#[non_exhaustive]pub enum Payload {
Entr(Vec<u8>),
}Expand description
v0.1 payload.
Caller-wrap contract (SPEC v0.9.0 §1 item 2): the Vec<u8> inside
Payload::Entr is NOT zeroize-wrapped — widening the public type to
Zeroizing<Vec<u8>> is a breaking change deferred indefinitely per
SPEC §3 OOS-2. Callers MUST wrap the byte buffer at the use site
(e.g., let bytes = Zeroizing::new((*p.as_bytes()).to_vec());)
so that the secret-material lifetime ends with a scrubbed drop.
ms-codec internally minimizes the un-scrubbed lifetime: encode + decode
path locals are Zeroizing<Vec<u8>>; only the public Payload::Entr
boundary is unwrapped.
Variants (Non-exhaustive)§
This enum is marked as non-exhaustive
Entr(Vec<u8>)
BIP-39 entropy. Length MUST be in {16, 20, 24, 28, 32} bytes (bijective with BIP-39 word counts {12, 15, 18, 21, 24}).
Caller responsibility: ms-codec does NOT check the statistical quality of these bytes. Callers are responsible for sourcing entropy from a vetted CSPRNG, or from a BIP-39 mnemonic the user already trusts. FIPS-style entropy-quality checks would slow encoding and provide false assurance — they cannot detect attacker-supplied “pseudo-random” seeds crafted to pass standard randomness tests. See SPEC §3.6.
Caller-wrap reminder: wrap this Vec<u8> in Zeroizing at the
use site so it scrubs on drop. ms-codec cannot wrap this for you
without a breaking public-API change.
Implementations§
Source§impl Payload
impl Payload
Sourcepub fn validate(&self) -> Result<()>
pub fn validate(&self) -> Result<()>
Validate the payload’s intrinsic structure (byte length for Entr). Encoder MUST call this before emitting; decoder calls it after extracting the payload bytes following the reserved-prefix byte.
Sourcepub fn kind(&self) -> PayloadKind
pub fn kind(&self) -> PayloadKind
The PayloadKind discriminant.