Struct DeviceIdentity 

pub struct DeviceIdentity { /* private fields */ }

A device’s cryptographic identity

Contains an Ed25519 signing key and derives a unique NodeId from it. The private key should be stored securely (platform secure enclave if available).

Implementations

impl DeviceIdentity

pub fn generate() -> Self

Generate a new random device identity

Uses the platform’s cryptographically secure random number generator.

pub fn from_private_key(private_key: &[u8; 32]) -> Result<Self, IdentityError>

Create identity from existing private key bytes

Arguments

• private_key - 32-byte Ed25519 private key

Returns

• Ok(DeviceIdentity) - If key is valid
• Err(IdentityError) - If key format is invalid

pub fn private_key_bytes(&self) -> [u8; 32]

Get the private key bytes for secure storage

Security: This exposes the private key. Only use for persisting to secure storage (keychain, secure enclave, encrypted NVS).

pub fn public_key(&self) -> [u8; 32]

Get the public key bytes

This can be shared freely to allow others to verify signatures.

pub fn verifying_key(&self) -> VerifyingKey

Get the verifying key for signature verification

pub fn node_id(&self) -> NodeId

Derive the NodeId from the public key

The NodeId is the first 4 bytes of the BLAKE3 hash of the public key, interpreted as a little-endian u32. This provides:

• Deterministic derivation (same key = same node_id)
• Collision resistance (BLAKE3 is cryptographically secure)
• Compact representation (4 bytes vs 32 bytes)

pub fn sign(&self, message: &[u8]) -> [u8; 64]

Sign a message

Arguments

• message - Arbitrary bytes to sign

Returns

64-byte Ed25519 signature

pub fn verify(&self, message: &[u8], signature: &[u8; 64]) -> bool

Verify a signature made by this identity

Arguments

• message - Original message that was signed
• signature - 64-byte signature to verify

Returns

true if signature is valid, false otherwise

pub fn create_attestation(&self, timestamp_ms: u64) -> IdentityAttestation

Create an identity attestation

An attestation proves that the holder of this identity controls the claimed node_id at a specific point in time.

Trait Implementations

impl Clone for DeviceIdentity

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for DeviceIdentity

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.