt_bytes

Encrypt data using Argon2id for key derivation, prepending tag 0x03.

get_kdf_params

Returns Argon2id parameters for key derivation.

validate_passphrase

Validates that a passphrase meets minimum strength requirements.