{
    "$schema": "http://json-schema.org/draft-07/schema",
    "$id": "https://mfkdf.com/schema/v1.0.0/policy.json",
    "type": "object",
    "title": "Multi-Factor Derived Key Policy Schema",
    "description": "A multi-factor derived key policy defines the factors and methods used to derive a key via multi-factor key derivation.",
    "required": [
        "threshold",
        "salt",
        "size",
        "kdf",
        "factors",
        "$id",
        "$schema"
    ],
    "properties": {
        "$schema": {
            "type": "string",
            "title": "Key Schema",
            "description": "Link to the version of the schema that can validate the key policy."
        },
        "$id": {
            "type": "string",
            "title": "Key ID",
            "description": "String which uniquely identifies this key."
        },
        "threshold": {
            "type": "integer",
            "title": "Factor Threshold",
            "description": "The number of correct factors needed to derive this key."
        },
        "size": {
            "type": "integer",
            "title": "Key Size",
            "description": "Size of key to derive (in bytes)."
        },
        "kdf": {
            "type": "object",
            "title": "Key Derivation Function",
            "description": "Underlying KDF to use for key derivation.",
            "required": [
                "type",
                "params"
            ],
            "properties": {
                "type": {
                    "type": "string",
                    "title": "KDF Type",
                    "description": "Name of the key derivation function to use."
                },
                "params": {
                    "type": "object",
                    "title": "KDF Parameters",
                    "description": "Parameters required by chosen key derivation function.",
                    "required": []
                }
            }
        },
        "salt": {
            "type": "string",
            "title": "KDF Salt",
            "description": "Base-64 encoded salt value used as additional input to the KDF."
        },
        "factors": {
            "type": "array",
            "title": "Factors",
            "description": "Factors which can be used to derive this key.",
            "items": {
                "type": "object",
                "title": "Factor",
                "description": "Factor which can be used to derive this key.",
                "required": [
                    "id",
                    "type",
                    "pad",
                    "params"
                ],
                "properties": {
                    "id": {
                        "type": "string",
                        "title": "Factor ID",
                        "description": "String which uniquely identifies this factor."
                    },
                    "type": {
                        "type": "string",
                        "title": "Factor Type",
                        "description": "Name of the factor material function to use."
                    },
                    "pad": {
                        "type": "string",
                        "title": "Factor Pad",
                        "description": "Base-64 encoded intermediate value to combine with factor material."
                    },
                    "params": {
                        "type": "object",
                        "title": "Factor Parameters",
                        "description": "Parameters required by chosen factor material function.",
                        "required": []
                    }
                }
            }
        },
        "secrets": {
            "type": "array",
            "title": "Secrets",
            "description": "Enveloped secrets encrypted with this key.",
            "items": {
                "type": "object",
                "title": "Factor",
                "description": "Enveloped secret encrypted with this key.",
                "required": [
                    "id",
                    "type",
                    "value"
                ],
                "properties": {
                    "id": {
                        "type": "string",
                        "title": "Secret ID",
                        "description": "String which uniquely identifies this enveloped secret."
                    },
                    "type": {
                        "type": "string",
                        "title": "Secret Type",
                        "description": "Type of enveloped secret."
                    },
                    "value": {
                        "type": "string",
                        "title": "Secret Value",
                        "description": "Base-64 encoded ciphertext value encrypted with this key."
                    }
                }
            }
        }
    }
}