Struct PasswordProtectedKeyEnvelope

pub struct PasswordProtectedKeyEnvelope<Ids: KeyIds> {
    _phantom: PhantomData<Ids>,
    cose_encrypt: CoseEncrypt,
}

A password-protected key envelope can seal a symmetric key, and protect it with a password. It does so by using a Key Derivation Function (KDF), to increase the difficulty of brute-forcing the password.

The KDF parameters such as iterations and salt are stored in the envelope and do not have to be provided.

Internally, Argon2 is used as the KDF and XChaCha20-Poly1305 is used to encrypt the key.

Fields

_phantom: PhantomData<Ids>

cose_encrypt: CoseEncrypt

Implementations

impl<Ids: KeyIds> PasswordProtectedKeyEnvelope<Ids>

pub fn seal( key_to_seal: Ids::Symmetric, password: &str, ctx: &KeyStoreContext<'_, Ids>, ) -> Result<Self, PasswordProtectedKeyEnvelopeError>

Seals a symmetric key with a password, using the current default KDF parameters and a random salt.

This should never fail, except for memory allocation error, when running the KDF.

fn seal_ref( key_to_seal: &SymmetricCryptoKey, password: &str, ) -> Result<Self, PasswordProtectedKeyEnvelopeError>

Seals a key reference with a password. This function is not public since callers are expected to only work with key store references.

fn seal_ref_with_settings( key_to_seal: &SymmetricCryptoKey, password: &str, kdf_settings: &Argon2RawSettings, ) -> Result<Self, PasswordProtectedKeyEnvelopeError>

Seals a key reference with a password and custom provided settings. This function is not public since callers are expected to only work with key store references, and to not control the KDF difficulty where possible.

pub fn unseal( &self, target_keyslot: Ids::Symmetric, password: &str, ctx: &mut KeyStoreContext<'_, Ids>, ) -> Result<Ids::Symmetric, PasswordProtectedKeyEnvelopeError>

Unseals a symmetric key from the password-protected envelope, and stores it in the key store context.

fn unseal_ref( &self, password: &str, ) -> Result<SymmetricCryptoKey, PasswordProtectedKeyEnvelopeError>

pub fn reseal( &self, password: &str, new_password: &str, ) -> Result<Self, PasswordProtectedKeyEnvelopeError>

Re-seals the key with new KDF parameters (updated settings, salt), and a new password

Trait Implementations

impl<Ids: KeyIds> Debug for PasswordProtectedKeyEnvelope<Ids>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de, Ids: KeyIds> Deserialize<'de> for PasswordProtectedKeyEnvelope<Ids>

fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>

where D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl<Ids: KeyIds> From<&PasswordProtectedKeyEnvelope<Ids>> for Vec<u8>

fn from(val: &PasswordProtectedKeyEnvelope<Ids>) -> Self

Converts to this type from the input type.

impl<Ids: KeyIds> From<PasswordProtectedKeyEnvelope<Ids>> for String

fn from(val: PasswordProtectedKeyEnvelope<Ids>) -> Self

Converts to this type from the input type.

impl<Ids: KeyIds> FromStr for PasswordProtectedKeyEnvelope<Ids>

type Err = PasswordProtectedKeyEnvelopeError

The associated error which can be returned from parsing.

fn from_str(s: &str) -> Result<Self, Self::Err>

Parses a string s to return a value of this type.

impl<Ids: KeyIds> Serialize for PasswordProtectedKeyEnvelope<Ids>

fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>

where S: Serializer,

Serialize this value into the given Serde serializer.

impl<Ids: KeyIds> TryFrom<&Vec<u8>> for PasswordProtectedKeyEnvelope<Ids>

type Error = CoseError

The type returned in the event of a conversion error.

fn try_from(value: &Vec<u8>) -> Result<Self, Self::Error>

Performs the conversion.