Struct SecretProtectedKeyEnvelope 

pub struct SecretProtectedKeyEnvelope {
    cose_encrypt: CoseEncrypt,
}

A secret-protected key envelope can seal a symmetric key, and protect it with a high-entropy secret of arbitrary length.

Unlike the crate::safe::PasswordProtectedKeyEnvelope, which is meant for low-entropy secrets such as PINs and uses a compute-hard or memory-hard KDF, this envelope assumes the secret is high-entropy and thus uses a cheap KDF (HKDF). The KDF salt is stored in the envelope and does not have to be provided.

Internally, HKDF-SHA256 is used as the KDF and AES-256-GCM is used to encrypt the key.

Fields

cose_encrypt: CoseEncrypt

Implementations

impl SecretProtectedKeyEnvelope

pub fn seal<Ids: KeySlotIds>( key_to_seal: Ids::Symmetric, secret: &HighEntropySecret, namespace: SecretProtectedKeyEnvelopeNamespace, ctx: &KeyStoreContext<'_, Ids>, ) -> Result<Self, SecretProtectedKeyEnvelopeError>

Seals a symmetric key with a HighEntropySecret, using a random salt.

The secret is guaranteed to be high-entropy by the HighEntropySecret type, which the cheap KDF used here relies on, since it cannot defend a low-entropy secret against brute-forcing.

This should never fail, except for memory allocation error, when running the KDF.

fn seal_ref( key_to_seal: &SymmetricCryptoKey, secret: &HighEntropySecret, namespace: SecretProtectedKeyEnvelopeNamespace, ) -> Result<Self, SecretProtectedKeyEnvelopeError>

Seals a key reference with a secret. This function is not public since callers are expected to only work with key store references.

fn seal_ref_with_settings( key_to_seal: &SymmetricCryptoKey, secret: &HighEntropySecret, hkdf_settings: &HkdfSettings, namespace: SecretProtectedKeyEnvelopeNamespace, ) -> Result<Self, SecretProtectedKeyEnvelopeError>

Seals a key reference with a secret and custom provided settings. This function is not public since callers are expected to only work with key store references.

pub fn unseal<Ids: KeySlotIds>( &self, secret: &HighEntropySecret, namespace: SecretProtectedKeyEnvelopeNamespace, ctx: &mut KeyStoreContext<'_, Ids>, ) -> Result<Ids::Symmetric, SecretProtectedKeyEnvelopeError>

Unseals a symmetric key from the secret-protected envelope, and stores it in the key store context.

fn unseal_ref( &self, secret: &HighEntropySecret, content_namespace: SecretProtectedKeyEnvelopeNamespace, ) -> Result<SymmetricCryptoKey, SecretProtectedKeyEnvelopeError>

pub fn reseal( &self, secret: &HighEntropySecret, new_secret: &HighEntropySecret, namespace: SecretProtectedKeyEnvelopeNamespace, ) -> Result<Self, SecretProtectedKeyEnvelopeError>

Re-seals the key with a new salt, and a new secret

pub fn contained_key_id( &self, ) -> Result<Option<KeyId>, SecretProtectedKeyEnvelopeError>

Get the key ID of the contained key, if the key ID is stored on the envelope headers. Only COSE keys have a key ID, legacy keys do not.

Trait Implementations

impl Clone for SecretProtectedKeyEnvelope

fn clone(&self) -> SecretProtectedKeyEnvelope

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecretProtectedKeyEnvelope

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for SecretProtectedKeyEnvelope

fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>

where D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl From<&SecretProtectedKeyEnvelope> for Vec<u8>

fn from(val: &SecretProtectedKeyEnvelope) -> Self

Converts to this type from the input type.

impl From<SecretProtectedKeyEnvelope> for String

fn from(val: SecretProtectedKeyEnvelope) -> Self

Converts to this type from the input type.

impl FromStr for SecretProtectedKeyEnvelope

type Err = SecretProtectedKeyEnvelopeError

The associated error which can be returned from parsing.

fn from_str(s: &str) -> Result<Self, Self::Err>

Parses a string s to return a value of this type.

impl FromWasmAbi for SecretProtectedKeyEnvelope

Available on crate feature wasm only.

type Abi = <String as FromWasmAbi>::Abi

The Wasm ABI type that this converts from when coming back out from the ABI boundary.

unsafe fn from_abi(abi: Self::Abi) -> Self

Recover a Self from Self::Abi.

impl IntoWasmAbi for SecretProtectedKeyEnvelope

Available on crate feature wasm only.

type Abi = <String as IntoWasmAbi>::Abi

The Wasm ABI type that this converts into when crossing the ABI boundary.

fn into_abi(self) -> Self::Abi

Convert self into Self::Abi so that it can be sent across the wasm ABI boundary.

impl OptionFromWasmAbi for SecretProtectedKeyEnvelope

Available on crate feature wasm only.

fn is_none(abi: &Self::Abi) -> bool

Tests whether the argument is a “none” instance. If so it will be deserialized as None, and otherwise it will be passed to FromWasmAbi.

impl Serialize for SecretProtectedKeyEnvelope

fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>

where S: Serializer,

Serialize this value into the given Serde serializer.

impl TryFrom<&Vec<u8>> for SecretProtectedKeyEnvelope

type Error = CoseError

The type returned in the event of a conversion error.

fn try_from(value: &Vec<u8>) -> Result<Self, Self::Error>

Performs the conversion.

impl TryFrom<JsValue> for SecretProtectedKeyEnvelope

Available on crate feature wasm only.

type Error = SecretProtectedKeyEnvelopeError

The type returned in the event of a conversion error.

fn try_from(value: JsValue) -> Result<Self, Self::Error>

Performs the conversion.

impl WasmDescribe for SecretProtectedKeyEnvelope

Available on crate feature wasm only.

fn describe()