@reallyme/crypto 0.2.0 → 0.3.1

package/dist/pbkdf2.js

@@ -6,27 +6,27 @@ import { sha256, sha512 } from "@noble/hashes/sha2.js";
 import { ReallyMeCryptoError } from "./errors.js";
 export const PBKDF2_MIN_INPUT_LENGTH = 1;
 export const PBKDF2_MAX_INPUT_LENGTH = 4096;
-// The primitive accepts any count >= 1 so it can verify PBKDF2 hashes created
-// elsewhere at their stored iteration count (a required interop use), matching
-// the Rust lane. It is NOT a security floor; see the recommended minimums
-// below for deriving *new* password keys.
-export const PBKDF2_MIN_ITERATIONS = 1;
+// Public derivation routes enforce a modern baseline. Historical hashes with a
+// lower work factor require an explicit migration tool, not a silent downgrade
+// in the v0.3 API.
+export const PBKDF2_MIN_ITERATIONS = 100_000;
+// Bound hostile work-factor inputs before the provider begins CPU-expensive
+// derivation. This matches the Rust, Swift, and Kotlin public lanes.
+export const PBKDF2_MAX_ITERATIONS = 10_000_000;
 export const PBKDF2_MIN_OUTPUT_LENGTH = 1;
 export const PBKDF2_MAX_OUTPUT_LENGTH = 4096;
 /**
  * OWASP Password Storage Cheat Sheet minimum iteration counts for deriving a
  * *new* password key.
- * The primitive does not enforce these (it must remain able to verify
- * externally created hashes), so callers creating new key material SHOULD
- * pass at least the value for their PRF.
+ * These stronger profile recommendations remain above the enforced public
+ * baseline and should be selected when protocol latency budgets permit.
  */
 export const PBKDF2_RECOMMENDED_MIN_ITERATIONS_SHA256 = 600_000;
 export const PBKDF2_RECOMMENDED_MIN_ITERATIONS_SHA512 = 220_000;
 export const ReallyMePbkdf2 = {
     /**
      * PBKDF2-HMAC-SHA-256. For a new password key pass at least
-     * {@link PBKDF2_RECOMMENDED_MIN_ITERATIONS_SHA256} iterations; lower counts
-     * are accepted only to verify hashes created elsewhere.
+     * {@link PBKDF2_RECOMMENDED_MIN_ITERATIONS_SHA256} iterations.
      */
     deriveHmacSha256(password, salt, iterations, outputLength) {
         validate(password, salt, iterations, outputLength);
@@ -34,8 +34,7 @@ export const ReallyMePbkdf2 = {
     },
     /**
      * PBKDF2-HMAC-SHA-512. For a new password key pass at least
-     * {@link PBKDF2_RECOMMENDED_MIN_ITERATIONS_SHA512} iterations; lower counts
-     * are accepted only to verify hashes created elsewhere.
+     * {@link PBKDF2_RECOMMENDED_MIN_ITERATIONS_SHA512} iterations.
      */
     deriveHmacSha512(password, salt, iterations, outputLength) {
         validate(password, salt, iterations, outputLength);
@@ -49,6 +48,7 @@ function validate(password, salt, iterations, outputLength) {
         salt.length > PBKDF2_MAX_INPUT_LENGTH ||
         !Number.isInteger(iterations) ||
         iterations < PBKDF2_MIN_ITERATIONS ||
+        iterations > PBKDF2_MAX_ITERATIONS ||
         !Number.isInteger(outputLength) ||
         outputLength < PBKDF2_MIN_OUTPUT_LENGTH ||
         outputLength > PBKDF2_MAX_OUTPUT_LENGTH) {