IKDFOptions Interface
Configuration options for Key Derivation Functions (PBKDF2 and HKDF) across Katlux encryption providers and CKeyManager.
🧰 CKeyManager · 🔒 CWebCryptoEncryptionProvider · 📋 IProviderEncryptionOptions
export interface IKDFOptions {
kdf: 'pbkdf2' | 'hkdf'
salt?: Uint8Array | string
iterations?: number
hash?: 'SHA-256' | 'SHA-512'
info?: string
keyLength?: 128 | 256
extractable?: boolean
}
import type { IKDFOptions } from '@katlux/providers'
import { CKeyManager } from '@katlux/providers'
// 1. PBKDF2 for human passphrases (Slow, memory-hardened against brute force)
const pbkdf2Config: IKDFOptions = {
kdf: 'pbkdf2',
iterations: 310_000, // OWASP 2024 recommended minimum
hash: 'SHA-256',
keyLength: 256
}
const pbkdf2Key = await CKeyManager.deriveKey('my-human-password', pbkdf2Config)
// 2. HKDF for machine/database keys (Fast, high-entropy key expansion)
const hkdfConfig: IKDFOptions = {
kdf: 'hkdf',
hash: 'SHA-256',
info: 'katlux-tenant-ledger-key',
keyLength: 256
}
const hkdfKey = await CKeyManager.deriveKey('high-entropy-db-uuid', hkdfConfig)
| Property | Type | Default | Description |
|---|
| kdf | 'pbkdf2' | 'hkdf' | Required | Derivation strategy. Use pbkdf2 for human passwords; hkdf for machine/database secrets. |
| salt | Uint8Array | string | Random 16 bytes | Cryptographic salt. If omitted during encryption, a secure random salt is generated and included in the envelope. |
| iterations | number | 310,000 | Number of hash rounds (PBKDF2 only). Aligns with OWASP guidelines. |
| hash | 'SHA-256' | 'SHA-512' | 'SHA-256' | Underlying cryptographic hash algorithm. |
| info | string | 'katlux-derived-aes-key' | Application-specific context info label (HKDF only). |
| keyLength | 128 | 256 | 256 | Length of the derived symmetric AES key in bits. |
| extractable | boolean | true | Whether the resulting CryptoKey can be exported or wrapped with another key. |