runar-keys 0.1.0

Standards-compliant X.509 certificates and ECDSA P-256 key management for Runar
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53

//! Runar Keys Fix - Production-Ready Certificate System
//!
//! A robust, standards-compliant certificate management system for the Runar network.
//! This implementation replaces the existing custom certificate system with proper
//! X.509 certificates and a unified ECDSA P-256 cryptographic foundation.
//!
//! ## Key Features
//!
//! - **Standard X.509 Certificates**: Full compliance with PKI standards
//! - **Unified Cryptography**: Single ECDSA P-256 algorithm throughout
//! - **Proper CA Hierarchy**: Mobile CA signs all node certificates
//! - **QUIC Compatibility**: Certificates work seamlessly with QUIC transport
//! - **Production Quality**: Comprehensive validation and error handling
//!
//! ## Architecture
//!
//! ```text
//! Mobile User CA (Self-signed root)
//! └── Node TLS Certificate (signed by Mobile CA)
//!     └── Used for all QUIC/TLS operations
//! ```

pub mod certificate;
pub mod derivation;
pub mod error;
pub mod mobile;
pub mod node;
#[macro_use]
mod macros;

// Re-export key types for convenience
pub use certificate::{CertificateAuthority, CertificateValidator, X509Certificate};
pub use error::{KeyError, Result};
pub use mobile::MobileKeyManager;
pub use node::NodeKeyManager;
// expose profile public key registration convenience re-export

// ---------------------------------------------------------------------------
// Common envelope crypto abstraction (shared with serializer)
// ---------------------------------------------------------------------------
use crate::mobile::EnvelopeEncryptedData;

/// High-level envelope encryption / decryption used by higher layers.
pub trait EnvelopeCrypto: Send + Sync {
    fn encrypt_with_envelope(
        &self,
        data: &[u8],
        network_id: Option<&str>,
        profile_public_keys: Vec<Vec<u8>>,
    ) -> Result<EnvelopeEncryptedData>;

    fn decrypt_envelope_data(&self, env: &EnvelopeEncryptedData) -> Result<Vec<u8>>;
}