Back to Learn

Security and technical design

Technical notes for Kardix KDX2, including derivation parameters, local processing, and limitations.

Kardix · KDX2 · Updated June 10, 2026

KDX2 derivation

KDX2 normalizes passphrase and PIN with NFKC. Argon2id uses 64 MiB memory, three passes, parallelism one, and a 64-byte output.

Domain separation

The Argon2id result is expanded through HMAC-SHA-512 with separate labels for username and password.

Output construction

The username contains a 120-bit identifier. The password is 24 characters with uppercase, lowercase, digits, and symbols. Rejection sampling avoids simple modulo bias.

Local processing

The Argon2 library is bundled locally. Secret inputs and outputs are not intentionally sent to Maotaw.

Threat model

Kardix cannot protect a compromised device, malicious extension, keylogger, screen recorder, phishing site, or weak passphrase.

Compatibility warning

Never silently replace KDX2 with another algorithm. A fallback would generate different credentials.

Continue learning

GuideSecurityAboutContactPrivacyTerms