Struct SecretBundle 

pub struct SecretBundle {
    pub iroh_secret_key: [u8; 32],
    pub ipns_secret_key: [u8; 32],
    pub did_signing_key: [u8; 32],
    pub did_encryption_key: [u8; 32],
    /* private fields */
}

Standard and user-defined 32-byte secret keys for a ma daemon identity.

All key material is zeroed from memory when this struct is dropped.

Adding custom keys

use ma_core::config::SecretBundle;

// Generate a fresh bundle.
let mut bundle = SecretBundle::generate();

// Generate and store a new random key:
bundle.generate_key("my_service_key")?;

// Or store an existing 32-byte key:
let key_bytes = [0u8; 32];
bundle.add_key("other_key", key_bytes)?;

// Retrieve it:
let key = bundle.get_key("my_service_key").expect("key not found");

// Encrypt in-memory and decrypt again:
let encrypted = bundle.encrypt("passphrase")?;
let restored = SecretBundle::decrypt(&encrypted, "passphrase")?;
assert_eq!(bundle.iroh_secret_key, restored.iroh_secret_key);

Fields

iroh_secret_key: [u8; 32]

iroh QUIC transport secret key.

ipns_secret_key: [u8; 32]

IPNS publishing secret key.

did_signing_key: [u8; 32]

DID document signing key (Ed25519).

did_encryption_key: [u8; 32]

DID document encryption key (X25519).

Implementations

impl SecretBundle

pub fn generate() -> Self

Generate a new bundle with four random standard keys and no extra keys.

pub fn add_key(&mut self, name: &str, key: [u8; 32]) -> Result<()>

Store a named 32-byte key in this bundle.

Returns an error if name collides with a reserved standard key name or is empty.

pub fn generate_key(&mut self, name: &str) -> Result<[u8; 32]>

Generate a random 32-byte key, store it under name, and return it.

Returns an error if name is invalid (see add_key).

pub fn get_key(&self, name: &str) -> Option<&[u8; 32]>

Retrieve a named extra key, or None if it does not exist.

pub fn remove_key(&mut self, name: &str) -> Option<[u8; 32]>

Remove a named extra key from the bundle.

pub fn extra_key_names(&self) -> impl Iterator<Item = &str>

Iterate over all extra key names.

pub fn encrypt(&self, passphrase: &str) -> Result<Vec<u8>>

Encrypt this bundle with passphrase and return the binary blob.

A fresh random salt and nonce are generated for each call.

pub fn decrypt(data: &[u8], passphrase: &str) -> Result<Self>

Decrypt a bundle from the on-disk binary format.

Returns Err(Error::Secrets) on authentication failure (wrong passphrase or corrupted data) without revealing which it was.

pub fn load(path: &Path, passphrase: &str) -> Result<Self>

Load and decrypt a bundle from a file.

pub fn save(&self, path: &Path, passphrase: &str) -> Result<()>

Encrypt this bundle and write it to path with 0600 permissions.

pub fn generate_passphrase() -> String

Generate a random alphanumeric passphrase (43 characters ≈ 256 bits entropy).

pub fn generate_identity(&self) -> Result<GeneratedIdentity>

Derive the DID identity from this bundle’s ipns_secret_key.

Calls ma_did::generate_identity_from_secret with the bundle’s IPNS key so callers do not need to handle the IPNS/PeerId derivation themselves.

Trait Implementations

impl Clone for SecretBundle

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Drop for SecretBundle

fn drop(&mut self)

Executes the destructor for this type.