ak.profile.key_backup.memory_hard.v1
ak.profile.key_backup.memory_hard.v1
description
"Hardening profile for passphrase-protected key backups. Requires memory-hard Argon2id defaults, explicit PBKDF2 downgrade, domain-separated backup classes, deterministic AEAD nonce recomputation, series-chain freshness (series_id / series_seq / supersedes / supersedes_digest), and server-side rate limiting / fresh device proof on backup access."enforcement_phases
[
"build",
"conformance"
]operation_requirements
[
{
"direction": "provide",
"operation_id": "ak.self.keys.backups.resource.replace.v1",
"binding_kind": "http_json"
},
{
"direction": "provide",
"operation_id": "ak.self.keys.backups.read.list.v1",
"binding_kind": "http_json"
},
{
"direction": "provide",
"operation_id": "ak.self.keys.backups.command.unlock.v1",
"binding_kind": "http_json"
},
{
"direction": "provide",
"operation_id": "ak.self.keys.backups.resource.delete.v1",
"binding_kind": "http_json"
}
]inherits
[]required_event_kinds
[]rejected_event_kinds
[]required_schemas
[
"ak.schema.key_backup.v1",
"ak.schema.recovery_policy.v1",
"ak.schema.recovery_session.v1",
"ak.schema.recovery_receipt.v1"
]required_fixtures
[
"privacy-security-fixture.json",
"key-backup-fixture.json"
]optional_extensions
[]feature_discovery
{
"required": [
"key_backup_argon2id_floor",
"key_backup_domain_separation",
"passphrase_kdf_nonce_recompute",
"mixed_secret_storage_policy",
"key_backup_series_chain_verification",
"key_backup_freshness_commit",
"key_backup_recipient_method_profiles",
"key_backup_server_rate_limit",
"recovery_policy_binding",
"recovery_session_lifecycle",
"recovery_receipt_emission"
],
"unsupported_optional": "omit profile claim or reject weak passphrase_kdf backups"
}