Enum UserKey 

pub enum UserKey {
    X25519(Identity),
    Pq(Identity),
}

One user’s encryption key (the private half).

Variants

X25519(Identity)

An age X25519 key: classic, for classic repositories (the opt-out).

Pq(Identity)

age’s hybrid ML-KEM-768 + X25519 key, for quantum-safe repositories: what a new key is unless asked otherwise (Level::NEW).

Implementations

impl UserKey

pub fn generate(level: Level) -> Result<UserKey, UserKeyError>

A new user key for repositories of level (Level::NEW unless the person asked for a classic one).

pub fn public(&self) -> String

The public half: what a members line and the server hold (age1…, or age1pq1…).

pub fn level(&self) -> Level

The level of repositories this key can be a member of.

pub fn identity(&self) -> &dyn Identity

As an age identity: what opens a repository’s key ring.

pub fn wrap_to(&self, recipient: &dyn Recipient) -> Result<String, UserKeyError>

Wrap this key to one unlock method’s age recipient: one armored age file, to be stored on the server as the method’s wrap.

pub fn wrap_to_security_key( &self, recipient: &str, ) -> Result<String, UserKeyError>

Wrap this key to a security key’s recipient (the age1… string security_key::recipient gave at enrolment).

pub fn wrap_to_security_key_v2( &self, prf_output: &[u8; 32], credential_id: &[u8], ) -> Result<String, UserKeyError>

Wrap this key to a security key, v2 (CRYPT-PQ-SK): a fresh 32-byte salt, HKDF-SHA256(salt, prf_output, "gunnar-crypt user-key wrap v2") as the key, XChaCha20-Poly1305 with a fresh nonce over the key’s payload, the credential id bound in the associated data. Symmetric, so quantum-safe; no X25519 step.

pub fn wrap_to_recovery_code(&self, code: &str) -> Result<String, UserKeyError>

Wrap this key to a printed recovery code: age’s scrypt stanza at the FIXED work factor recovery_code::LOG_N (scrypt N = 2^18, r = 8, p = 1: about 256 MiB and a second), on top of the code’s 160 random bits.

pub fn wrap_to_ssh(&self, public_key: &str) -> Result<String, UserKeyError>

Wrap this key to an SSH public key line (ssh-ed25519 …, ssh-rsa …). The wrap is age’s SSH stanza (X25519 for ed25519, RSA-OAEP for RSA): CLASSICAL, also for a quantum-safe key (SSH_WRAP_IS_CLASSICAL).

pub fn wrap_to_pq(&self, public_key: &str) -> Result<String, UserKeyError>

Wrap this key to an age1pq1… key (a key file made by gunnar crypt keygen).

Trait Implementations

impl Debug for UserKey

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.