Struct SecureKeyStore 

pub struct SecureKeyStore { /* private fields */ }

Secure keystore for encrypted key storage.

The keystore encrypts all keys at rest using a master key derived from a password. Each key is encrypted with a unique nonce and integrity-protected with HMAC.

Implementations

impl SecureKeyStore

pub fn new(password: &[u8]) -> KeyStoreResult<Self>

Create a new keystore with the given password.

The password is used to derive the master encryption and HMAC keys using Argon2. A random salt is generated for key derivation.

Example

use chie_crypto::keystore::SecureKeyStore;

let keystore = SecureKeyStore::new(b"my-password").unwrap();

pub fn with_salt(password: &[u8], salt: [u8; 32]) -> KeyStoreResult<Self>

Create a keystore with an explicit salt (for loading from storage).

pub fn store_key( &mut self, key_id: &str, key_data: &[u8], key_type: KeyType, ) -> KeyStoreResult<()>

Store a key in the keystore.

Arguments

• key_id - Unique identifier for the key
• key_data - The key bytes to encrypt and store
• key_type - Type of the key

Errors

Returns KeyAlreadyExists if a key with the same ID already exists.

Example

use chie_crypto::keystore::{SecureKeyStore, KeyType};

let mut keystore = SecureKeyStore::new(b"password")?;
keystore.store_key("key1", b"secret", KeyType::Generic)?;

pub fn retrieve_key(&mut self, key_id: &str) -> KeyStoreResult<Vec<u8>>

Retrieve a key from the keystore.

Errors

Returns KeyNotFound if the key doesn’t exist, or IntegrityCheckFailed if the HMAC verification fails.

Example

use chie_crypto::keystore::{SecureKeyStore, KeyType};

let mut keystore = SecureKeyStore::new(b"password")?;
keystore.store_key("key1", b"secret", KeyType::Generic)?;
let retrieved = keystore.retrieve_key("key1")?;
assert_eq!(retrieved, b"secret");

pub fn delete_key(&mut self, key_id: &str) -> KeyStoreResult<()>

Delete a key from the keystore.

The key data is securely zeroized before removal.

Example

use chie_crypto::keystore::{SecureKeyStore, KeyType};

let mut keystore = SecureKeyStore::new(b"password")?;
keystore.store_key("key1", b"secret", KeyType::Generic)?;
keystore.delete_key("key1")?;
assert!(keystore.get_metadata("key1").is_err());

pub fn list_keys(&self) -> Vec<String>

List all key IDs in the keystore.

pub fn get_metadata(&self, key_id: &str) -> KeyStoreResult<&KeyMetadata>

Get metadata for a key.

pub fn update_metadata<F>(&mut self, key_id: &str, f: F) -> KeyStoreResult<()>

where F: FnOnce(&mut KeyMetadata),

Update key metadata.

pub fn rotate_key( &mut self, key_id: &str, new_key_data: &[u8], ) -> KeyStoreResult<()>

Rotate a key to a new version.

This stores the new key data while incrementing the version number and preserving other metadata.

pub fn serialize(&self) -> KeyStoreResult<Vec<u8>>

Serialize the keystore to bytes for persistent storage.

The serialized format includes the salt and all encrypted entries.

pub fn deserialize(password: &[u8], data: &[u8]) -> KeyStoreResult<Self>

Deserialize a keystore from bytes with the given password.

pub fn salt(&self) -> &[u8; 32]

Get the salt used for key derivation.

pub fn contains_key(&self, key_id: &str) -> bool

Check if a key exists in the keystore.

pub fn len(&self) -> usize

Get the number of keys stored.

pub fn is_empty(&self) -> bool

Check if the keystore is empty.

Trait Implementations

impl Drop for SecureKeyStore

fn drop(&mut self)

Executes the destructor for this type.