[PS-2267] Add KdfMemory and KDFParallelism fields (#2583)

* Add KdfMemory and KDFParallelism fields

* Revise argon2 support

This pull request makes the new attribues for argon2, kdfMemory and
kdfParallelism optional. Furthermore it adds checks for the argon2
parametrs and improves the database migration script.

* Add validation for argon2 in RegisterRequestModel

* update validation messages

* update sql scripts

* register data protection with migration factories

* add ef migrations

* update kdf option validation

* adjust validation

* Centralize and Test KDF Validation

Co-authored-by: Kyle Spearrin <kspearrin@users.noreply.github.com>
Co-authored-by: Kyle Spearrin <kyle.spearrin@gmail.com>
Co-authored-by: Justin Baur <19896123+justindbaur@users.noreply.github.com>

src/Api/Controllers/AccountsController.cs

@@ -330,7 +330,7 @@ public class AccountsController : Controller
         }
 
         var result = await _userService.ChangeKdfAsync(user, model.MasterPasswordHash,
-            model.NewMasterPasswordHash, model.Key, model.Kdf.Value, model.KdfIterations.Value);
+            model.NewMasterPasswordHash, model.Key, model.Kdf.Value, model.KdfIterations.Value, model.KdfMemory, model.KdfParallelism);
         if (result.Succeeded)
         {
             return;

src/Api/Models/Request/Accounts/KdfRequestModel.cs

@@ -1,5 +1,6 @@
 using System.ComponentModel.DataAnnotations;
 using Bit.Core.Enums;
+using Bit.Core.Utilities;
 
 namespace Bit.Api.Models.Request.Accounts;
 
@@ -9,22 +10,16 @@ public class KdfRequestModel : PasswordRequestModel, IValidatableObject
     public KdfType? Kdf { get; set; }
     [Required]
     public int? KdfIterations { get; set; }
+    public int? KdfMemory { get; set; }
+    public int? KdfParallelism { get; set; }
 
     public override IEnumerable<ValidationResult> Validate(ValidationContext validationContext)
     {
         if (Kdf.HasValue && KdfIterations.HasValue)
         {
-            switch (Kdf.Value)
+            return KdfSettingsValidator.Validate(Kdf.Value, KdfIterations.Value, KdfMemory, KdfParallelism);
-            {
-                case KdfType.PBKDF2_SHA256:
-                    if (KdfIterations.Value < 5000 || KdfIterations.Value > 2_000_000)
-                    {
-                        yield return new ValidationResult("KDF iterations must be between 5000 and 2000000.");
-                    }
-                    break;
-                default:
-                    break;
-            }
         }
+
+        return Enumerable.Empty<ValidationResult>();
     }
 }

src/Api/Models/Request/Accounts/SetKeyConnectorKeyRequestModel.cs

@@ -2,10 +2,11 @@
 using Bit.Core.Entities;
 using Bit.Core.Enums;
 using Bit.Core.Models.Api.Request.Accounts;
+using Bit.Core.Utilities;
 
 namespace Bit.Api.Models.Request.Accounts;
 
-public class SetKeyConnectorKeyRequestModel
+public class SetKeyConnectorKeyRequestModel : IValidatableObject
 {
     [Required]
     public string Key { get; set; }
@@ -15,6 +16,8 @@ public class SetKeyConnectorKeyRequestModel
     public KdfType Kdf { get; set; }
     [Required]
     public int KdfIterations { get; set; }
+    public int? KdfMemory { get; set; }
+    public int? KdfParallelism { get; set; }
     [Required]
     public string OrgIdentifier { get; set; }
 
@@ -22,8 +25,15 @@ public class SetKeyConnectorKeyRequestModel
     {
         existingUser.Kdf = Kdf;
         existingUser.KdfIterations = KdfIterations;
+        existingUser.KdfMemory = KdfMemory;
+        existingUser.KdfParallelism = KdfParallelism;
         existingUser.Key = Key;
         Keys.ToUser(existingUser);
         return existingUser;
     }
+
+    public IEnumerable<ValidationResult> Validate(ValidationContext validationContext)
+    {
+        return KdfSettingsValidator.Validate(Kdf, KdfIterations, KdfMemory, KdfParallelism);
+    }
 }

src/Api/Models/Request/Accounts/SetPasswordRequestModel.cs

@@ -2,10 +2,11 @@
 using Bit.Core.Entities;
 using Bit.Core.Enums;
 using Bit.Core.Models.Api.Request.Accounts;
+using Bit.Core.Utilities;
 
 namespace Bit.Api.Models.Request.Accounts;
 
