Struct ArkSide 

pub struct ArkSide<R: Read, W: Write, A: Attester> { /* private fields */ }

Ark side of the wire, an encrypted transport for serving protobuf requests from a connected host. It waits for session resets (empty frames), responds to handshake and afterward decrypts inbound and encrypts outbound messages.

The device attestation is not interpreted by the wire, it is provided by an Attester and forwarded to the host verbatim.

Implementations

impl<R: Read, W: Write, A: Attester> ArkSide<R, W, A>

pub fn new(reader: R, writer: W, signer: SecretKey, attester: A) -> Self

Creates a new Ark side around a low level reader and writer. The signer is the Ark’s identity key, which signs the handshake; the host verifies that signature against the key it extracts from the attestation, so the two must match. Reads block per the transport’s semantics, so any timeout must be configured on the reader passed in.

pub fn next_message(&mut self) -> Result<HostToArk, Error>

Serves the next host-to-ark message, decrypting and protobuf decoding it. Empty frames are session resets and run the handshake inline; junk outside a session, undecryptable packets and failed handshakes are logged and skipped, so only transport failures and malformed messages surface as errors.

pub fn send_message(&mut self, res: ArkToHost) -> Result<(), Error>

Protobuf encodes an ark-to-host message, seals it with the session and sends it. Fails without an active session, and a failure after sealing drops the session, as the host’s HPKE sequence can no longer be caught up with.