Total decoded length: 100 bytes longer than your PEM-encoded RSA private key.
A typical RSA private key, when PEM-encoded, is about 1674 bytes long.
Therefore, you can estimate the data payload for a k1.secret-pw PASERK to be
1774 bytes. There MAY be variability, so parsers should permit some flex.
The iteration count (i) MUST be encoded as a 32-bit unsigned
integer in big-endian byte order.
The Argon2id parameters (mem, time, para) MUST be encoded as
unsigned integers in big-endian byte order. mem is 64-bit; the
other parameters are 32-bit.
PASERK Type: secret-pw
This PASERK is a secret key intended for
public
PASETOs, encrypted with a password.Format
Where
[data]
is the base64url-encoded payload, defined by each version.ID Serialization
See sid.
Operations
See PBKW for the algorithm used.
PASERK Versions
Version 1
See V1/V3 Encryption in the PBKW document for how these values are derived.
salt
)i
)n
)edk
)t
)Total decoded length: 100 bytes longer than your PEM-encoded RSA private key.
A typical RSA private key, when PEM-encoded, is about 1674 bytes long. Therefore, you can estimate the data payload for a
k1.secret-pw
PASERK to be1774
bytes. There MAY be variability, so parsers should permit some flex.The iteration count (
i
) MUST be encoded as a 32-bit unsigned integer in big-endian byte order.Versions 2 and 4
See V2/V4 Encryption in the PBKW document for how these values are derived.
salt
)mem
)time
)para
)n
)esk
)t
)Total decoded length:
152 bytes
The Argon2id parameters (
mem
,time
,para
) MUST be encoded as unsigned integers in big-endian byte order.mem
is 64-bit; the other parameters are 32-bit.Version 3
See V1/V3 Encryption in the PBKW document for how these values are derived.
salt
)i
)n
)esk
)t
)Total decoded length:
148 bytes
The iteration count (
i
) MUST be encoded as a 32-bit unsigned integer in big-endian byte order.Examples