diff --git a/docs/Engineering_Reference_Manual.md b/docs/Engineering_Reference_Manual.md index cb99c593..66773ddf 100644 --- a/docs/Engineering_Reference_Manual.md +++ b/docs/Engineering_Reference_Manual.md @@ -396,9 +396,9 @@ The couple keyset is a Tink AES-256-GCM keyset generated once per couple. - `RecoveryKeyManager.newCoupleKeyset()` creates the keyset. - `RecoveryKeyManager.wrap(keyset, phrase)` derives a 32-byte key with Argon2id: - - **memory**: 46 MiB (`46080` KiB) - - **iterations**: 3 - - **parallelism**: 1 + - **memory**: 46 MiB (`46 * 1024 = 47104` KiB; constant `ARGON2_MEMORY_KB`) + - **iterations**: 3 (`ARGON2_ITERATIONS`) + - **parallelism**: 1 (`ARGON2_PARALLELISM`) - **salt**: 16 random bytes - The keyset plaintext is encrypted with AES-256-GCM using the derived key. AAD is the fixed string `"closer_couple_key"` so the blob is portable across invite-code reconciliation. - The wrapped result is stored on the couple document as `wrappedCoupleKey`, `kdfSalt`, `kdfParams`.