1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
// GENERATED by `tf-schema codegen --target rust` — DO NOT EDIT BY HAND.
#![allow(unused_imports, non_camel_case_types, non_snake_case, clippy::all)]
use serde::{Deserialize, Serialize};
use super::*;
/// One encrypted entry.
#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
pub struct VaultEntry {
/// Stable identifier for this entry within the vault.
pub id: String,
/// What the key is used for.
pub purpose: VaultEntry_Purpose,
/// Algorithm this key targets, e.g. ed25519.
pub algorithm: AlgorithmId,
/// Base64-encoded 12-byte AEAD nonce.
pub nonce: String,
/// Base64-encoded AEAD ciphertext (includes 16-byte tag).
pub ciphertext: String,
/// When this entry was written.
pub created_at: Timestamp,
}
/// What the key is used for.
#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
pub enum VaultEntry_Purpose {
#[serde(rename = "signing")]
Signing,
#[serde(rename = "kem")]
Kem,
#[serde(rename = "attestation")]
Attestation,
#[serde(rename = "raw")]
Raw,
}
/// Passphrase-encrypted key vault on disk. KDF = Argon2id, cipher = ChaCha20-Poly1305.
#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
pub struct VaultFile {
/// Version of the vault file schema itself.
pub vault_version: VaultFile_VaultVersion,
/// Key-derivation parameters used to turn the passphrase into the 32-byte wrap key.
pub kdf: VaultFile_Kdf,
/// AEAD cipher used to seal each entry.
pub cipher: VaultFile_Cipher,
/// Encrypted entries. Each entry's ciphertext decrypts under the wrap key to raw key bytes.
pub entries: Vec<VaultEntry>,
}
/// AEAD cipher used to seal each entry.
#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
pub struct VaultFile_Cipher {
/// AEAD algorithm. Only ChaCha20-Poly1305 is supported in this phase.
pub algorithm: String,
}
/// Key-derivation parameters used to turn the passphrase into the 32-byte wrap key.
#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
pub struct VaultFile_Kdf {
/// KDF algorithm. Only Argon2id is supported in this phase.
pub algorithm: String,
/// Base64-encoded Argon2id salt (at least 16 bytes).
pub salt: String,
/// Memory cost in KiB.
pub m_cost: i64,
/// Iteration count.
pub t_cost: i64,
/// Parallelism factor.
pub p_cost: i64,
}
/// Version of the vault file schema itself.
#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
pub enum VaultFile_VaultVersion {
#[serde(rename = "1")]
V1,
}