Module kdf 

HKDF-SHA256, PBES2 (PBKDF2-HS256), and master-key derivation.

Constants

MIN_PBKDF2_ITERATIONS 🔒

The floor the web client enforces inside its PBKDF2 primitive, so a server cannot talk us into deriving a weaker key than the client would.

Functions

derive_master_key 🔒

Derives the 32-byte master unlock key (kid "mp"), dispatching on the algorithm prefix the way the web client’s Auk.deriveKdfBytes does.

hkdf_sha256 🔒

HKDF-SHA256 producing 32 bytes, with method as the info parameter.

legacy_password 🔒

The legacy PBES2- stand-in for the password, hashed raw and never normalized.

normalize_identity_username 🔒

The only place the email is decomposed, not just trimmed and lowercased.

normalize_password 🔒

normalize_username 🔒

pbes2 🔒

PBKDF2-HMAC-SHA256 producing 32 bytes. Callers check the method first.

validate_pbes2 🔒

Rejects a PBES2 method this module cannot honour.