KsfParams
in package
The key-stretching function and cost a `/start` response names (CONTRACT.md §23.4).
The cost properties are nullable on purpose: they arrive flat, and a field that does not apply
to the named function is absent, not zero. Reading a missing memoryKib as 0 would
stretch at the wrong cost and fail against a record that is perfectly good (§23.4 rule 5).
These are never cached across exchanges and never defaulted locally. A credential enrolled under one cost keeps working after a tenant raises its policy, so a client that guessed would derive a different randomized password and report "invalid password" for one that is entirely correct (§23.4 rule 2).
This is where PHP stopped being doubly conditional. The SRP client it replaces needed a
bignum extension and a tenant on pbkdf2_sha256, because no PHP runtime offers Argon2id with
a caller-supplied salt. The key stretching now happens inside libaxiam_opaque_ffi, so an
argon2id tenant is no longer a PHP-shaped hole.
Table of Contents
Constants
- ARGON2ID : mixed = 'argon2id'
- The wire name of the memory-hard function AXIAM asks for by default.
- SCRYPT : mixed = 'scrypt'
- The wire name of the alternative AXIAM accepts.
Properties
- $iterations : int|null
- Argon2id's time cost.
- $ksf : string
- The wire name of the function: `argon2id` or `scrypt`.
- $logN : int|null
- scrypt's base-2 CPU/memory cost.
- $memoryKib : int|null
- Argon2id's memory cost in KiB.
- $p : int|null
- scrypt's parallelisation parameter.
- $parallelism : int|null
- Argon2id's lane count.
- $r : int|null
- scrypt's block size.
Methods
- __construct() : mixed
- Every field exactly as the server named it — no local defaults, no coercion of an absent cost to zero.
- build() : mixed
- Builds the library's key-stretching handle from what the *server* named.
- fromWire() : self
- Reads the flat key-stretching fields of a `/start` response, preserving absence.
Constants
ARGON2ID
The wire name of the memory-hard function AXIAM asks for by default.
public
mixed
ARGON2ID
= 'argon2id'
SCRYPT
The wire name of the alternative AXIAM accepts.
public
mixed
SCRYPT
= 'scrypt'
Properties
$iterations read-only
Argon2id's time cost.
public
int|null
$iterations
= null
$ksf read-only
The wire name of the function: `argon2id` or `scrypt`.
public
string
$ksf
$logN read-only
scrypt's base-2 CPU/memory cost.
public
int|null
$logN
= null
$memoryKib read-only
Argon2id's memory cost in KiB.
public
int|null
$memoryKib
= null
$p read-only
scrypt's parallelisation parameter.
public
int|null
$p
= null
$parallelism read-only
Argon2id's lane count.
public
int|null
$parallelism
= null
$r read-only
scrypt's block size.
public
int|null
$r
= null
Methods
__construct()
Every field exactly as the server named it — no local defaults, no coercion of an absent cost to zero.
public
__construct(string $ksf[, int|null $memoryKib = null ][, int|null $iterations = null ][, int|null $parallelism = null ][, int|null $logN = null ][, int|null $r = null ][, int|null $p = null ]) : mixed
Parameters
- $ksf : string
- $memoryKib : int|null = null
- $iterations : int|null = null
- $parallelism : int|null = null
- $logN : int|null = null
- $r : int|null = null
- $p : int|null = null
build()
Builds the library's key-stretching handle from what the *server* named.
public
build(OpaqueNativeInterface $lib) : mixed
An unrecognised function is refused, never substituted: substituting produces a well-formed
randomized password no AXIAM server agrees with, which surfaces to the user as a wrong
password (§23.4 rule 3). The returned handle must be released with ksfFree.
Parameters
- $lib : OpaqueNativeInterface
Tags
fromWire()
Reads the flat key-stretching fields of a `/start` response, preserving absence.
public
static fromWire(array<string, mixed> $wire) : self
Parameters
- $wire : array<string, mixed>
-
the decoded response body