Enum MurkIdentity 

pub enum MurkIdentity {
    Age(Identity),
    Ssh {
        identity: Identity,
        pem: Zeroizing<String>,
    },
    Plugin {
        identity: Identity,
        pubkey: String,
    },
}

An identity that can decrypt age-encrypted data.

Plugin identities (AGE-PLUGIN-<NAME>-1...) carry the recipient pubkey alongside the pointer so pubkey_string does not require spawning the plugin binary. Decryption spawns age-plugin-<name> via IdentityPluginV1 to access the hardware-backed key.

Variants

Age(Identity)

Ssh

Fields

identity: Identity

pem: Zeroizing<String>

The original OpenSSH private-key text. age does not expose the SSH signing scalar, so we retain the PEM to derive an Ed25519 signing key for vault signing (ssh-ed25519 only). Zeroized on drop.

Plugin

Fields

identity: Identity

pubkey: String

Implementations

impl MurkIdentity

pub fn pubkey_string(&self) -> Result<String, CryptoError>

Return the public key string for this identity.

For age keys: age1.... For SSH keys: ssh-ed25519 AAAA... or ssh-rsa AAAA.... For plugin keys: the age1<plugin>1... recipient that was parsed from the identity file’s recipient header (# Recipient: or # public key:).

pub fn plugin_name(&self) -> Option<&str>

Plugin name (e.g. "yubikey", "se") if this is a plugin identity.

pub fn is_signing_capable(&self) -> bool

Whether this identity can produce vault signatures: native age keys, and ssh-ed25519 keys (which sign natively). ssh-rsa and hardware/plugin identities cannot. Cheap check for deciding whether to nudge on an unsigned vault; the actual key comes from Self::signing_key.

pub fn registers_verifying_key(&self) -> bool

Whether this identity’s verifying key must be recorded in the signer registry (Meta::signers) for its signature to be verifiable.

Only age keys: their Ed25519 verifying key is derived from the secret and cannot be recovered from the public age recipient, so it must be published. ssh-ed25519 verifying keys are embedded in the recipient string itself, so they are self-authenticating and are NOT registered.

pub fn signing_key(&self) -> Option<SigningKey>

This identity’s Ed25519 signing key, if it can sign.

• Age keys: derived from the raw x25519 key bytes via a domain-separated KDF (see crate::signing), so it recovers from the BIP39 phrase.
• ssh-ed25519 keys: the SSH key is an Ed25519 signing key; we parse it from the retained OpenSSH PEM (age does not expose the scalar). The resulting verifying key matches the ssh-ed25519 … recipient string.
• ssh-rsa and plugin/hardware identities return None (unsigned).

Trait Implementations

impl Clone for MurkIdentity

fn clone(&self) -> MurkIdentity

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for MurkIdentity

Debug prints only the identity kind, never key material, to keep accidental logs from leaking secrets.

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.