Struct SecretBundle 

pub struct SecretBundle {
    pub iroh_secret_key: [u8; 32],
    pub ipns_secret_key: [u8; 32],
    pub did_signing_key: [u8; 32],
    pub did_encryption_key: [u8; 32],
    /* private fields */
}

Standard and user-defined 32-byte secret keys for a ma daemon identity.

All key material is zeroed from memory when this struct is dropped.

Adding custom keys

use ma_core::config::SecretBundle;

// Generate a fresh bundle.
let mut bundle = SecretBundle::generate();

// Generate and store a new random key:
bundle.generate_key("my_service_key")?;

// Or store an existing 32-byte key:
let key_bytes = [0u8; 32];
bundle.add_key("other_key", key_bytes)?;

// Retrieve it:
let key = bundle.get_key("my_service_key").expect("key not found");

// Encrypt in-memory and decrypt again:
let encrypted = bundle.encrypt("passphrase")?;
let restored = SecretBundle::decrypt(&encrypted, "passphrase")?;
assert_eq!(bundle.iroh_secret_key, restored.iroh_secret_key);

Fields

iroh_secret_key: [u8; 32]

iroh QUIC transport secret key.

ipns_secret_key: [u8; 32]

IPNS publishing secret key.

did_signing_key: [u8; 32]

DID document signing key (Ed25519).

did_encryption_key: [u8; 32]

DID document encryption key (X25519).

Implementations

impl SecretBundle

pub fn generate() -> Self

Generate a new bundle with four random standard keys and no extra keys.

pub fn add_key(&mut self, name: &str, key: [u8; 32]) -> Result<()>

Store a named 32-byte key in this bundle.

Returns an error if name collides with a reserved standard key name or is empty.

pub fn generate_key(&mut self, name: &str) -> Result<[u8; 32]>

Generate a random 32-byte key, store it under name, and return it.

Returns an error if name is invalid (see add_key).

pub fn get_key(&self, name: &str) -> Option<&[u8; 32]>

Retrieve a named extra key, or None if it does not exist.

pub fn remove_key(&mut self, name: &str) -> Option<[u8; 32]>

Remove a named extra key from the bundle.

pub fn extra_key_names(&self) -> impl Iterator<Item = &str>

Iterate over all extra key names.

pub fn encrypt(&self, passphrase: &str) -> Result<Vec<u8>>

Encrypt this bundle with passphrase and return the binary blob.

A fresh random salt and nonce are generated for each call.

pub fn decrypt(data: &[u8], passphrase: &str) -> Result<Self>

Decrypt a bundle from the on-disk binary format.

Returns Err(Error::Secrets) on authentication failure (wrong passphrase or corrupted data) without revealing which it was.

pub fn load(path: &Path, passphrase: &str) -> Result<Self>

Load and decrypt a bundle from a file.

pub fn save(&self, path: &Path, passphrase: &str) -> Result<()>

Encrypt this bundle and write it to path with 0600 permissions.

pub fn generate_passphrase() -> String

Generate a random alphanumeric passphrase (43 characters ≈ 256 bits entropy).

pub fn generate_identity(&self) -> Result<GeneratedIdentity>

Derive the DID identity deterministically from all four bundle keys.

Unlike crate::generate_identity_from_secret this method uses the bundle’s own did_signing_key and did_encryption_key instead of generating fresh random keys, so the resulting document is identical on every call with the same bundle — safe to use across daemon restarts.

Verification method IDs use fixed fragments #sign and #enc.

pub fn build_document(&self, ext: MaExtension) -> Result<Document>

Build a complete, signed crate::Document from this bundle and a crate::MaExtension.

This is the recommended single entry point for constructing a ready-to-publish DID document:

1. Generates the deterministic base identity from the bundle keys.
2. Applies the caller-supplied extension (services, type, custom fields).
3. Re-signs the document so the proof covers the extension data.

Example

let ma = endpoint.ma_extension().kind("world");
let document = bundle.build_document(ma)?;

pub fn signing_key(&self) -> Result<SigningKey>

Derive the crate::SigningKey for this bundle.

The returned key matches the #sign verification method in any document produced by Self::build_document or Self::generate_identity. Use it to sign crate::Message objects after the document is built.

Trait Implementations

impl Clone for SecretBundle

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Drop for SecretBundle

fn drop(&mut self)

Executes the destructor for this type.

fn pin_drop(self: Pin<&mut Self>)

🔬This is a nightly-only experimental API. (pin_ergonomics)

Execute the destructor for this type, but different to Drop::drop, it requires self to be pinned.