key_vault/
lib.rs

1//! # key-vault
2//!
3//! ENTERPRISE-GRADE KEY MANAGEMENT VAULT
4//!
5//! 9-layer defense-in-depth in-memory key storage. Fragmented across non-contiguous
6//! mlock'd allocations, interleaved with self-referential decoy bytes, optionally
7//! transformed through a codex layer, with constant-time operations, zero-on-drop,
8//! security monitoring, and audit logging.
9//!
10//! # The 9 Layers (plus bonus Layer 10)
11//!
12//! 1. **Secure Acquisition** ([`KeyFetch`] trait — TPM/HSM/Keychain/File/Env)
13//! 2. **Memory Page Locking** (`mlock` / `VirtualLock` — prevents swap)
14//! 3. **Fragment Strategy** ([`FragmentStrategy`] — variable chunks, shuffled, non-contiguous)
15//! 4. **Decoy Bytes** ([`DecoyStrategy`] — self-referential filler, statistically indistinguishable)
16//! 5. **Codex Transformation** ([`Codex`] — byte swap via involution)
17//! 6. **Constant-Time Operations** (`subtle::ConstantTimeEq`)
18//! 7. **Zero-On-Drop** (`zeroize` crate)
19//! 8. **Security Monitor** ([`SecurityMonitor`] — failed decrypt detection, threshold lockout)
20//! 9. **Audit Logging** (every key access tracked)
21//! 10. **(Bonus) Page Protection Toggling** (PROT_NONE when not in use)
22//!
23//! See `docs/SECURITY.md` for the full architecture and `docs/TRANSFORMATION.md`
24//! for a visual walkthrough.
25//!
26//! # Status
27//!
28//! Phase 0.2.0 — foundation types defined. [`KeyHandle`], [`KeyVault`],
29//! [`KeyVaultBuilder`], the five core traits, [`IdentityCodex`], and
30//! [`tee::detect_tee_capabilities`] are in place. Real fragmentation, mlock,
31//! decoy, and zeroize land in Phases 0.3 and 0.4. See `.dev/ROADMAP.md` for
32//! the full milestone plan.
33//!
34//! # License
35//!
36//! Dual-licensed under Apache-2.0 OR MIT.
37
38#![doc(html_root_url = "https://docs.rs/key-vault")]
39#![cfg_attr(docsrs, feature(doc_cfg))]
40#![cfg_attr(not(feature = "std"), no_std)]
41#![deny(missing_docs)]
42#![deny(unsafe_op_in_unsafe_fn)]
43#![deny(unused_must_use)]
44#![deny(unused_results)]
45#![deny(clippy::unwrap_used)]
46#![deny(clippy::expect_used)]
47#![deny(clippy::todo)]
48#![deny(clippy::unimplemented)]
49#![deny(clippy::print_stdout)]
50#![deny(clippy::print_stderr)]
51#![deny(clippy::dbg_macro)]
52#![deny(clippy::undocumented_unsafe_blocks)]
53#![deny(clippy::missing_safety_doc)]
54#![warn(clippy::pedantic)]
55#![allow(clippy::module_name_repetitions)]
56
57extern crate alloc;
58
59pub mod codex;
60pub mod decoy;
61mod error;
62pub mod fetcher;
63pub mod fragment;
64mod handle;
65mod memory;
66mod metadata;
67pub mod monitor;
68mod normalize;
69pub mod tee;
70mod vault;
71
72pub use crate::codex::{Codex, DynamicCodex, IdentityCodex, StaticCodex};
73pub use crate::decoy::{DecoyStrategy, KeyDerivedDecoy, RandomDecoy, SelfReferenceDecoy};
74pub use crate::error::{Error, Result};
75#[cfg(feature = "fetcher-env")]
76pub use crate::fetcher::EnvFetch;
77#[cfg(feature = "fetcher-file")]
78pub use crate::fetcher::FileFetch;
79#[cfg(feature = "fetcher-keychain")]
80pub use crate::fetcher::KeychainFetch;
81#[cfg(feature = "fetcher-tpm")]
82pub use crate::fetcher::TpmFetch;
83pub use crate::fetcher::{FetchContext, KeyFetch, RawKey};
84pub use crate::fragment::{
85    FragmentStrategy, Fragments, InterleavedFragmenter, LayeredFragmenter, RandomFragmenter,
86    StandardFragmenter,
87};
88pub use crate::handle::{KeyHandle, KeyId};
89pub use crate::metadata::{AlgorithmHint, KeyMetadata};
90#[cfg(feature = "monitor-tracing")]
91pub use crate::monitor::LogMonitor;
92pub use crate::monitor::{
93    AccessContext, CompositeMonitor, FailureContext, NoMonitor, SecurityMonitor, ThresholdContext,
94};
95pub use crate::vault::{KeyVault, KeyVaultBuilder, VaultConfig};
96
97/// Crate version string, populated by Cargo at build time.
98pub const VERSION: &str = env!("CARGO_PKG_VERSION");
key_vault/lib.rs

key_vault/
lib.rs
