From a502845662c17a5ff01348f31396d61ce0d00065 Mon Sep 17 00:00:00 2001
From: harald <harald@pansi.eu>
Date: Sat, 19 Sep 2026 09:12:04 +0200
Subject: [PATCH] =?UTF-8?q?fix(crypto):=20M-01=20=E2=80=94=20increase=20ar?=
 =?UTF-8?q?gon2id=20default=20parameters=20to=20256=20mib=20and=204=20iter?=
 =?UTF-8?q?ations?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/crypto.rs | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/src/crypto.rs b/src/crypto.rs
index e4e06ef..1de72ed 100644
--- a/src/crypto.rs
+++ b/src/crypto.rs
@@ -22,8 +22,8 @@ pub const CHUNK_SIZE: usize = 1024 * 1024; // 1 MB
 pub const COMPRESSION_NONE: u8 = 0x00;
 pub const COMPRESSION_LZ4: u8 = 0x01;
 
-pub const DEFAULT_MEMORY_COST_KIB: u32 = 64 * 1024; // 64 MB
-pub const DEFAULT_TIME_COST: u32 = 3;
+pub const DEFAULT_MEMORY_COST_KIB: u32 = 256 * 1024; // 256 MB (262_144 KiB)
+pub const DEFAULT_TIME_COST: u32 = 4;
 pub const DEFAULT_PARALLELISM: u32 = 4;
 
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
@@ -832,6 +832,22 @@ mod tests {
         assert!(unwrap_dek(&kek, &wrapped, &nonce, &tampered_tag).is_err());
     }
 
+    #[test]
+    fn test_m01_default_kdf_params_256mib_4_iterations() {
+        let defaults = KdfParams::default();
+        assert_eq!(
+            defaults.memory_cost,
+            256 * 1024,
+            "Default memory cost must be 256 MiB (262,144 KiB)"
+        );
+        assert_eq!(defaults.time_cost, 4, "Default time cost must be 4 iterations");
+        assert_eq!(defaults.parallelism, 4, "Default parallelism must be 4 threads");
+        assert!(
+            validate_kdf_params(&defaults).is_ok(),
+            "Default KDF parameters must pass validation"
+        );
+    }
+
     #[test]
     fn test_chunk_encryption_and_swap_protection() {
         let dek = generate_dek();