v0.2.5-pre.004

crates/ksp-wallet-lib/src/wire.rs

@@ -1,5 +1,5 @@
 // file: crates/ksp-wallet-lib/src/wire.rs
-// version: 1
+// version: 3
 
 //! Strict native `.kspwallet` V1 wire envelope.
 
@@ -893,6 +893,12 @@ fn parse_kdf(raw: RawKdfV1) -> ksp_core_lib::Result<WalletKdfParametersV1> {
     if raw.parallelism == 0 || raw.parallelism > crate::KSPWALLET_V1_MAX_ARGON2_PARALLELISM {
         return std::result::Result::Err(crypto_parameter_error("Wallet Argon2 parallelism is outside the V1 structural range", "key_slots.kdf.parallelism"));
     }
+    if raw.memory_kib < raw.parallelism * 8 {
+        return std::result::Result::Err(crypto_parameter_error(
+            "Wallet Argon2 memory_kib must provide at least eight 1-KiB blocks per lane",
+            "key_slots.kdf.memory_kib",
+        ));
+    }
     let salt = match decode_base64url(raw.salt.as_str(), "key_slots.kdf.salt") {
         std::result::Result::Ok(salt) => salt,
         std::result::Result::Err(error) => return std::result::Result::Err(error),