-public class SetPasswordRequestModel
+public class SetPasswordRequestModel : IValidatableObject
 {
     [Required]
     [StringLength(300)]
@@ -20,6 +21,8 @@ public class SetPasswordRequestModel
     public KdfType Kdf { get; set; }
     [Required]
     public int KdfIterations { get; set; }
+    public int? KdfMemory { get; set; }
+    public int? KdfParallelism { get; set; }
     public string OrgIdentifier { get; set; }
 
     public User ToUser(User existingUser)
@@ -27,8 +30,15 @@ public class SetPasswordRequestModel
         existingUser.MasterPasswordHint = MasterPasswordHint;
         existingUser.Kdf = Kdf;
         existingUser.KdfIterations = KdfIterations;
+        existingUser.KdfMemory = KdfMemory;
+        existingUser.KdfParallelism = KdfParallelism;
         existingUser.Key = Key;
         Keys.ToUser(existingUser);
         return existingUser;
     }
+
+    public IEnumerable<ValidationResult> Validate(ValidationContext validationContext)
+    {
+        return KdfSettingsValidator.Validate(Kdf, KdfIterations, KdfMemory, KdfParallelism);
+    }
 }

src/Api/Models/Response/EmergencyAccessResponseModel.cs

@@ -97,9 +97,13 @@ public class EmergencyAccessTakeoverResponseModel : ResponseModel
         KeyEncrypted = emergencyAccess.KeyEncrypted;
         Kdf = grantor.Kdf;
         KdfIterations = grantor.KdfIterations;
+        KdfMemory = grantor.KdfMemory;
+        KdfParallelism = grantor.KdfParallelism;
     }
 
     public int KdfIterations { get; private set; }
+    public int? KdfMemory { get; private set; }
+    public int? KdfParallelism { get; private set; }
     public KdfType Kdf { get; private set; }
     public string KeyEncrypted { get; private set; }
 }

src/Api/Models/Response/Organizations/OrganizationUserResponseModel.cs

@@ -111,12 +111,16 @@ public class OrganizationUserResetPasswordDetailsResponseModel : ResponseModel
 
         Kdf = orgUser.Kdf;
         KdfIterations = orgUser.KdfIterations;
+        KdfMemory = orgUser.KdfMemory;
+        KdfParallelism = orgUser.KdfParallelism;
         ResetPasswordKey = orgUser.ResetPasswordKey;
         EncryptedPrivateKey = orgUser.EncryptedPrivateKey;
     }
 
     public KdfType Kdf { get; set; }
     public int KdfIterations { get; set; }
+    public int? KdfMemory { get; set; }
+    public int? KdfParallelism { get; set; }
     public string ResetPasswordKey { get; set; }
     public string EncryptedPrivateKey { get; set; }
 }

src/Core/Entities/User.cs

@@ -54,6 +54,8 @@ public class User : ITableObject<Guid>, ISubscriber, IStorable, IStorableSubscri
     public string ApiKey { get; set; }
     public KdfType Kdf { get; set; } = KdfType.PBKDF2_SHA256;
     public int KdfIterations { get; set; } = 5000;
+    public int? KdfMemory { get; set; }
+    public int? KdfParallelism { get; set; }
     public DateTime CreationDate { get; set; } = DateTime.UtcNow;
     public DateTime RevisionDate { get; set; } = DateTime.UtcNow;
     public bool ForcePasswordReset { get; set; }

src/Core/Enums/KdfType.cs

@@ -2,5 +2,6 @@
 
 public enum KdfType : byte
 {
-    PBKDF2_SHA256 = 0
+    PBKDF2_SHA256 = 0,
+    Argon2id = 1
 }

src/Core/Models/Api/Request/Accounts/RegisterRequestModel.cs

@@ -26,6 +26,8 @@ public class RegisterRequestModel : IValidatableObject, ICaptchaProtectedModel
     public Guid? OrganizationUserId { get; set; }
     public KdfType? Kdf { get; set; }
     public int? KdfIterations { get; set; }
+    public int? KdfMemory { get; set; }
+    public int? KdfParallelism { get; set; }
     public Dictionary<string, object> ReferenceData { get; set; }
 
     public User ToUser()
@@ -37,6 +39,8 @@ public class RegisterRequestModel : IValidatableObject, ICaptchaProtectedModel
             MasterPasswordHint = MasterPasswordHint,
             Kdf = Kdf.GetValueOrDefault(KdfType.PBKDF2_SHA256),
             KdfIterations = KdfIterations.GetValueOrDefault(5000),
+            KdfMemory = KdfMemory,
+            KdfParallelism = KdfParallelism
         };
 
         if (ReferenceData != null)
@@ -61,17 +65,9 @@ public class RegisterRequestModel : IValidatableObject, ICaptchaProtectedModel
     {
         if (Kdf.HasValue && KdfIterations.HasValue)
         {
-            switch (Kdf.Value)
+            return KdfSettingsValidator.Validate(Kdf.Value, KdfIterations.Value, KdfMemory, KdfParallelism);
-            {
-                case KdfType.PBKDF2_SHA256:
-                    if (KdfIterations.Value < 5000 || KdfIterations.Value > 1_000_000)
-                    {
-                        yield return new ValidationResult("KDF iterations must be between 5000 and 1000000.");
-                    }
-                    break;
-                default:
-                    break;
-            }
         }
+
+        return Enumerable.Empty<ValidationResult>();
     }
 }

src/Core/Models/Api/Response/Accounts/PreloginResponseModel.cs

@@ -9,8 +9,12 @@ public class PreloginResponseModel
     {
         Kdf = kdfInformation.Kdf;
         KdfIterations = kdfInformation.KdfIterations;
+        KdfMemory = kdfInformation.KdfMemory;
+        KdfParallelism = kdfInformation.KdfParallelism;
     }
 
     public KdfType Kdf { get; set; }
     public int KdfIterations { get; set; }
+    public int? KdfMemory { get; set; }
+    public int? KdfParallelism { get; set; }
 }

src/Core/Models/Data/Organizations/OrganizationUsers/OrganizationUserResetPasswordDetails.cs

