---
title: "locker.key-backup@1 · OpenVibe.Services"
canonical: "https://openvibe.services/docs/contracts/locker.key-backup"
updated: null
---

# locker.key-backup@1 · OpenVibe.Services

HTML: [locker.key-backup@1 · OpenVibe.Services](https://openvibe.services/docs/contracts/locker.key-backup)

# LockerKeyBackup `locker.key-backup@1`

Generated at 2026-11-13 06:25:48 UTC from [`openvibe-contracts v0.419.0`](https://github.com/OpenVibers/OpenVibe.Contracts/tree/v0.419.0) and [`openvibe-sdk v0.161.0`](https://github.com/OpenVibers/OpenVibe.SDK/tree/v0.161.0).

- Version: 1.0.0
- Owner: network
- Visibility: public
- Status: active
- Compatibility: backward
- Schema: [`https://openvibe.network/contracts/locker/key-backup.v1.json`](/docs/contracts/locker.key-backup.json)

locker.key-backup@1: the person's private keys, wrapped. The wrapping key comes from the locker passphrase with PBKDF2-SHA-256, so the server stores bytes it cannot open; a passkey (WebAuthn PRF) may wrap the same bytes later without changing this shape.

## Fields

| Field | Type | Required | Description | Constraints |
| --- | --- | --- | --- | --- |
| `method` | enum | yes | How the private keys are wrapped. A passkey-only locker comes later. | - `one of "passphrase"` |
| `kdf` | const | yes |  | - `= "PBKDF2-SHA-256"` |
| `iterations` | integer | yes |  | - `minimum 600000`<br>- `maximum 10000000` |
| `salt` | string | yes | Sixteen random bytes, base64. | - `pattern ^[A-Za-z0-9+/]{22}==$` |
| `nonce` | string | yes | Twelve random bytes, base64: the AES-GCM nonce of the wrapped keys. | - `pattern ^[A-Za-z0-9+/]{16}$` |
| `wrapped_keys` | string | yes | The two private keys as JWKs, sealed with AES-256-GCM under the derived key, base64. | - `pattern ^[A-Za-z0-9+/]+={0,2}$` |

## Examples

From the contract's own test fixtures: valid ones validate, rejected ones must fail.

 Valid: example

~~~~
{
  "method": "passphrase",
  "kdf": "PBKDF2-SHA-256",
  "iterations": 600000,
  "salt": "c3Nzc3Nzc3Nzc3Nzc3Nzcw==",
  "nonce": "bm5ubm5ubm5ubm5u",
  "wrapped_keys": "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"
}
~~~~

Rejected: weak-iterations

~~~~
{
  "method": "passphrase",
  "kdf": "PBKDF2-SHA-256",
  "iterations": 10000,
  "salt": "c3Nzc3Nzc3Nzc3Nzc3Nzcw==",
  "nonce": "bm5ubm5ubm5ubm5u",
  "wrapped_keys": "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"
}
~~~~

## Validate

~~~~
const contracts = require('openvibe-contracts');
contracts.validate('locker.key-backup@1', value);   // { valid, errors: [{ path, message }] }
~~~~