feat(opaque): lower KSF values to support old clients (memory intensive)

example.env

@@ -216,9 +216,9 @@ DATABASE_URL=postgres://postgres:postgres@localhost:5432/oxicloud
 #
 # Generate on first-time enable:
 #   # Docker (recommended for production):
-#   docker run --rm ghcr.io/atalayalabs/oxicloud:latest opaque-setup
+#   docker run --rm ghcr.io/atalayalabs/oxicloud:latest oxicloud-cli opaque setup
 #   # Or from a source checkout:
-#   cargo run --bin opaque-setup
+#   cargo run --bin oxicloud-cli -- opaque setup
 # Both print the base64 value on stdout (guidance on stderr, so shell
 # pipelines capture cleanly). Paste the printed line into your env or
 # secrets manager. NEVER regenerate — treat it like your JWT secret;
@@ -226,21 +226,29 @@ DATABASE_URL=postgres://postgres:postgres@localhost:5432/oxicloud
 #OXICLOUD_AUTH_OPAQUE_SERVER_SETUP=
 
 # Client-side Argon2id key-stretching parameters (RFC 9807 KSF).
-# These run on the USER'S DEVICE during OPAQUE login/registration —
-# distinct from OXICLOUD_HASH_* which runs on the server for the legacy
-# password path. Client-side execution means we can afford higher memory
-# than the server would (each user pays once for themselves rather than
-# the server paying for every concurrent login).
+# These run on the USER'S DEVICE during OPAQUE login/registration,
+# TWICE per login (once each in OPAQUE's `start` and `finish` steps),
+# on the main thread inside a synchronous WASM call. Interactive
+# login latency is roughly `2 × Argon2(memory, iterations)`.
 #
-# Bumping these does NOT affect existing envelopes; they'd re-mint on
-# the user's next password change.
+# Defaults match OWASP's Argon2id-for-interactive-auth guidance
+# (46 MiB / 1 iter / 1 lane) — chosen for compatibility with older
+# and lower-end devices where a heavier memory budget either takes
+# tens of seconds OR fails to allocate WASM heap outright. See
+# `docs/config/authentication.md § OPAQUE — KSF parameters` for the
+# full rationale and per-device latency table.
 #
-# Memory cost in KiB (default: 262144 = 256 MiB)
-#OXICLOUD_AUTH_OPAQUE_KSF_MEMORY_KIB=262144
-# Iterations (default: 3)
-#OXICLOUD_AUTH_OPAQUE_KSF_ITERATIONS=3
-# Parallelism lanes (default: 4)
-#OXICLOUD_AUTH_OPAQUE_KSF_PARALLELISM=4
+# Changing these does NOT invalidate existing envelopes — the KSF
+# params are baked in per-envelope at register time; silent-migration
+# re-mints under new params on the user's next password change.
+#
+# Memory cost in KiB (default: 47104 = 46 MiB, OWASP interactive)
+#OXICLOUD_AUTH_OPAQUE_KSF_MEMORY_KIB=47104
+# Iterations (default: 1, OWASP interactive)
+#OXICLOUD_AUTH_OPAQUE_KSF_ITERATIONS=1
+# Parallelism lanes (default: 1 — OWASP recommendation; higher only
+# helps on multi-core devices and hurts single-core / older mobile)
+#OXICLOUD_AUTH_OPAQUE_KSF_PARALLELISM=1
 
 # -----------------------------------------------------------------------------
 # RATE LIMITING & ACCOUNT LOCKOUT