derive

const (
	// MinIterations and MaxIterations bound a value that arrives from a client or a
	// stored record. Below the floor the stretch is worthless; above the ceiling one
	// login can ask for minutes of CPU.
	//
	// The two products do not agree on the ceiling, and this constant takes the looser
	// of the two. kypost-server enforces 12,000,000 and nothing tighter sits in front of
	// it (users.MaxLoginIterations, checked in login_params.go). kynotes-server's
	// derivation carries the same 12,000,000 (auth.MaxLoginIterations), and four of its
	// five routes that accept a client iteration count cap it below that: registration
	// silently clamps an out-of-range value to 600,000 rather than refusing it
	// (httpapi/auth_routes.go:80), and password change, admin user creation, and admin
	// password reset each refuse anything outside 100,000-1,000,000
	// (auth_routes.go:227, admin_routes.go:135,246). The fifth, account recovery
	// (auth_routes.go:264), checks the client's count only through
	// auth.DeriveAuthSecret's own 100,000-12,000,000 bound and stores what it is given —
	// so kynotes does admit the full 12,000,000, just not on every route.
	//
	// Which ceiling is right is unresolved, and it is a product decision rather than a
	// library one. Adopting this package as the only bound would raise those four
	// routes' ceiling 12-fold; keep their tighter checks until that call is made.
	//
	// The cross-repo line numbers above are evidence this module cannot execute — it has
	// no access to those repositories. What it can pin is its own pair of numbers, so
	// that moving either one is a deliberate diff: TestIterationBoundsAreWhatTheDocSays.
	MinIterations = 100_000
	MaxIterations = 12_000_000
)

const (
	// MaxConcurrent bounds how many stretches run at once.
	//
	// MaxIterations bounds one call, which is not admission control: a burst all asking
	// for the ceiling occupies every core for as long as it takes, and everything sharing
	// the process waits behind it. The iteration count comes from a client or a stored
	// record, so the expensive number is the caller's to choose and the concurrency is
	// ours. PBKDF2 is single-threaded, so a slot really is a core.
	//
	// This budget is separate from password's, and deliberately: this package is
	// standard-library-only, and importing password would pull x/crypto into it. The two
	// also bound different resources — slots of CPU here, bytes and lanes of memory
	// there. A product adopting both is spending MaxConcurrent cores plus
	// password.MaxMemoryKiB of memory across password.MaxLanes lanes; add them up
	// against the box before deciding either is safe.
	MaxConcurrent = 4
)

const MinSyntheticKeyBytes = 32