LockerPasswordSlot locker.password-slot@1

Generated at from openvibe-contracts v0.419.0 and openvibe-sdk v0.161.0.

Version
1.0.0
Owner
network
Visibility
public
Status
active
Compatibility
backward
Schema
https://openvibe.network/contracts/locker/password-slot.v1.json

locker.password-slot@1: the content key wrapped with a password. The wrapping key comes from PBKDF2-SHA-256 with the salt and the iteration count in this slot, so both can be raised later without changing the format. The tag covers the parameters, so they cannot be weakened in transit.

Fields

FieldTypeRequiredDescriptionConstraints
algorithmconstyes
  • = "PBKDF2-SHA256/AES-256-GCM"
kdfconstyes
  • = "PBKDF2-SHA-256"
iterationsintegeryesPBKDF2 iterations. 600000 is the floor for this version; the count may go up, never down.
  • minimum 600000
  • maximum 10000000
saltstringyesSixteen random bytes, base64: the PBKDF2 salt.
  • pattern ^[A-Za-z0-9+/]{22}==$
noncestringyesTwelve random bytes, base64: the AES-GCM nonce of the wrapped content key.
  • pattern ^[A-Za-z0-9+/]{16}$
wrapped_keystringyesThe 32-byte content key and its 16-byte tag, base64. Never the key itself.
  • pattern ^[A-Za-z0-9+/]{64}$

Examples

From the contract's own test fixtures: valid ones validate, rejected ones must fail.

Valid: example
{
  "algorithm": "PBKDF2-SHA256/AES-256-GCM",
  "kdf": "PBKDF2-SHA-256",
  "iterations": 600000,
  "salt": "c3Nzc3Nzc3Nzc3Nzc3Nzcw==",
  "nonce": "bm5ubm5ubm5ubm5u",
  "wrapped_key": "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"
}
Rejected: weak-iterations
{
  "algorithm": "PBKDF2-SHA256/AES-256-GCM",
  "kdf": "PBKDF2-SHA-256",
  "iterations": 1000,
  "salt": "c3Nzc3Nzc3Nzc3Nzc3Nzcw==",
  "nonce": "bm5ubm5ubm5ubm5u",
  "wrapped_key": "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"
}

Validate

const contracts = require('openvibe-contracts');
contracts.validate('locker.password-slot@1', value);   // { valid, errors: [{ path, message }] }