Expand description
Argon2id password-based key derivation.
This is the only place where a user-supplied password enters the system. The
password is stretched into a 32-byte MasterKey whose cost parameters are
compiled in rather than configurable: a weakened parameter set is
indistinguishable from a correct one at the API surface, so exposing it
would turn a silent misconfiguration into a silent loss of security.
The salt is not random. It is the perceptual hash of the container image, so the same password applied to the same image always yields the same master key — which is what lets extraction work without storing any key material alongside the payload.
Structs§
- Argon2
Kdf - The production key deriver: Argon2id with compiled-in cost parameters.
- Master
Key - A 32-byte key derived from the password and the container’s perceptual hash.
Enums§
- KdfError
- Every way password stretching can fail.
Traits§
- KeyDeriver
- Stretching of a password into a master key.