confium_patterns/revocation/
revocation_blob.rs

1//! Revocation blob (user-side prepared, service-side decrypted).
2//!
3//! Mirrors Thunderbird's blob structure but uses threshold KEM
4//! encryption to recipient quorum instead of single-party encryption.
5
6use serde::{Deserialize, Serialize};
7
8/// A revocation blob prepared by the user's client.
9#[derive(Debug, Clone, Serialize, Deserialize)]
10pub struct RevocationBlob {
11    /// Email associated with the key (for verification flow).
12    pub user_email: String,
13    /// Fingerprint of the key being revoked.
14    pub key_fingerprint: String,
15    /// Threshold KEM encapsulated key (encrypted to service quorum's public key).
16    pub encapsulated_key: Vec<u8>,
17    /// AEAD ciphertext of (revocation_signature + public_key).
18    pub ciphertext: Vec<u8>,
19    /// AEAD nonce.
20    pub nonce: Vec<u8>,
21}
22
23/// Errors during revocation blob operations.
24#[derive(Debug, thiserror::Error)]
25pub enum RevocationError {
26    /// Blob malformed.
27    #[error("malformed blob: {0}")]
28    Malformed(String),
29    /// Verification token invalid.
30    #[error("verification token invalid: {0}")]
31    InvalidToken(String),
32    /// Email verification failed.
33    #[error("email verification failed: {0}")]
34    EmailVerificationFailed(String),
35    /// Submission already in progress.
36    #[error("submission already in progress for {0}")]
37    AlreadyInProgress(String),
38    /// Threshold decryption failed.
39    #[error("threshold decryption failed: {0}")]
40    ThresholdDecryption(String),
41    /// Keyserver publication failed.
42    #[error("keyserver publication failed: {0}")]
43    Publish(String),
44}
confium_patterns/revocation/revocation_blob.rs

confium_patterns/revocation/
revocation_blob.rs