@@ -24,11 +24,15 @@ public class OrganizationUserResetPasswordDetails
 
         Kdf = user.Kdf;
         KdfIterations = user.KdfIterations;
+        KdfMemory = user.KdfMemory;
+        KdfParallelism = user.KdfParallelism;
         ResetPasswordKey = orgUser.ResetPasswordKey;
         EncryptedPrivateKey = org.PrivateKey;
     }
     public KdfType Kdf { get; set; }
     public int KdfIterations { get; set; }
+    public int? KdfMemory { get; set; }
+    public int? KdfParallelism { get; set; }
     public string ResetPasswordKey { get; set; }
     public string EncryptedPrivateKey { get; set; }
 }

src/Core/Models/Data/UserKdfInformation.cs

@@ -6,4 +6,6 @@ public class UserKdfInformation
 {
     public KdfType Kdf { get; set; }
     public int KdfIterations { get; set; }
+    public int? KdfMemory { get; set; }
+    public int? KdfParallelism { get; set; }
 }

src/Core/Services/IUserService.cs

@@ -36,7 +36,7 @@ public interface IUserService
     Task<IdentityResult> AdminResetPasswordAsync(OrganizationUserType type, Guid orgId, Guid id, string newMasterPassword, string key);
     Task<IdentityResult> UpdateTempPasswordAsync(User user, string newMasterPassword, string key, string hint);
     Task<IdentityResult> ChangeKdfAsync(User user, string masterPassword, string newMasterPassword, string key,
-        KdfType kdf, int kdfIterations);
+        KdfType kdf, int kdfIterations, int? kdfMemory, int? kdfParallelism);
     Task<IdentityResult> UpdateKeyAsync(User user, string masterPassword, string key, string privateKey,
         IEnumerable<Cipher> ciphers, IEnumerable<Folder> folders, IEnumerable<Send> sends);
     Task<IdentityResult> RefreshSecurityStampAsync(User user, string masterPasswordHash);

src/Core/Services/Implementations/UserService.cs

@@ -824,7 +824,7 @@ public class UserService : UserManager<User>, IUserService, IDisposable
     }
 
     public async Task<IdentityResult> ChangeKdfAsync(User user, string masterPassword, string newMasterPassword,
-        string key, KdfType kdf, int kdfIterations)
+        string key, KdfType kdf, int kdfIterations, int? kdfMemory, int? kdfParallelism)
     {
         if (user == null)
         {
@@ -843,6 +843,8 @@ public class UserService : UserManager<User>, IUserService, IDisposable
             user.Key = key;
             user.Kdf = kdf;
             user.KdfIterations = kdfIterations;
+            user.KdfMemory = kdfMemory;
+            user.KdfParallelism = kdfParallelism;
             await _userRepository.ReplaceAsync(user);
             await _pushService.PushLogOutAsync(user.Id);
             return IdentityResult.Success;

src/Core/Utilities/KdfSettingsValidator.cs

@@ -0,0 +1,37 @@
+using System.ComponentModel.DataAnnotations;
+using Bit.Core.Enums;
+
+namespace Bit.Core.Utilities;
+
+public static class KdfSettingsValidator
+{
+    public static IEnumerable<ValidationResult> Validate(KdfType kdfType, int kdfIterations, int? kdfMemory, int? kdfParallelism)
+    {
+        switch (kdfType)
+        {
+            case KdfType.PBKDF2_SHA256:
+                if (kdfIterations < 5000 || kdfIterations > 2_000_000)
+                {
+                    yield return new ValidationResult("KDF iterations must be between 5000 and 2000000.");
+                }
+                break;
+            case KdfType.Argon2id:
+                if (kdfIterations <= 0)
+                {
+                    yield return new ValidationResult("Argon2 iterations must be greater than 0.");
+                }
+                else if (!kdfMemory.HasValue || kdfMemory.Value < 15 || kdfMemory.Value > 1024)
+                {
+                    yield return new ValidationResult("Argon2 memory must be between 15mb and 1024mb.");
+                }
+                else if (!kdfParallelism.HasValue || kdfParallelism.Value < 1 || kdfParallelism.Value > 16)
+                {
+                    yield return new ValidationResult("Argon2 parallelism must be between 1 and 16.");
+                }
+                break;
+
+            default:
+                break;
+        }
+    }
+}

