Module pbkdf2 

PBKDF2 (RFC 8018) passwords: the hash-independent half of the PBKDF2 surface. The password resource minted here parameterizes derivations through the per-hash prepare interfaces (pbkdf2-sha2, pbkdf2-sha1), so one imported password serves either hash family.

Security:

• No operation returns a password’s bytes, under any grant: WebCrypto’s forced non-extractability on PBKDF2 base keys, made structural.
• The implementation holds an imported password in memory for the resource’s construction-to-drop lifetime; that window is the secret’s exposure to memory side channels. Import late, drop early. Dropping releases (and, in scrubbing implementations, zeroizes) it.

Structs

Password

A password: consumable only by prepare, never readable. Usage grants are fixed at import and copied to every input prepared from it.

Functions

import_password

Import a password.

unwrap_password

Mint a password from unwrapped bytes (see the wrapping interface), subject to import-password’s contract. See hkdf.unwrap-ikm for the model — the grants come from options alone, and non-extractability stays structural. input is consumed.

Type Aliases

DeriveOptions

Error

UnwrapInput