# Paranoid profile — multi-pass, multi-algorithm, full verification.

[meta]
name        = "Paranoid"
version     = 1
description = "Multi-pass, multi-algorithm, full verification. For media that must not be recoverable under any plausible adversary. Uses Gutmann 35-pass for HDDs, DoD 7-pass + every-pass verify for SSDs/NVMe."
nist_class  = "purge"
audience    = "Classified, high-value, adversary-rich environments"

[defaults]
prng_pool    = ["BLAKE3-XOF (CSPRNG)", "XChaCha20 (CSPRNG)", "Salsa20 (CSPRNG)"]
hash         = "BLAKE3-256"
verify       = "every"
certificate  = "both"
report       = ["summary", "detailed", "compliance"]

[policy_map]
hdd_cmr   = "hdd_overwrite"
hdd_smr   = "hdd_overwrite"
ssd_sata  = "ssd_purge_then_overwrite"
ssd_sas   = "ssd_purge_then_overwrite"
ssd_usb   = "ssd_purge_then_overwrite"
ssd_nvme  = "nvme_sanitize_then_overwrite"
pmem      = "pmem_crypto_erase"
mmc       = "embedded_overwrite"
sd        = "embedded_overwrite"
ufs       = "embedded_overwrite"
virtual   = "virtual_overwrite"

[constraints]
require_secure_erase_capable = false
abort_on_verify_failure      = true
require_signed_certificate   = true
minimum_passes               = 3