Struct SecretKey 

pub struct SecretKey { /* private fields */ }

A device-scoped client key, stored in secretkey.json within the profile directory.

The key material is zeroized on drop and hidden from debug output.

Example

use cipherstash_client::zerokms::{SecretKey, KeyProvider};
use zerokms_protocol::ViturKeyMaterial;
use uuid::Uuid;

let key_material: ViturKeyMaterial = vec![/* key bytes */].into();
let secret_key = SecretKey::new(
    Uuid::new_v4(),
    key_material,
);

// SecretKey implements KeyProvider
let client_key = secret_key.client_key().await?;

Implementations

impl SecretKey

pub fn new(client_id: Uuid, client_key: ViturKeyMaterial) -> Self

Create a new SecretKey from the given client ID and key material.

pub fn from_hex( client_id: String, client_key_encoded: String, ) -> Result<Self, KeyProviderError>

Create a SecretKey from string representations of the client ID and encoded key material.

Accepts the key material as either hex (the historical CS_CLIENT_KEY format) or standard padded base64 (the format used by secretkey.json on disk). Hex is tried first; base64 is a fallback for any input that doesn’t parse as hex.

Named from_hex for historical reasons — the function is now lenient. The name is preserved to avoid breaking callers.

Errors

Returns KeyProviderError::InvalidKey if:

• client_id is not a valid UUID
• client_key_encoded is neither valid hex nor valid base64

pub fn from_env() -> Result<Option<Self>, KeyProviderError>

Load a SecretKey from the CS_CLIENT_ID and CS_CLIENT_KEY environment variables.

CS_CLIENT_KEY accepts either hex (the historical format) or the base64 value that appears in secretkey.json — see SecretKey::from_hex.

Returns Ok(None) if neither or only one variable is set, allowing callers to fall back to another source. Returns Err if both variables are present but the values are invalid (bad UUID or bad encoding).

Example

use cipherstash_client::zerokms::SecretKey;

let key = SecretKey::from_env().expect("invalid key material in env");
// key is Option<SecretKey> — None means "not configured via env"

Trait Implementations

impl Debug for SecretKey

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for SecretKey

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Drop for SecretKey

fn drop(&mut self)

Executes the destructor for this type.

fn pin_drop(self: Pin<&mut Self>)

🔬This is a nightly-only experimental API. (pin_ergonomics)

Execute the destructor for this type, but different to Drop::drop, it requires self to be pinned.

impl KeyProvider for SecretKey

Implement KeyProvider for SecretKey to allow it to be used directly as a key source when initializing with a super::ZeroKMSBuilder.

async fn client_key(&self) -> Result<ClientKey, KeyProviderError>

Load a ClientKey from this provider.

impl OpaqueDebug for SecretKey

impl ProfileData for SecretKey

Available on non-WebAssembly only.

Implement ProfileData for SecretKey to enable loading/saving from the profile directory.

const FILENAME: &'static str = "secretkey.json"

The filename used when saving/loading this type (e.g. "secretkey.json").

const MODE: Option<u32>

Unix file permissions for this file. None uses the default umask. Sensitive files should return Some(0o600).

impl Serialize for SecretKey

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Zeroize for SecretKey

fn zeroize(&mut self)

Zero out this object from memory using Rust intrinsics which ensure the zeroization operation is not “optimized away” by the compiler.