src/Identity/IdentityServer/BaseRequestValidator.cs

@@ -187,6 +187,8 @@ public abstract class BaseRequestValidator<T> where T : class
         customResponse.Add("ResetMasterPassword", string.IsNullOrWhiteSpace(user.MasterPassword));
         customResponse.Add("Kdf", (byte)user.Kdf);
         customResponse.Add("KdfIterations", user.KdfIterations);
+        customResponse.Add("KdfMemory", user.KdfMemory);
+        customResponse.Add("KdfParallelism", user.KdfParallelism);
 
         if (sendRememberToken)
         {

src/Infrastructure.EntityFramework/Repositories/UserRepository.cs

@@ -32,7 +32,9 @@ public class UserRepository : Repository<Core.Entities.User, User, Guid>, IUserR
                 .Select(e => new DataModel.UserKdfInformation
                 {
                     Kdf = e.Kdf,
-                    KdfIterations = e.KdfIterations
+                    KdfIterations = e.KdfIterations,
+                    KdfMemory = e.KdfMemory,
+                    KdfParallelism = e.KdfParallelism
                 }).SingleOrDefaultAsync();
         }
     }

src/Sql/Sql.sqlproj

@@ -67,6 +67,7 @@
     <Folder Include="dbo\Functions\" />
     <Folder Include="dbo\Stored Procedures\" />
     <Folder Include="dbo\User Defined Types\" />
+    <Folder Include="dbo\Stored Procedures\ApiKey\" />
   </ItemGroup>
   <ItemGroup>
     <Build Include="dbo\Functions\CipherDetails.sql" />

src/Sql/dbo/Stored Procedures/User_Create.sql

@@ -27,6 +27,8 @@
     @LicenseKey VARCHAR(100),
     @Kdf TINYINT,
     @KdfIterations INT,
+    @KdfMemory INT = NULL,
+    @KdfParallelism INT = NULL,
     @CreationDate DATETIME2(7),
     @RevisionDate DATETIME2(7),
     @ApiKey VARCHAR(30),
@@ -78,7 +80,9 @@ BEGIN
         [FailedLoginCount],
         [LastFailedLoginDate],
         [UnknownDeviceVerificationEnabled],
-        [AvatarColor]
+        [AvatarColor],
+        [KdfMemory],
+        [KdfParallelism]
     )
     VALUES
     (
@@ -118,6 +122,8 @@ BEGIN
         @FailedLoginCount,
         @LastFailedLoginDate,
         @UnknownDeviceVerificationEnabled,
-        @AvatarColor
+        @AvatarColor,
+        @KdfMemory,
+        @KdfParallelism
     )
 END

src/Sql/dbo/Stored Procedures/User_ReadKdfByEmail.sql

@@ -7,6 +7,8 @@ BEGIN
     SELECT
         [Kdf],
         [KdfIterations]
+        [KdfMemory],
+        [KdfParallelism]
     FROM
         [dbo].[User]
     WHERE

src/Sql/dbo/Stored Procedures/User_Update.sql

@@ -27,6 +27,8 @@
     @LicenseKey VARCHAR(100),
     @Kdf TINYINT,
     @KdfIterations INT,
+    @KdfMemory INT = NULL,
+    @KdfParallelism INT = NULL,
     @CreationDate DATETIME2(7),
     @RevisionDate DATETIME2(7),
     @ApiKey VARCHAR(30),
@@ -70,6 +72,8 @@ BEGIN
         [LicenseKey] = @LicenseKey,
         [Kdf] = @Kdf,
         [KdfIterations] = @KdfIterations,
+        [KdfMemory] = @KdfMemory,
+        [KdfParallelism] = @KdfParallelism,
         [CreationDate] = @CreationDate,
         [RevisionDate] = @RevisionDate,
         [ApiKey] = @ApiKey,

src/Sql/dbo/Tables/User.sql

@@ -27,6 +27,8 @@
     [LicenseKey]                       VARCHAR (100)    NULL,
     [Kdf]                              TINYINT          NOT NULL,
     [KdfIterations]                    INT              NOT NULL,
+    [KdfMemory]                        INT              NULL,
+    [KdfParallelism]                   INT              NULL,
     [CreationDate]                     DATETIME2 (7)    NOT NULL,
     [RevisionDate]                     DATETIME2 (7)    NOT NULL,
     [ApiKey]                           VARCHAR (30)     NOT NULL,

