Struct EncryptedKey 

pub struct EncryptedKey { /* private fields */ }

Overview

Provides symmetric encryption and decryption of content keys using various key derivation methods (HKDF, PBKDF2, Scrypt, Argon2id). This module implements types and traits to wrap the encryption mechanisms, and encodes methods and parameters in CBOR according to the defined CDDL schemas.

Usage

• Call EncryptedKey::lock with a chosen key derivation method, secret, and content key to produce an encrypted key.
• Retrieve the original content key by calling EncryptedKey::unlock with the correct secret.

Encoding

The form of an EncryptedKey is an EncryptedMessage that contains the encrypted content key, with its Additional Authenticated Data (AAD) being the CBOR encoding of the key derivation method and parameters used for key derivation. The same key derivation method and parameters must be used to unlock the content key.

CDDL:

EncryptedKey = #6.40027(EncryptedMessage) ; TAG_ENCRYPTED_KEY

EncryptedMessage =
    #6.40002([ ciphertext: bstr, nonce: bstr, auth: bstr, aad: bstr .cbor KeyDerivation ]) ; TAG_ENCRYPTED

KeyDerivation = HKDFParams / PBKDF2Params / ScryptParams / Argon2idParams / SSHAgentParams

HKDFParams = [HKDF, Salt, HashType]
PBKDF2Params = [PBKDF2, Salt, iterations: uint, HashType]
ScryptParams = [Scrypt, Salt, log_n: uint, r: uint, p: uint]
Argon2idParams = [Argon2id, Salt]
SSHAgentParams = [SSHAgent, Salt, id: tstr]

KeyDerivationMethod = HKDF / PBKDF2 / Scrypt / Argon2id / SSHAgent

HKDF = 0
PBKDF2 = 1
Scrypt = 2
Argon2id = 3
SSHAgent = 4

HashType = SHA256 / SHA512

SHA256 = 0
SHA512 = 1

Implementations

impl EncryptedKey

pub fn lock_opt( params: KeyDerivationParams, secret: impl AsRef<[u8]>, content_key: &SymmetricKey, ) -> Result<Self>

pub fn lock( method: KeyDerivationMethod, secret: impl AsRef<[u8]>, content_key: &SymmetricKey, ) -> Result<Self>

pub fn encrypted_message(&self) -> &EncryptedMessage

pub fn aad_cbor(&self) -> Result<CBOR>

pub fn unlock(&self, secret: impl AsRef<[u8]>) -> Result<SymmetricKey>

pub fn is_password_based(&self) -> bool

pub fn is_ssh_agent(&self) -> bool

Trait Implementations

impl CBORTagged for EncryptedKey

fn cbor_tags() -> Vec<Tag>

Returns the CBOR tags associated with this type.

impl CBORTaggedDecodable for EncryptedKey

fn from_untagged_cbor(untagged_cbor: CBOR) -> Result<Self>

Creates an instance of this type by decoding it from untagged CBOR.

fn from_tagged_cbor(cbor: CBOR) -> Result<Self, Error>

where Self: Sized,

Creates an instance of this type by decoding it from tagged CBOR.

fn from_tagged_cbor_data(data: impl AsRef<[u8]>) -> Result<Self, Error>

where Self: Sized,

Creates an instance of this type by decoding it from binary encoded tagged CBOR.

fn from_untagged_cbor_data(data: impl AsRef<[u8]>) -> Result<Self, Error>

where Self: Sized,

Creates an instance of this type by decoding it from binary encoded untagged CBOR.

impl CBORTaggedEncodable for EncryptedKey

fn untagged_cbor(&self) -> CBOR

Returns the untagged CBOR encoding of this instance.

fn tagged_cbor(&self) -> CBOR

Returns the tagged CBOR encoding of this instance.

fn tagged_cbor_data(&self) -> Vec<u8>

Returns the tagged value in CBOR binary representation.

impl Clone for EncryptedKey

fn clone(&self) -> EncryptedKey

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for EncryptedKey

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for EncryptedKey

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl From<EncryptedKey> for CBOR

fn from(value: EncryptedKey) -> Self

Converts to this type from the input type.

impl PartialEq for EncryptedKey

fn eq(&self, other: &EncryptedKey) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl TryFrom<CBOR> for EncryptedKey

type Error = Error

The type returned in the event of a conversion error.

fn try_from(value: CBOR) -> Result<Self>

Performs the conversion.

impl Eq for EncryptedKey

impl StructuralPartialEq for EncryptedKey