Enum KeyPair

pub enum KeyPair {
    Ed25519(KeyPair),
    P256(KeyPair),
}

pair of cryptographic keys used to sign a token’s block

Variants

Ed25519(KeyPair)

P256(KeyPair)

Implementations

impl KeyPair

pub fn new() -> KeyPair

Create a new ed25519 keypair with the default OS RNG

Examples found in repository

examples/token_attenuation.rs (line 12)

fn main() -> Result<(), TokenError> {
    // Generate an example token
    let (token_base64, root_keypair) = generate_example_token()?;
    println!("Original token: {}\n", token_base64);

    // Create a service node keypair
    let service_keypair = KeyPair::new();

    // 1. First, we need the binary token data
    let token_bytes = decode_token(&token_base64)?;

    // 2. Add service node attenuation
    println!("Adding service node attenuation...");
    let attenuated_token = add_service_node_attenuation(
        token_bytes,
        root_keypair.public(),
        "my-service",
        &service_keypair,
    )?;

    // 3. Encode back to base64
    let attenuated_token_base64 = encode_token(&attenuated_token);
    println!("Attenuated token: {}\n", attenuated_token_base64);

    // 4. Verify the attenuated token still works
    println!("Verifying attenuated token...");
    verify_token(
        &attenuated_token_base64,
        root_keypair.public(),
        "alice",
        "resource1",
    )?;
    println!("✅ Verification successful for attenuated token");

    // 5. Generate a chain of attenuations
    println!("\nCreating a chain of attenuations...");
    let token_with_chain = create_attenuation_chain(&token_base64, &root_keypair)?;
    println!("Token with attenuation chain: {}", token_with_chain);

    // 6. Verify the chain token
    println!("\nVerifying token with attenuation chain...");
    verify_token(
        &token_with_chain,
        root_keypair.public(),
        "alice",
        "resource1",
    )?;
    println!("✅ Verification successful for token with attenuation chain");

    Ok(())
}

/// Generate an example token for testing, returning both token and keypair
fn generate_example_token() -> Result<(String, KeyPair), TokenError> {
    // Create a test keypair
    let keypair = KeyPair::new();

    // Create a simple test biscuit with authorization rules
    let biscuit_builder = biscuit!(
        r#"
            // Grant rights to alice for resource1
            right("alice", "resource1", "read");
            right("alice", "resource1", "write");
        "#
    );

    // Build and serialize the token
    let biscuit = biscuit_builder
        .build(&keypair)
        .map_err(TokenError::biscuit_error)?;

    let token_bytes = biscuit.to_vec().map_err(TokenError::biscuit_error)?;

    // Encode to base64 for transmission
    Ok((encode_token(&token_bytes), keypair))
}

/// Create a chain of service attestations
fn create_attenuation_chain(
    token_base64: &str,
    root_keypair: &KeyPair,
) -> Result<String, TokenError> {
    // Decode the original token
    let mut token_bytes = decode_token(token_base64)?;

    // Create service keypairs
    let service_names = ["service-1", "service-2", "service-3"];

    // Add multiple service attestations
    for service_name in service_names.iter() {
        println!("  Adding attestation for {}", service_name);

        // Create a new keypair for this service
        let service_keypair = KeyPair::new();

        // Add an attestation
        token_bytes = add_service_node_attenuation(
            token_bytes,
            root_keypair.public(),
            service_name,
            &service_keypair,
        )?;
    }

    // Encode the final token
    Ok(encode_token(&token_bytes))
}

examples/token_verification.rs (line 9)

fn main() -> Result<(), TokenError> {
    // Generate an example token
    let root_keypair = Arc::new(KeyPair::new());
    let token_base64 = generate_example_token(root_keypair.clone())?;
    println!("Generated token: {}\n", token_base64);

    // Example 1: Basic verification
    println!("Example 1: Basic verification");
    verify_token(&token_base64, root_keypair.public(), "alice", "resource1")?;
    println!("✅ Basic verification successful\n");

    // Example 2: Service chain verification
    println!("Example 2: Service chain verification");

    // Create service node keypairs
    let service1_keypair = KeyPair::new();
    let service1_pk_hex = hex::encode(service1_keypair.public().to_bytes());
    let service1_public_key = format!("ed25519/{}", service1_pk_hex);

    let service2_keypair = KeyPair::new();
    let service2_pk_hex = hex::encode(service2_keypair.public().to_bytes());
    let service2_public_key = format!("ed25519/{}", service2_pk_hex);

