Crate clevis

Expand description

A Rust implementation of the Tang portion of Clevis, specified in https://github.com/latchset/clevis.

This is still under development, but works reasonibly well.

use clevis::{KeyMeta, TangClient};

/// 32-byte (256 bit) key, such as for AES256-GCM
const KEY_BYTES: usize = 32;

/* key provisioning */

// create a key suitible for encryption (i.e. has gone through a KDF)
let out = TangClient::new("localhost:11697", None)
    .create_secure_key::<KEY_BYTES>()
    .expect("failed to generate key");

// use this key to encrypt data
let original_key = out.encryption_key;

// this must be stored to get the encryption key back for decryption
// WARNING: this information should be considered secret, since any device that can
// access this and the tang server can retrieve the encryption key. Treat it with
// respect!
let meta_str = out.meta.to_json();

/* key recovery */

let new_meta = KeyMeta::from_json(&meta_str).expect("invalid metadata");
let new_key = new_meta
    .client(None)
    .recover_secure_key::<KEY_BYTES>(&new_meta)
    .expect("failed to retrieve key");

assert_eq!(original_key, new_key);

Structs

EncryptionKey
A zeroizing wrapper around a generated encryption key
KeyMeta
Data that must be stored to retrieve a key.
ProvisionedData
Data that is produced as a result of the provisioning (key generation) step.
TangClient
A tang server connection specification.

Enums

Error
Error types that this crate may produce

Type Aliases

Result
An alias for Result with this crate’s Error type