Crate ockam_vault

In order to support a variety of cryptographically capable hardware we maintain loose coupling between our protocols and how a specific building block is invoked in a specific hardware. This is achieved using an abstract Vault trait.

A concrete implementation of the Vault trait is called an Ockam Vault. Over time, and with help from the Ockam open source community, we plan to add vaults for several TEEs, TPMs, HSMs, and Secure Enclaves.

This crate provides a software-only Vault implementation that can be used when no cryptographic hardware is available. The primary Ockam crate uses this as the default Vault implementation.

The main [Ockam][main-ockam-crate-link] has optional dependency on this crate.

Modules

legacy

Backwards compatibility storage formats

storage

Storage

Structs

AeadSecret

AEAD Secret.

AeadSecretKeyHandle

Handle to an AES-256 Secret Key.

Aes256GcmSecretKeyHandle

Handle to an AES-256 Secret Key.

BufferSecret

Buffer with sensitive data, like HKDF output.

ECDSASHA256CurveP256PublicKey

A Curve P-256 Public Key that is only used for ECDSA SHA256 signatures.

ECDSASHA256CurveP256SecretKey

ECDSASHA256CurveP256 Secret Key.

ECDSASHA256CurveP256Signature

An ECDSA Signature using SHA256 and Curve P-256.

EdDSACurve25519PublicKey

A Curve25519 Public Key that is only used for EdDSA signatures.

EdDSACurve25519SecretKey

EdDSACurve25519 Secret Key.

EdDSACurve25519Signature

An EdDSA Signature using Curve25519.

HandleToSecret

Implementation-specific arbitrary vector of bytes that allows a concrete Vault implementation to address a specific secret that it stores.

HashOutput

Hash used for Noise handshake.

HkdfOutput

HKDF Output.

SecretBufferHandle

A handle to a secret Buffer (like an HKDF output).

Sha256HkdfOutput

SHA-256 HKDF Output.

Sha256Output

SHA-256 Output.

SoftwareVaultForSecureChannels

[SecureChannelVault] implementation using software

SoftwareVaultForSigning

[SigningVault] implementation using software

SoftwareVaultForVerifyingSignatures

[VaultForSigning] implementation using software

X25519PublicKey

X25519 Public Key is used for ECDH.

X25519SecretKey

X25519 Secret Key.

X25519SecretKeyHandle

A handle to a X25519 Secret Key.

Enums

HKDFNumberOfOutputs

Possible number of outputs of HKDF.

Signature

A cryptographic signature.

SigningKeyType

Key type for Signing. See super::signatures::Signature.

SigningSecret

Signing secret binary

SigningSecretKeyHandle

A handle to signing secret key inside a vault.

VaultError

Represents the failures that can occur in an Ockam vault

VerifyingPublicKey

A public key for verifying signatures.

Constants

AEAD_SECRET_LENGTH

AEAD Secret Length.

AEAD_TYPE

AEAD type string.

AES256_SECRET_LENGTH

AES256 private key length.

AES_NONCE_LENGTH

AES-GCM nonce length

ECDSA_SHA256_CURVEP256_PUBLIC_KEY_LENGTH

NIST P256 public key length.

ECDSA_SHA256_CURVEP256_SECRET_KEY_LENGTH

NIST P256 private key length.

ECDSA_SHA256_CURVEP256_SIGNATURE_LENGTH

ECDSASHA256CurveP256 signature length.

EDDSA_CURVE25519_PUBLIC_KEY_LENGTH

Ed25519 public key length.

EDDSA_CURVE25519_SECRET_KEY_LENGTH

Ed25519 private key length.

EDDSA_CURVE25519_SIGNATURE_LENGTH

EdDSACurve25519 signature length.

SHA256_LENGTH

SHA256 digest length

X25519_PUBLIC_KEY_LENGTH

X25519 public key length.

X25519_SECRET_KEY_LENGTH

X25519 private key length.

Traits

VaultForSecureChannels

Vault for running a Secure Channel

VaultForSigning

Vault for signing data.

VaultForVerifyingSignatures

Vault for verifying signatures and computing SHA-256.

Type Aliases

AeadSecretKeyHandleType

Handle to a AEAD Secret Key.