    // Define service nodes
    let service_nodes = vec![
        ServiceNode {
            component: "node1".to_string(),
            public_key: service1_public_key.clone(),
        },
        ServiceNode {
            component: "node2".to_string(),
            public_key: service2_public_key.clone(),
        },
    ];

    // Generate a token with service chain
    let chain_token = generate_service_chain_token(
        root_keypair.clone(),
        service1_public_key,
        service2_public_key,
    )?;

    // attenuate the token for node1
    let attenuated_token = add_service_node_attenuation(
        decode_token(&chain_token)?,
        root_keypair.public(),
        "resource1",
        &service1_keypair,
    )?;

    // attenuate the token for node2
    let attenuated_token2 = add_service_node_attenuation(
        attenuated_token,
        root_keypair.public(),
        "resource1",
        &service2_keypair,
    )?;

    // Verify with service chain
    verify_service_chain_token(
        &encode_token(&attenuated_token2),
        root_keypair.public(),
        "alice",
        "resource1",
        service_nodes,
        None,
    )?;
    println!("✅ Service chain verification successful\n");

    // Example 3: Verification with key from string
    println!("Example 3: Verification with key from string");

    // Convert public key to string format and back
    let pk_hex = hex::encode(root_keypair.public().to_bytes());
    let pk_str = format!("ed25519/{}", pk_hex);
    let parsed_pk = biscuit_key_from_string(pk_str)?;

    // Verify with parsed key
    verify_token(&token_base64, parsed_pk, "alice", "resource1")?;
    println!("✅ Verification with key from string successful");

    Ok(())
}

pub fn new_with_algorithm(algorithm: Algorithm) -> KeyPair

Create a new keypair with a chosen algorithm and the default OS RNG

pub fn new_with_rng<T>(algorithm: Algorithm, rng: &mut T) -> KeyPair

where T: RngCore + CryptoRng,

pub fn from(key: &PrivateKey) -> KeyPair

pub fn from_bytes(bytes: &[u8], algorithm: Algorithm) -> Result<KeyPair, Format>

deserializes from a byte array

pub fn sign(&self, data: &[u8]) -> Result<Signature, Format>

pub fn from_private_key_der_with_algorithm( bytes: &[u8], algorithm: Algorithm, ) -> Result<KeyPair, Format>

pub fn from_private_key_der(bytes: &[u8]) -> Result<KeyPair, Format>

pub fn from_private_key_pem_with_algorithm( str: &str, algorithm: Algorithm, ) -> Result<KeyPair, Format>

pub fn from_private_key_pem(str: &str) -> Result<KeyPair, Format>

pub fn to_private_key_der(&self) -> Result<Zeroizing<Vec<u8>>, Format>

pub fn to_private_key_pem(&self) -> Result<Zeroizing<String>, Format>

pub fn private(&self) -> PrivateKey

pub fn public(&self) -> PublicKey

Examples found in repository

examples/token_attenuation.rs (line 21)

fn main() -> Result<(), TokenError> {
    // Generate an example token
    let (token_base64, root_keypair) = generate_example_token()?;
    println!("Original token: {}\n", token_base64);

    // Create a service node keypair
    let service_keypair = KeyPair::new();

    // 1. First, we need the binary token data
    let token_bytes = decode_token(&token_base64)?;

    // 2. Add service node attenuation
    println!("Adding service node attenuation...");
    let attenuated_token = add_service_node_attenuation(
        token_bytes,
        root_keypair.public(),
        "my-service",
        &service_keypair,
    )?;

    // 3. Encode back to base64
    let attenuated_token_base64 = encode_token(&attenuated_token);
    println!("Attenuated token: {}\n", attenuated_token_base64);

    // 4. Verify the attenuated token still works
    println!("Verifying attenuated token...");
    verify_token(
        &attenuated_token_base64,
        root_keypair.public(),
        "alice",
        "resource1",
    )?;
    println!("✅ Verification successful for attenuated token");

    // 5. Generate a chain of attenuations
    println!("\nCreating a chain of attenuations...");
    let token_with_chain = create_attenuation_chain(&token_base64, &root_keypair)?;
    println!("Token with attenuation chain: {}", token_with_chain);

    // 6. Verify the chain token
    println!("\nVerifying token with attenuation chain...");
    verify_token(
        &token_with_chain,
        root_keypair.public(),
        "alice",
        "resource1",
    )?;
    println!("✅ Verification successful for token with attenuation chain");

