Crate ic_vetkeys 

Internet Computer (IC) vetKeys

This crate contains a set of tools designed to help canister developers integrate vetKeys into their Internet Computer (ICP) applications.

The current Minimum Supported Rust Version (MSRV) of this crate is 1.85. Any future increase in the MSRV will be accompanied by a bump in the minor version number.

Key Manager

A canister library for derivation of encrypted vetkeys from arbitrary strings. It can be used in combination with the frontend key manager library.

Encrypted Maps

An efficient canister library facilitating access control and encrypted storage for a collection of maps contatining key-value pairs. It can be used in combination with the frontend encrypted maps library.

Ready-made EncryptedMaps canister

The export_encrypted_maps_canister! macro generates a complete EncryptedMaps canister — the #[init]/#[post_upgrade], the stable state, and every endpoint the @icp-sdk/vetkeys frontend expects — in a few lines instead of ~200 of hand-written boilerplate:

ic_vetkeys::export_encrypted_maps_canister!(
    "my_app_domain_separator",
    [memory(0), memory(1), memory(2), memory(3)],
);
ic_cdk::export_candid!();

If your canister keeps state linked to each value (e.g. a metadata row per entry) and must own the value read/write endpoints, pass custom_value_endpoints: the macro then generates the control-plane endpoints, state, lifecycle hooks, and with_encrypted_maps/with_encrypted_maps_mut accessors, but omits the value endpoints so you can provide your own. See the macro documentation for the full setup and rationale.

Utils

For obtaining and decrypting verifiably-encrypted threshold keys via the Internet Computer vetKD system API. The API is located in the crate root.

Cross-language library

If Motoko better suits your needs, take a look at the Motoko equivalent of this library.

Modules

encrypted_maps

See EncryptedMaps for the main documentation.

key_manager

See KeyManager for the main documentation.

management_canister

This module contains functions for calling the ICP management canister’s vetkd_derive_key endpoint from within a canister.

types

Macros

export_encrypted_maps_canister

Generates an EncryptedMaps canister in the calling crate.

Structs

DerivedKeyMaterial

Key material derived from a VetKey

DerivedPublicKey

A derived public key

EncryptedVetKey

An encrypted VetKey

IbeCiphertext

An IBE (identity based encryption) ciphertext

IbeIdentity

An identity, used for identity based encryption (IBE)

IbeSeed

A random seed, used for identity based encryption

MasterPublicKey

A master VetKD public key

TransportSecretKey

Secret key of the transport key pair

VetKey

A verifiably encrypted threshold key derived by the VetKD protocol

VrfOutput

VRF (Verifiable Random Function) Output

Enums

DecryptionError

An error while decrypting

EncryptedVetKeyDeserializationError

Error indicating that deserializing an encrypted key failed

EncryptionError

An error while encrypting

InvalidVrfOutput

An error occured while decoding or checking a VrfOutput

PublicKeyDeserializationError

Error indicating deserializing a derived public key failed

Functions

derive_symmetric_key

Derive a symmetric key using HKDF-SHA256

is_valid_transport_public_key_encoding

Return true iff the argument is a valid encoding of a transport public key

verify_bls_signature

Verify an augmented BLS signature