aranya-daemon-api 6.0.0

IPC API between the Aranya client and daemon
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89

#![allow(clippy::disallowed_macros)] // tarpc uses unreachable

use aranya_crypto::{tls::EncryptedPskSeed, Encap, EncryptionPublicKey};
use serde::{Deserialize, Serialize};

use crate::{Ikm, CS};

pub const SEED_IKM_SIZE: usize = 32;

/// Configuration for creating a new team with QUIC synchronization.
#[derive(Debug, Serialize, Deserialize)]
pub struct CreateTeamQuicSyncConfig {
    pub seed_mode: CreateSeedMode,
}

/// Configuration for adding members to an existing team with QUIC synchronization.
#[derive(Debug, Serialize, Deserialize)]
pub struct AddTeamQuicSyncConfig {
    pub seed_mode: AddSeedMode,
}

#[allow(clippy::large_enum_variant)]
#[derive(Clone, Debug, Serialize, Deserialize)]
/// Specifies how PSK seeds are provided when creating a new team.
///
/// Teams share a single PSK seed that is used to derive Pre-Shared Keys (PSKs)
/// for QUIC connections between team members.
///
/// This type will be removed soon since certificates will be used instead of PSKs in the future.
pub enum CreateSeedMode {
    /// Generates a new random seed.
    ///
    /// Used by team owners in the `create_team` API when establishing a new team.
    Generate,

    /// Provides raw input key material to derive a seed.
    ///
    /// The IKM must be exactly 32 bytes. This mode is available in both:
    /// - `create_team`: Allows team owners to specify deterministic seed material
    /// - `add_team`: Allows non-owners to join using pre-shared key material
    IKM(Ikm),
}

impl Default for CreateSeedMode {
    fn default() -> Self {
        Self::Generate
    }
}

#[allow(clippy::large_enum_variant)]
#[derive(Clone, Debug, Serialize, Deserialize)]
/// Specifies how PSK seeds are provided when joining teams.
///
/// Teams share a single PSK seed that is used to derive Pre-Shared Keys (PSKs)
/// for QUIC connections between team members.
///
/// This type will be removed soon since certificates will be used instead of PSKs in the future.
pub enum AddSeedMode {
    /// Provides raw input key material to derive a seed.
    ///
    /// The IKM must be exactly 32 bytes. This mode is available in both:
    /// - `create_team`: Allows team owners to specify deterministic seed material
    /// - `add_team`: Allows non-owners to join using pre-shared key material
    IKM(Ikm),

    /// Provides an encrypted seed for secure distribution.
    ///
    /// Used by non-owners in the `add_team` API to join an existing team.
    /// Seeds are wrapped (encrypted) to prevent plaintext exposure during
    /// the join process.
    Wrapped(WrappedSeed),
}

#[derive(Debug, Serialize, Deserialize)]
pub struct WrappedSeed {
    pub sender_pk: EncryptionPublicKey<CS>,
    pub encap_key: Encap<CS>,
    pub encrypted_seed: EncryptedPskSeed<CS>,
}

impl Clone for WrappedSeed {
    fn clone(&self) -> Self {
        Self {
            sender_pk: self.sender_pk.clone(),
            encap_key: Encap::from_bytes(self.encap_key.as_bytes()).expect("can round trip"),
            encrypted_seed: self.encrypted_seed.clone(),
        }
    }
}