Struct SecretKey 

pub struct SecretKey { /* private fields */ }

A device-scoped client key, stored in secretkey.json within the profile directory.

The key material is zeroized on drop and hidden from debug output.

Example

use cipherstash_client::zerokms::{SecretKey, KeyProvider};
use zerokms_protocol::ViturKeyMaterial;
use uuid::Uuid;

let key_material: ViturKeyMaterial = vec![/* key bytes */].into();
let secret_key = SecretKey::new(
    Uuid::new_v4(),
    key_material,
);

// SecretKey implements KeyProvider
let client_key = secret_key.client_key().await?;

Implementations

impl SecretKey

pub fn new(client_id: Uuid, client_key: ViturKeyMaterial) -> Self

Create a new SecretKey from the given client ID and key material.

pub fn from_hex( client_id: String, client_key_hex: String, ) -> Result<Self, KeyProviderError>

Create a SecretKey from string representations of the client ID and hex-encoded key material.

This is a convenience constructor for FFI boundaries where the client ID and key material arrive as strings.

Errors

Returns KeyProviderError::InvalidKey if:

• client_id is not a valid UUID
• client_key_hex is not valid hex

pub fn from_env() -> Result<Option<Self>, KeyProviderError>

Load a SecretKey from the CS_CLIENT_ID and CS_CLIENT_KEY environment variables.

Returns Ok(None) if neither or only one variable is set, allowing callers to fall back to another source. Returns Err if both variables are present but the values are invalid (bad UUID or bad hex).

Example

use cipherstash_client::zerokms::SecretKey;

let key = SecretKey::from_env().expect("invalid key material in env");
// key is Option<SecretKey> — None means "not configured via env"

Trait Implementations

impl Debug for SecretKey

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for SecretKey

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Drop for SecretKey

fn drop(&mut self)

Executes the destructor for this type.

impl KeyProvider for SecretKey

Implement KeyProvider for SecretKey to allow it to be used directly as a key source when initializing with a super::ZeroKMSBuilder.

async fn client_key(&self) -> Result<ClientKey, KeyProviderError>

Load a ClientKey from this provider.

impl ProfileData for SecretKey

Implement ProfileData for SecretKey to enable loading/saving from the profile directory.

const FILENAME: &'static str = "secretkey.json"

The filename used when saving/loading this type (e.g. "secretkey.json").

const MODE: Option<u32>

Unix file permissions for this file. None uses the default umask. Sensitive files should return Some(0o600).

impl Serialize for SecretKey

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Zeroize for SecretKey

fn zeroize(&mut self)

Zero out this object from memory using Rust intrinsics which ensure the zeroization operation is not “optimized away” by the compiler.

impl OpaqueDebug for SecretKey