test/Api.Test/Models/Request/Accounts/KdfRequestModelTests.cs

@@ -0,0 +1,65 @@
+using System.ComponentModel.DataAnnotations;
+using Bit.Api.Models.Request.Accounts;
+using Bit.Core.Enums;
+using Xunit;
+
+namespace Bit.Api.Test.Models.Request.Accounts;
+
+public class KdfRequestModelTests
+{
+    [Theory]
+    [InlineData(KdfType.PBKDF2_SHA256, 1_000_000, null, null)] // Somewhere in the middle
+    [InlineData(KdfType.PBKDF2_SHA256, 5000, null, null)] // Right on the lower boundary
+    [InlineData(KdfType.PBKDF2_SHA256, 2_000_000, null, null)] // Right on the upper boundary
+    [InlineData(KdfType.Argon2id, 10, 500, 8)] // Somewhere in the middle
+    [InlineData(KdfType.Argon2id, 1, 15, 1)] // Right on the lower boundary
+    [InlineData(KdfType.Argon2id, 5000, 1024, 16)] // Right on the upper boundary
+    public void Validate_IsValid(KdfType kdfType, int? kdfIterations, int? kdfMemory, int? kdfParallelism)
+    {
+        var model = new KdfRequestModel
+        {
+            Kdf = kdfType,
+            KdfIterations = kdfIterations,
+            KdfMemory = kdfMemory,
+            KdfParallelism = kdfParallelism,
+            Key = "TEST",
+            NewMasterPasswordHash = "TEST",
+        };
+
+        var results = Validate(model);
+        Assert.Empty(results);
+    }
+
+    [Theory]
+    [InlineData(null, 350_000, null, null, 1)] // Although KdfType is nullable, it's marked as [Required]
+    [InlineData(KdfType.PBKDF2_SHA256, 1000, null, null, 1)] // Too few iterations
+    [InlineData(KdfType.PBKDF2_SHA256, 2_000_001, null, null, 1)] // Too many iterations
+    [InlineData(KdfType.Argon2id, 0, 30, 8, 1)] // Iterations must be greater than 0
+    [InlineData(KdfType.Argon2id, 10, 14, 8, 1)] // Too little memory
+    [InlineData(KdfType.Argon2id, 10, 14, 0, 1)] // Too small of a parallelism value
+    [InlineData(KdfType.Argon2id, 10, 1025, 8, 1)] // Too much memory
+    [InlineData(KdfType.Argon2id, 10, 512, 17, 1)] // Too big of a parallelism value
+    public void Validate_Fails(KdfType? kdfType, int? kdfIterations, int? kdfMemory, int? kdfParallelism, int expectedFailures)
+    {
+        var model = new KdfRequestModel
+        {
+            Kdf = kdfType,
+            KdfIterations = kdfIterations,
+            KdfMemory = kdfMemory,
+            KdfParallelism = kdfParallelism,
+            Key = "TEST",
+            NewMasterPasswordHash = "TEST",
+        };
+
+        var results = Validate(model);
+        Assert.NotEmpty(results);
+        Assert.Equal(expectedFailures, results.Count);
+    }
+
+    public static List<ValidationResult> Validate(KdfRequestModel model)
+    {
+        var results = new List<ValidationResult>();
+        Validator.TryValidateObject(model, new ValidationContext(model), results);
+        return results;
+    }
+}

