LockerKeyBackup locker.key-backup@1

Generated at from openvibe-contracts v0.419.0 and openvibe-sdk v0.161.0.

Version
1.0.0
Owner
network
Visibility
public
Status
active
Compatibility
backward
Schema
https://openvibe.network/contracts/locker/key-backup.v1.json

locker.key-backup@1: the person's private keys, wrapped. The wrapping key comes from the locker passphrase with PBKDF2-SHA-256, so the server stores bytes it cannot open; a passkey (WebAuthn PRF) may wrap the same bytes later without changing this shape.

Fields

FieldTypeRequiredDescriptionConstraints
methodenumyesHow the private keys are wrapped. A passkey-only locker comes later.
  • one of "passphrase"
kdfconstyes
  • = "PBKDF2-SHA-256"
iterationsintegeryes
  • minimum 600000
  • maximum 10000000
saltstringyesSixteen random bytes, base64.
  • pattern ^[A-Za-z0-9+/]{22}==$
noncestringyesTwelve random bytes, base64: the AES-GCM nonce of the wrapped keys.
  • pattern ^[A-Za-z0-9+/]{16}$
wrapped_keysstringyesThe two private keys as JWKs, sealed with AES-256-GCM under the derived key, base64.
  • pattern ^[A-Za-z0-9+/]+={0,2}$

Examples

From the contract's own test fixtures: valid ones validate, rejected ones must fail.

Valid: example
{
  "method": "passphrase",
  "kdf": "PBKDF2-SHA-256",
  "iterations": 600000,
  "salt": "c3Nzc3Nzc3Nzc3Nzc3Nzcw==",
  "nonce": "bm5ubm5ubm5ubm5u",
  "wrapped_keys": "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"
}
Rejected: weak-iterations
{
  "method": "passphrase",
  "kdf": "PBKDF2-SHA-256",
  "iterations": 10000,
  "salt": "c3Nzc3Nzc3Nzc3Nzc3Nzcw==",
  "nonce": "bm5ubm5ubm5ubm5u",
  "wrapped_keys": "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"
}

Validate

const contracts = require('openvibe-contracts');
contracts.validate('locker.key-backup@1', value);   // { valid, errors: [{ path, message }] }