KeyStore

_hope_core::crypto

Trait KeyStore 

Source 
pub trait KeyStore: Send + Sync {
    // Required methods
    fn sign(&self, data: &[u8]) -> Result<Vec<u8>>;
    fn verify(&self, data: &[u8], signature: &[u8]) -> Result<()>;
    fn public_key_bytes(&self) -> Vec<u8> ⓘ;

    // Provided method
    fn identifier(&self) -> String { ... }
}
Expand description

Trait for cryptographic key storage backends

This abstraction allows Hope Genome to support multiple key storage mechanisms without changing the core logic:

  • SoftwareKeyStore: Keys stored in memory (testing, dev)
  • HsmKeyStore: Keys stored in Hardware Security Module (production)
  • TeeKeyStore: Keys stored in Trusted Execution Environment (production)
  • Future: YubiKey, TPM, AWS CloudHSM, Azure Key Vault, etc.

§Security Requirements

Implementations MUST:

  1. Use constant-time operations to prevent timing attacks
  2. Protect private keys from unauthorized access
  3. Support Ed25519 signature scheme (or compatible)
  4. Be thread-safe (Send + Sync)

§Example

use _hope_core::crypto::{KeyStore, SoftwareKeyStore};

fn sign_decision(store: &dyn KeyStore, decision: &[u8]) -> Vec<u8> {
    store.sign(decision).expect("Signing failed")
}

Required Methods§

Source

fn sign(&self, data: &[u8]) -> Result<Vec<u8>>

Sign data with the private key

§Arguments
  • data - Data to sign (will be hashed internally for some schemes)
§Returns
  • Ed25519: 64-byte signature
  • Errors if signing fails (HSM unavailable, etc.)
Source

fn verify(&self, data: &[u8], signature: &[u8]) -> Result<()>

Verify signature with the public key

§Arguments
  • data - Original data that was signed
  • signature - Signature to verify
§Returns
  • Ok(()) if signature is valid
  • Err(InvalidSignature) if signature is invalid or tampered
Source

fn public_key_bytes(&self) -> Vec<u8> ⓘ

Get the public key bytes (for export, verification by others)

§Returns
  • Ed25519: 32 bytes (compressed public key)

Provided Methods§

Source

fn identifier(&self) -> String

Get a human-readable identifier for this key store

Examples: “SoftwareKeyStore”, “HSM:YubiKey-5C”, “AWS-KMS:key-123”

Implementors§