util/Migrator/DbScripts/2023_01-15_00_KDFOptions.sql

@@ -0,0 +1,265 @@
+IF COL_LENGTH('dbo.User', 'KdfMemory') IS NULL
+BEGIN
+    ALTER TABLE
+        [dbo].[User]
+    ADD
+        [KdfMemory] INT NULL
+END
+GO
+
+IF COL_LENGTH('dbo.User', 'KdfParallelism') IS NULL
+BEGIN
+    ALTER TABLE
+        [dbo].[User]
+    ADD
+        [KdfParallelism] INT NULL
+END
+GO
+
+CREATE OR ALTER VIEW [dbo].[UserView]
+AS
+SELECT
+   *
+FROM
+   [dbo].[User]
+GO
+
+CREATE OR ALTER PROCEDURE [dbo].[User_Create]
+    @Id UNIQUEIDENTIFIER OUTPUT,
+    @Name NVARCHAR(50),
+    @Email NVARCHAR(256),
+    @EmailVerified BIT,
+    @MasterPassword NVARCHAR(300),
+    @MasterPasswordHint NVARCHAR(50),
+    @Culture NVARCHAR(10),
+    @SecurityStamp NVARCHAR(50),
+    @TwoFactorProviders NVARCHAR(MAX),
+    @TwoFactorRecoveryCode NVARCHAR(32),
+    @EquivalentDomains NVARCHAR(MAX),
+    @ExcludedGlobalEquivalentDomains NVARCHAR(MAX),
+    @AccountRevisionDate DATETIME2(7),
+    @Key NVARCHAR(MAX),
+    @PublicKey NVARCHAR(MAX),
+    @PrivateKey NVARCHAR(MAX),
+    @Premium BIT,
+    @PremiumExpirationDate DATETIME2(7),
+    @RenewalReminderDate DATETIME2(7),
+    @Storage BIGINT,
+    @MaxStorageGb SMALLINT,
+    @Gateway TINYINT,
+    @GatewayCustomerId VARCHAR(50),
+    @GatewaySubscriptionId VARCHAR(50),
+    @ReferenceData VARCHAR(MAX),
+    @LicenseKey VARCHAR(100),
+    @Kdf TINYINT,
+    @KdfIterations INT,
+    @KdfMemory INT = NULL,
+    @KdfParallelism INT = NULL,
+    @CreationDate DATETIME2(7),
+    @RevisionDate DATETIME2(7),
+    @ApiKey VARCHAR(30),
+    @ForcePasswordReset BIT = 0,
+    @UsesKeyConnector BIT = 0,
+    @FailedLoginCount INT = 0,
+    @LastFailedLoginDate DATETIME2(7),
+    @UnknownDeviceVerificationEnabled BIT = 1,
+    @AvatarColor VARCHAR(7) = NULL
+AS
+BEGIN
+    SET NOCOUNT ON
+
+    INSERT INTO [dbo].[User]
+    (
+        [Id],
+        [Name],
+        [Email],
+        [EmailVerified],
+        [MasterPassword],
+        [MasterPasswordHint],
+        [Culture],
+        [SecurityStamp],
+        [TwoFactorProviders],
+        [TwoFactorRecoveryCode],
+        [EquivalentDomains],
+        [ExcludedGlobalEquivalentDomains],
+        [AccountRevisionDate],
+        [Key],
+        [PublicKey],
+        [PrivateKey],
+        [Premium],
+        [PremiumExpirationDate],
+        [RenewalReminderDate],
+        [Storage],
+        [MaxStorageGb],
+        [Gateway],
+        [GatewayCustomerId],
+        [GatewaySubscriptionId],
+        [ReferenceData],
+        [LicenseKey],
+        [Kdf],
+        [KdfIterations],
+        [CreationDate],
+        [RevisionDate],
+        [ApiKey],
+        [ForcePasswordReset],
+        [UsesKeyConnector],
+        [FailedLoginCount],
+        [LastFailedLoginDate],
+        [UnknownDeviceVerificationEnabled],
+        [AvatarColor],
+        [KdfMemory],
+        [KdfParallelism]
+    )
+    VALUES
+    (
+        @Id,
+        @Name,
+        @Email,
+        @EmailVerified,
+        @MasterPassword,
+        @MasterPasswordHint,
+        @Culture,
+        @SecurityStamp,
+        @TwoFactorProviders,
+        @TwoFactorRecoveryCode,
+        @EquivalentDomains,
+        @ExcludedGlobalEquivalentDomains,
+        @AccountRevisionDate,
+        @Key,
+        @PublicKey,
+        @PrivateKey,
+        @Premium,
+        @PremiumExpirationDate,
+        @RenewalReminderDate,
+        @Storage,
+        @MaxStorageGb,
+        @Gateway,
+        @GatewayCustomerId,
+        @GatewaySubscriptionId,
+        @ReferenceData,
+        @LicenseKey,
+        @Kdf,
+        @KdfIterations,
+        @CreationDate,
+        @RevisionDate,
+        @ApiKey,
+        @ForcePasswordReset,
+        @UsesKeyConnector,
+        @FailedLoginCount,
+        @LastFailedLoginDate,
+        @UnknownDeviceVerificationEnabled,
+        @AvatarColor,
+        @KdfMemory,
+        @KdfParallelism
+    )
+END
+GO
+
+
+CREATE OR ALTER PROCEDURE [dbo].[User_ReadKdfByEmail]
+    @Email NVARCHAR(256)
+AS
+BEGIN
+    SET NOCOUNT ON
+
+    SELECT
+        [Kdf],
+        [KdfIterations]
+        [KdfMemory],
+        [KdfParallelism]
+    FROM
+        [dbo].[User]
+    WHERE
+        [Email] = @Email
+END
+GO
+
+CREATE OR ALTER PROCEDURE [dbo].[User_Update]
+    @Id UNIQUEIDENTIFIER,
+    @Name NVARCHAR(50),
+    @Email NVARCHAR(256),
+    @EmailVerified BIT,
+    @MasterPassword NVARCHAR(300),
+    @MasterPasswordHint NVARCHAR(50),
+    @Culture NVARCHAR(10),
+    @SecurityStamp NVARCHAR(50),
+    @TwoFactorProviders NVARCHAR(MAX),
+    @TwoFactorRecoveryCode NVARCHAR(32),
+    @EquivalentDomains NVARCHAR(MAX),
+    @ExcludedGlobalEquivalentDomains NVARCHAR(MAX),
+    @AccountRevisionDate DATETIME2(7),
+    @Key NVARCHAR(MAX),
+    @PublicKey NVARCHAR(MAX),
+    @PrivateKey NVARCHAR(MAX),
+    @Premium BIT,
+    @PremiumExpirationDate DATETIME2(7),
+    @RenewalReminderDate DATETIME2(7),
+    @Storage BIGINT,
+    @MaxStorageGb SMALLINT,
+    @Gateway TINYINT,
+    @GatewayCustomerId VARCHAR(50),
+    @GatewaySubscriptionId VARCHAR(50),
+    @ReferenceData VARCHAR(MAX),
+    @LicenseKey VARCHAR(100),
+    @Kdf TINYINT,
+    @KdfIterations INT,
+    @KdfMemory INT = NULL,
+    @KdfParallelism INT = NULL,
+    @CreationDate DATETIME2(7),
+    @RevisionDate DATETIME2(7),
+    @ApiKey VARCHAR(30),
+    @ForcePasswordReset BIT = 0,
+    @UsesKeyConnector BIT = 0,
+    @FailedLoginCount INT,
+    @LastFailedLoginDate DATETIME2(7),
+    @UnknownDeviceVerificationEnabled BIT = 1,
+    @AvatarColor VARCHAR(7)
+AS
+BEGIN
+    SET NOCOUNT ON
+
+    UPDATE
+        [dbo].[User]
+    SET
+        [Name] = @Name,
+        [Email] = @Email,
+        [EmailVerified] = @EmailVerified,
+        [MasterPassword] = @MasterPassword,
+        [MasterPasswordHint] = @MasterPasswordHint,
+        [Culture] = @Culture,
+        [SecurityStamp] = @SecurityStamp,
+        [TwoFactorProviders] = @TwoFactorProviders,
+        [TwoFactorRecoveryCode] = @TwoFactorRecoveryCode,
+        [EquivalentDomains] = @EquivalentDomains,
+        [ExcludedGlobalEquivalentDomains] = @ExcludedGlobalEquivalentDomains,
+        [AccountRevisionDate] = @AccountRevisionDate,
+        [Key] = @Key,
+        [PublicKey] = @PublicKey,
+        [PrivateKey] = @PrivateKey,
+        [Premium] = @Premium,
+        [PremiumExpirationDate] = @PremiumExpirationDate,
+        [RenewalReminderDate] = @RenewalReminderDate,
+        [Storage] = @Storage,
+        [MaxStorageGb] = @MaxStorageGb,
+        [Gateway] = @Gateway,
+        [GatewayCustomerId] = @GatewayCustomerId,
+        [GatewaySubscriptionId] = @GatewaySubscriptionId,
+        [ReferenceData] = @ReferenceData,
+        [LicenseKey] = @LicenseKey,
+        [Kdf] = @Kdf,
+        [KdfIterations] = @KdfIterations,
+        [KdfMemory] = @KdfMemory,
+        [KdfParallelism] = @KdfParallelism,
+        [CreationDate] = @CreationDate,
+        [RevisionDate] = @RevisionDate,
+        [ApiKey] = @ApiKey,
+        [ForcePasswordReset] = @ForcePasswordReset,
+        [UsesKeyConnector] = @UsesKeyConnector,
+        [FailedLoginCount] = @FailedLoginCount,
+        [LastFailedLoginDate] = @LastFailedLoginDate,
+        [UnknownDeviceVerificationEnabled] = @UnknownDeviceVerificationEnabled,
+	    [AvatarColor] = @AvatarColor
+    WHERE
+        [Id] = @Id
+END
+GO

