key_vault/
lib.rs

1//! # key-vault
2//!
3//! ENTERPRISE-GRADE KEY MANAGEMENT VAULT
4//!
5//! 9-layer defense-in-depth in-memory key storage. Fragmented across non-contiguous
6//! mlock'd allocations, interleaved with self-referential decoy bytes, optionally
7//! transformed through a codex layer, with constant-time operations, zero-on-drop,
8//! security monitoring, and audit logging.
9//!
10//! # The 9 Layers (plus bonus Layer 10)
11//!
12//! 1. **Secure Acquisition** ([`KeyFetch`] trait — TPM/HSM/Keychain/File/Env)
13//! 2. **Memory Page Locking** (`mlock` / `VirtualLock` — prevents swap)
14//! 3. **Fragment Strategy** ([`FragmentStrategy`] — variable chunks, shuffled, non-contiguous)
15//! 4. **Decoy Bytes** ([`DecoyStrategy`] — self-referential filler, statistically indistinguishable)
16//! 5. **Codex Transformation** ([`Codex`] — byte swap via involution)
17//! 6. **Constant-Time Operations** (`subtle::ConstantTimeEq`)
18//! 7. **Zero-On-Drop** (`zeroize` crate)
19//! 8. **Security Monitor** ([`SecurityMonitor`] — failed decrypt detection, threshold lockout)
20//! 9. **Audit Logging** (every key access tracked)
21//! 10. **(Bonus) Page Protection Toggling** (PROT_NONE when not in use)
22//!
23//! See `docs/SECURITY.md` for the full architecture and `docs/TRANSFORMATION.md`
24//! for a visual walkthrough.
25//!
26//! # Status
27//!
28//! Phase 0.2.0 — foundation types defined. [`KeyHandle`], [`KeyVault`],
29//! [`KeyVaultBuilder`], the five core traits, [`IdentityCodex`], and
30//! [`tee::detect_tee_capabilities`] are in place. Real fragmentation, mlock,
31//! decoy, and zeroize land in Phases 0.3 and 0.4. See `.dev/ROADMAP.md` for
32//! the full milestone plan.
33//!
34//! # License
35//!
36//! Dual-licensed under Apache-2.0 OR MIT.
37
38#![doc(html_root_url = "https://docs.rs/key-vault")]
39#![cfg_attr(docsrs, feature(doc_cfg))]
40#![cfg_attr(not(feature = "std"), no_std)]
41#![deny(missing_docs)]
42#![deny(unsafe_op_in_unsafe_fn)]
43#![deny(unused_must_use)]
44#![deny(unused_results)]
45#![deny(clippy::unwrap_used)]
46#![deny(clippy::expect_used)]
47#![deny(clippy::todo)]
48#![deny(clippy::unimplemented)]
49#![deny(clippy::print_stdout)]
50#![deny(clippy::print_stderr)]
51#![deny(clippy::dbg_macro)]
52#![deny(clippy::undocumented_unsafe_blocks)]
53#![deny(clippy::missing_safety_doc)]
54#![warn(clippy::pedantic)]
55#![allow(clippy::module_name_repetitions)]
56
57extern crate alloc;
58
59pub mod audit;
60pub mod codex;
61pub mod decoy;
62mod error;
63pub mod fetcher;
64pub mod fragment;
65mod handle;
66mod memory;
67mod metadata;
68pub mod monitor;
69mod normalize;
70pub mod tee;
71mod vault;
72
73#[cfg(feature = "monitor-tracing")]
74pub use crate::audit::LogAudit;
75pub use crate::audit::{AccessKind, AuditEvent, AuditSink, NoAudit};
76pub use crate::codex::{Codex, DynamicCodex, IdentityCodex, StaticCodex};
77pub use crate::decoy::{DecoyStrategy, KeyDerivedDecoy, RandomDecoy, SelfReferenceDecoy};
78pub use crate::error::{Error, Result};
79#[cfg(feature = "fetcher-env")]
80pub use crate::fetcher::EnvFetch;
81#[cfg(feature = "fetcher-file")]
82pub use crate::fetcher::FileFetch;
83#[cfg(feature = "fetcher-keychain")]
84pub use crate::fetcher::KeychainFetch;
85#[cfg(feature = "fetcher-tpm")]
86pub use crate::fetcher::TpmFetch;
87pub use crate::fetcher::{FetchContext, KeyFetch, RawKey};
88pub use crate::fragment::{
89    FragmentStrategy, Fragments, InterleavedFragmenter, LayeredFragmenter, RandomFragmenter,
90    StandardFragmenter,
91};
92pub use crate::handle::{KeyHandle, KeyId};
93pub use crate::metadata::{AlgorithmHint, KeyMetadata};
94#[cfg(feature = "monitor-tracing")]
95pub use crate::monitor::LogMonitor;
96pub use crate::monitor::{
97    AccessContext, CompositeMonitor, FailureContext, NoMonitor, SecurityMonitor, ThresholdContext,
98};
99pub use crate::vault::{KeyVault, KeyVaultBuilder, VaultConfig};
100
101/// Crate version string, populated by Cargo at build time.
102pub const VERSION: &str = env!("CARGO_PKG_VERSION");
key_vault/lib.rs

key_vault/
lib.rs
