Struct bdrck::crypto::keystore::KeyStore

pub struct KeyStore { /* fields omitted */ }

A KeyStore is a structure which contains a single "master key", wrapped with one or more other keys. This is useful in cases where we want to encrypt data with a single key, while allowing users to add or remove keys at will, without having to a) re-encrypt the data when the keys change, or b) store multiple copies of the plaintext encrypted with the various different keys.

For example, users may want to be able to access a resource with either a password or a hardware authentication key, and the data they want to encrypt is relatively large (so re-encryption is expensive).

A KeyStore essentially contains a set of one or more wrapped keys, which it automatically loads from / persists to disk.

Methods

impl KeyStore

pub fn new<K: AbstractKey>(key: &K) -> Result<Self>

Construct a new KeyStore. A new master key is generated from scratch, and the given key is added to the KeyStore (wrapping the new master key).

pub fn open_slice<K: AbstractKey>(data: &[u8], key: &K) -> Result<Self>

Open the KeyStore (attempt to unwrap the master key) by deserializing the given KeyStore bytes.

pub fn open_read<R: Read, K: AbstractKey>(rd: R, key: &K) -> Result<Self>

Open the KeyStore (attempt to unwrap the master key) by deserializing the KeyStore bytes read from the given reader.

pub fn to_vec(&self) -> Result<Vec<u8>>

Serialize this KeyStore, so it can be persisted and then reloaded later.

pub fn get_master_key(&self) -> &Key

Return the unwrapped master key from this KeyStore.

pub fn add_key<K: AbstractKey>(&mut self, key: &K) -> Result<bool>

Add the given wrapping key to this KeyStore. When the KeyStore is opened in the future, this key can be used. Returns true if the key was successfully added, or false if it was already present in the KeyStore.

pub fn remove_key<K: AbstractKey>(&mut self, key: &K) -> Result<bool>

Remove the given key from this KeyStore, so it can no longer be used to open the KeyStore. Returns true if the key was removed, or false if the given key wasn't found in this KeyStore. It is an error to remove the last wrapping key from a KeyStore (doing so would leave it unopenable in the future).

Trait Implementations

impl<'de> Deserialize<'de> for KeyStore

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error> where
    __D: Deserializer<'de>, 

Deserialize this value from the given Serde deserializer.

impl Serialize for KeyStore

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error> where
    __S: Serializer, 

Serialize this value into the given Serde serializer.