util/MySqlMigrations/Factories.cs

@@ -3,6 +3,7 @@ using Bit.Infrastructure.EntityFramework.Repositories;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.EntityFrameworkCore.Design;
 using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.DependencyInjection;
 
 namespace Bit.MySqlMigrations;
 
@@ -22,6 +23,10 @@ public class DatabaseContextFactory : IDesignTimeDbContextFactory<DatabaseContex
 {
     public DatabaseContext CreateDbContext(string[] args)
     {
+        var services = new ServiceCollection();
+        services.AddDataProtection();
+        var serviceProvider = services.BuildServiceProvider();
+
         var globalSettings = GlobalSettingsFactory.GlobalSettings;
         var optionsBuilder = new DbContextOptionsBuilder<DatabaseContext>();
         var connectionString = globalSettings.MySql?.ConnectionString;
@@ -32,7 +37,8 @@ public class DatabaseContextFactory : IDesignTimeDbContextFactory<DatabaseContex
         optionsBuilder.UseMySql(
             connectionString,
             ServerVersion.AutoDetect(connectionString),
-            b => b.MigrationsAssembly("MySqlMigrations"));
+            b => b.MigrationsAssembly("MySqlMigrations"))
+           .UseApplicationServiceProvider(serviceProvider);
         return new DatabaseContext(optionsBuilder.Options);
     }
 }

util/MySqlMigrations/Migrations/20230124132226_KDFOptions.cs

@@ -0,0 +1,35 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace Bit.MySqlMigrations.Migrations
+{
+    public partial class KDFOptions : Migration
+    {
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<int>(
+                name: "KdfMemory",
+                table: "User",
+                type: "int",
+                nullable: true);
+
+            migrationBuilder.AddColumn<int>(
+                name: "KdfParallelism",
+                table: "User",
+                type: "int",
+                nullable: true);
+        }
+
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "KdfMemory",
+                table: "User");
+
+            migrationBuilder.DropColumn(
+                name: "KdfParallelism",
+                table: "User");
+        }
+    }
+}

util/MySqlMigrations/Migrations/DatabaseContextModelSnapshot.cs

@@ -1377,6 +1377,12 @@ namespace Bit.MySqlMigrations.Migrations
                     b.Property<int>("KdfIterations")
                         .HasColumnType("int");
 
