REF: ADMIN_RULES // CHAPTER_2885
ADMINISTRATIVE RULES
Chapter 2885: Technical Standards for Digital Trust & Fraud Prevention Registry
2885.0300 TOKENIZATION STANDARD
Algorithm: Argon2id (IETF RFC 9106)
64 MiB minimum
2 passes minimum
2 threads minimum
32 bytes (256 bits)
Token Construction
T = Argon2id(pass = Input Identifier, salt = Global Salt, secret = Association Pepper)
Input Normalization
Uppercase, no whitespace, format as [Country]-[Subdivision]-[ID]
Example: "US-MN-D12345678"
2885.0400 LIFECYCLE MANAGEMENT
Pepper Rotation
Every 36 months minimum
List Regeneration
Within 24 hours of rotation
Version Control
Authorized Issuers must reject stale list versions (>24 hours)
This prevents bad actors from targeting issuers with outdated data during rotation windows.
2885.0500 PROHIBITION ON RAINBOW TABLES
PROHIBITED
Pre-computing hashes for entire populations is explicitly prohibited.
REQUIRED
Targeted hashing only—at time of transaction, for specific subject.
Privacy by Design
The Fraud Prevention Registry architecture demonstrates that fraud prevention and privacy are not in tension:
- • No Raw Identifiers: The registry stores only Argon2id tokens, not SSNs or license numbers
- • Association Pepper: Stored in FIPS 140-3 Level 3 HSMs, rotates every 36 months
- • Version Control: Prevents replay attacks during rotation windows
- • Not a Consumer Report: Maintained solely for fraud prevention under this chapter
2885.0600 HALT COMMAND MECHANISM
Authority: § 325M.02, Subd. 3(e) — Halt Command for High-Velocity Fiscal Authority
Applicability
Class D-2 credentials and other high-velocity fiscal authority classes
Response Time
Cease new external transfers within 60 seconds of receipt
Authentication
Cryptographically authenticated instruction from Commissioner
Enforcement
Failure to comply triggers immediate suspension and protective draw on Solvency Bond
2885.0700 DATA CLASSIFICATION
Authority: § 325M.06, Subd. 4 — Classification under Minn. Stat. ch. 13
Registry Data
Classified as private data on individuals and nonpublic dataunder Minn. Stat. ch. 13. Not subject to public disclosure except as expressly provided.
Tokenization Secrets (§ 13.37)
Peppers, salts, key material, and key-derivation parameters constitute security information and trade secret information. Not subject to public disclosure or FOIA requests.
Halt Command Keys
Security keys and authentication material for revocation registries, status endpoints, and Halt Command mechanisms are classified as security informationunder § 13.37.