    Ok(())
}

/// Generate an example token for testing, returning both token and keypair
fn generate_example_token() -> Result<(String, KeyPair), TokenError> {
    // Create a test keypair
    let keypair = KeyPair::new();

    // Create a simple test biscuit with authorization rules
    let biscuit_builder = biscuit!(
        r#"
            // Grant rights to alice for resource1
            right("alice", "resource1", "read");
            right("alice", "resource1", "write");
        "#
    );

    // Build and serialize the token
    let biscuit = biscuit_builder
        .build(&keypair)
        .map_err(TokenError::biscuit_error)?;

    let token_bytes = biscuit.to_vec().map_err(TokenError::biscuit_error)?;

    // Encode to base64 for transmission
    Ok((encode_token(&token_bytes), keypair))
}

/// Create a chain of service attestations
fn create_attenuation_chain(
    token_base64: &str,
    root_keypair: &KeyPair,
) -> Result<String, TokenError> {
    // Decode the original token
    let mut token_bytes = decode_token(token_base64)?;

    // Create service keypairs
    let service_names = ["service-1", "service-2", "service-3"];

    // Add multiple service attestations
    for service_name in service_names.iter() {
        println!("  Adding attestation for {}", service_name);

        // Create a new keypair for this service
        let service_keypair = KeyPair::new();

        // Add an attestation
        token_bytes = add_service_node_attenuation(
            token_bytes,
            root_keypair.public(),
            service_name,
            &service_keypair,
        )?;
    }

    // Encode the final token
    Ok(encode_token(&token_bytes))
}

examples/token_verification.rs (line 15)

fn main() -> Result<(), TokenError> {
    // Generate an example token
    let root_keypair = Arc::new(KeyPair::new());
    let token_base64 = generate_example_token(root_keypair.clone())?;
    println!("Generated token: {}\n", token_base64);

    // Example 1: Basic verification
    println!("Example 1: Basic verification");
    verify_token(&token_base64, root_keypair.public(), "alice", "resource1")?;
    println!("✅ Basic verification successful\n");

    // Example 2: Service chain verification
    println!("Example 2: Service chain verification");

    // Create service node keypairs
    let service1_keypair = KeyPair::new();
    let service1_pk_hex = hex::encode(service1_keypair.public().to_bytes());
    let service1_public_key = format!("ed25519/{}", service1_pk_hex);

    let service2_keypair = KeyPair::new();
    let service2_pk_hex = hex::encode(service2_keypair.public().to_bytes());
    let service2_public_key = format!("ed25519/{}", service2_pk_hex);

    // Define service nodes
    let service_nodes = vec![
        ServiceNode {
            component: "node1".to_string(),
            public_key: service1_public_key.clone(),
        },
        ServiceNode {
            component: "node2".to_string(),
            public_key: service2_public_key.clone(),
        },
    ];

    // Generate a token with service chain
    let chain_token = generate_service_chain_token(
        root_keypair.clone(),
        service1_public_key,
        service2_public_key,
    )?;

    // attenuate the token for node1
    let attenuated_token = add_service_node_attenuation(
        decode_token(&chain_token)?,
        root_keypair.public(),
        "resource1",
        &service1_keypair,
    )?;

    // attenuate the token for node2
    let attenuated_token2 = add_service_node_attenuation(
        attenuated_token,
        root_keypair.public(),
        "resource1",
        &service2_keypair,
    )?;

    // Verify with service chain
    verify_service_chain_token(
        &encode_token(&attenuated_token2),
        root_keypair.public(),
        "alice",
        "resource1",
        service_nodes,
        None,
    )?;
    println!("✅ Service chain verification successful\n");

    // Example 3: Verification with key from string
    println!("Example 3: Verification with key from string");

    // Convert public key to string format and back
    let pk_hex = hex::encode(root_keypair.public().to_bytes());
    let pk_str = format!("ed25519/{}", pk_hex);
    let parsed_pk = biscuit_key_from_string(pk_str)?;

    // Verify with parsed key
    verify_token(&token_base64, parsed_pk, "alice", "resource1")?;
    println!("✅ Verification with key from string successful");

    Ok(())
}

pub fn algorithm(&self) -> Algorithm

Trait Implementations

impl Debug for KeyPair

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for KeyPair

fn default() -> KeyPair

Returns the “default value” for a type.

impl PartialEq for KeyPair

fn eq(&self, other: &KeyPair) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for KeyPair