+                    b.Property<int?>("KdfMemory")
+                        .HasColumnType("int");
+
+                    b.Property<int?>("KdfParallelism")
+                        .HasColumnType("int");
+
                     b.Property<string>("Key")
                         .HasColumnType("longtext");
 

util/PostgresMigrations/Factories.cs

@@ -3,6 +3,7 @@ using Bit.Infrastructure.EntityFramework.Repositories;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.EntityFrameworkCore.Design;
 using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.DependencyInjection;
 
 namespace Bit.PostgresMigrations;
 
@@ -22,6 +23,10 @@ public class DatabaseContextFactory : IDesignTimeDbContextFactory<DatabaseContex
 {
     public DatabaseContext CreateDbContext(string[] args)
     {
+        var services = new ServiceCollection();
+        services.AddDataProtection();
+        var serviceProvider = services.BuildServiceProvider();
+
         var globalSettings = GlobalSettingsFactory.GlobalSettings;
         var optionsBuilder = new DbContextOptionsBuilder<DatabaseContext>();
         var connectionString = globalSettings.PostgreSql?.ConnectionString;
@@ -31,7 +36,8 @@ public class DatabaseContextFactory : IDesignTimeDbContextFactory<DatabaseContex
         }
         optionsBuilder.UseNpgsql(
             connectionString,
-            b => b.MigrationsAssembly("PostgresMigrations"));
+            b => b.MigrationsAssembly("PostgresMigrations"))
+           .UseApplicationServiceProvider(serviceProvider);
         return new DatabaseContext(optionsBuilder.Options);
     }
 }

util/PostgresMigrations/Migrations/20230124132215_KDFOptions.cs

@@ -0,0 +1,35 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace Bit.PostgresMigrations.Migrations
+{
+    public partial class KDFOptions : Migration
+    {
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<int>(
+                name: "KdfMemory",
+                table: "User",
+                type: "integer",
+                nullable: true);
+
+            migrationBuilder.AddColumn<int>(
+                name: "KdfParallelism",
+                table: "User",
+                type: "integer",
+                nullable: true);
+        }
+
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "KdfMemory",
+                table: "User");
+
+            migrationBuilder.DropColumn(
+                name: "KdfParallelism",
+                table: "User");
+        }
+    }
+}

util/PostgresMigrations/Migrations/DatabaseContextModelSnapshot.cs

@@ -1388,6 +1388,12 @@ namespace Bit.PostgresMigrations.Migrations
                     b.Property<int>("KdfIterations")
                         .HasColumnType("integer");
 
+                    b.Property<int?>("KdfMemory")
+                        .HasColumnType("integer");
+
+                    b.Property<int?>("KdfParallelism")
+                        .HasColumnType("integer");
+
                     b.Property<string>("Key")
                         .HasColumnType("text");
 

util/SqliteMigrations/Factories.cs

@@ -3,6 +3,7 @@ using Bit.Infrastructure.EntityFramework.Repositories;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.EntityFrameworkCore.Design;
 using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.DependencyInjection;
 
 namespace Bit.SqliteMigrations;
 
@@ -21,6 +22,10 @@ public class DatabaseContextFactory : IDesignTimeDbContextFactory<DatabaseContex
 {
     public DatabaseContext CreateDbContext(string[] args)
     {
+        var services = new ServiceCollection();
+        services.AddDataProtection();
+        var serviceProvider = services.BuildServiceProvider();
+
         var globalSettings = GlobalSettingsFactory.GlobalSettings;
         var optionsBuilder = new DbContextOptionsBuilder<DatabaseContext>();
         var connectionString = globalSettings.Sqlite?.ConnectionString ?? "Data Source=:memory:";
@@ -30,7 +35,8 @@ public class DatabaseContextFactory : IDesignTimeDbContextFactory<DatabaseContex
         }
         optionsBuilder.UseSqlite(
             connectionString,
-            b => b.MigrationsAssembly("SqliteMigrations"));
+            b => b.MigrationsAssembly("SqliteMigrations"))
+           .UseApplicationServiceProvider(serviceProvider);
         return new DatabaseContext(optionsBuilder.Options);
     }
 }

util/SqliteMigrations/Migrations/20230124132220_KDFOptions.cs

@@ -0,0 +1,35 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace Bit.SqliteMigrations.Migrations
+{
+    public partial class KDFOptions : Migration
+    {
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<int>(
+                name: "KdfMemory",
+                table: "User",
+                type: "INTEGER",
+                nullable: true);
+
+            migrationBuilder.AddColumn<int>(
+                name: "KdfParallelism",
+                table: "User",
+                type: "INTEGER",
+                nullable: true);
+        }
+
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "KdfMemory",
+                table: "User");
+
+            migrationBuilder.DropColumn(
+                name: "KdfParallelism",
+                table: "User");
+        }
+    }
+}

util/SqliteMigrations/Migrations/DatabaseContextModelSnapshot.cs

@@ -1375,6 +1375,12 @@ namespace Bit.SqliteMigrations.Migrations
                     b.Property<int>("KdfIterations")
                         .HasColumnType("INTEGER");
 
+                    b.Property<int?>("KdfMemory")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<int?>("KdfParallelism")
+                        .HasColumnType("INTEGER");
+
                     b.Property<string>("Key")
                         .HasColumnType("TEXT");