aranya_daemon_api/service/
quic_sync.rs

1#![allow(clippy::disallowed_macros)] // tarpc uses unreachable
2
3use aranya_crypto::{tls::EncryptedPskSeed, Encap, EncryptionPublicKey};
4use serde::{Deserialize, Serialize};
5
6use crate::CS;
7
8pub const SEED_IKM_SIZE: usize = 32;
9
10#[derive(Debug, Serialize, Deserialize)]
11pub struct QuicSyncConfig {
12    pub seed_mode: SeedMode,
13}
14
15#[allow(clippy::large_enum_variant)]
16#[derive(Clone, Debug, Serialize, Deserialize)]
17/// Specifies how PSK seeds are provided when creating or joining teams.
18///
19/// Teams share a single PSK seed that is used to derive Pre-Shared Keys (PSKs)
20/// for QUIC connections between team members.
21pub enum SeedMode {
22    /// Generates a new random seed.
23    ///
24    /// Used by team owners in the `create_team` API when establishing a new team.
25    Generate,
26
27    /// Provides raw input key material to derive a seed.
28    ///
29    /// The IKM must be exactly 32 bytes. This mode is available in both:
30    /// - `create_team`: Allows team owners to specify deterministic seed material
31    /// - `add_team`: Allows non-owners to join using pre-shared key material
32    IKM([u8; SEED_IKM_SIZE]),
33
34    /// Provides an encrypted seed for secure distribution.
35    ///
36    /// Used by non-owners in the `add_team` API to join an existing team.
37    /// Seeds are wrapped (encrypted) to prevent plaintext exposure during
38    /// the join process.
39    Wrapped(WrappedSeed),
40}
41
42impl Default for SeedMode {
43    fn default() -> Self {
44        Self::Generate
45    }
46}
47
48#[derive(Debug, Serialize, Deserialize)]
49pub struct WrappedSeed {
50    pub sender_pk: EncryptionPublicKey<CS>,
51    pub encap_key: Encap<CS>,
52    pub encrypted_seed: EncryptedPskSeed<CS>,
53}
54
55impl Clone for WrappedSeed {
56    fn clone(&self) -> Self {
57        Self {
58            sender_pk: self.sender_pk.clone(),
59            encap_key: Encap::from_bytes(self.encap_key.as_bytes()).expect("can round trip"),
60            encrypted_seed: self.encrypted_seed.clone(),
61        }
62    }
63}
aranya_daemon_api/service/quic_sync.rs

aranya_daemon_api/service/
quic_sync.rs
