Struct ockam_vault::Vault

pub struct Vault { /* private fields */ }

Vault implementation that stores secrets in memory and uses software crypto.

Examples

use ockam_vault::Vault;
use ockam_core::Result;
use ockam_core::vault::{SecretAttributes, SecretType, SecretPersistence, CURVE25519_SECRET_LENGTH, SecretVault, Signer, Verifier};

async fn example() -> Result<()> {
    let mut vault = Vault::default();

    let mut attributes = SecretAttributes::new(
        SecretType::X25519,
        SecretPersistence::Ephemeral,
        CURVE25519_SECRET_LENGTH,
    );

    let secret = vault.secret_generate(attributes).await?;
    let public = vault.secret_public_key_get(&secret).await?;

    let data = "Very important stuff".as_bytes();

    let signature = vault.sign(&secret, data).await?;
    assert!(vault.verify(&signature, &public, data).await?);

    Ok(())
}

Implementations

impl Vault

pub fn check_secret(
    &self,
    secret: &[u8],
    attributes: &SecretAttributes
) -> Result<()>

Validate secret key.

impl Vault

pub fn new() -> Self

Create a new SoftwareVault

pub async fn serialize(&self) -> Vec<u8>

Serialize a vault to bytes which may later be restored using SoftwareVault::deserialize.

pub fn deserialize(data: &[u8]) -> Result<Self>

Load a vault from the serialized format produced by SoftwareVault::serialize.

pub fn create() -> Self

Same as Vault::new()

Trait Implementations

impl AsymmetricVault for Vault

fn ec_diffie_hellman<'life0, 'life1, 'life2, 'async_trait>(
    &'life0 self,
    context: &'life1 Secret,
    peer_public_key: &'life2 PublicKey
) -> Pin<Box<dyn Future<Output = Result<Secret>> + Send + 'async_trait>> where
    'life0: 'async_trait,
    'life1: 'async_trait,
    'life2: 'async_trait,
    Self: 'async_trait, 

Compute Elliptic-Curve Diffie-Hellman using this secret key and the specified uncompressed public key.

impl Clone for Vault

fn clone(&self) -> Vault

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Default for Vault

fn default() -> Vault

Returns the “default value” for a type.

impl Hasher for Vault

fn hkdf_sha256<'life0, 'life1, 'life2, 'life3, 'async_trait>(
    &'life0 self,
    salt: &'life1 Secret,
    info: &'life2 [u8],
    ikm: Option<&'life3 Secret>,
    output_attributes: Vec<SecretAttributes>
) -> Pin<Box<dyn Future<Output = Result<Vec<Secret>>> + Send + 'async_trait>> where
    'life0: 'async_trait,
    'life1: 'async_trait,
    'life2: 'async_trait,
    'life3: 'async_trait,
    Self: 'async_trait, 

Compute sha256. Salt and Ikm should be of Buffer type. Output secrets should be only of type Buffer or AES

fn sha256<'life0, 'life1, 'async_trait>(
    &'life0 self,
    data: &'life1 [u8]
) -> Pin<Box<dyn Future<Output = Result<[u8; 32]>> + Send + 'async_trait>> where
    'life0: 'async_trait,
    'life1: 'async_trait,
    Self: 'async_trait, 

Compute the SHA-256 digest given input data.

impl KeyIdVault for Vault

fn secret_by_key_id<'life0, 'life1, 'async_trait>(
    &'life0 self,
    key_id: &'life1 str
) -> Pin<Box<dyn Future<Output = Result<Secret>> + Send + 'async_trait>> where
    'life0: 'async_trait,
    'life1: 'async_trait,
    Self: 'async_trait, 

Return the Secret for a given key id.

fn compute_key_id_for_public_key<'life0, 'life1, 'async_trait>(
    &'life0 self,
    public_key: &'life1 PublicKey
) -> Pin<Box<dyn Future<Output = Result<KeyId>> + Send + 'async_trait>> where
    'life0: 'async_trait,
    'life1: 'async_trait,
    Self: 'async_trait, 

Compute and return the KeyId for a given public key.

impl SecretVault for Vault

fn secret_generate<'life0, 'async_trait>(
    &'life0 self,
    attributes: SecretAttributes
) -> Pin<Box<dyn Future<Output = Result<Secret>> + Send + 'async_trait>> where
    'life0: 'async_trait,
    Self: 'async_trait, 

Generate fresh secret. Only Curve25519 and Buffer types are supported

fn secret_public_key_get<'life0, 'life1, 'async_trait>(
    &'life0 self,
    context: &'life1 Secret
) -> Pin<Box<dyn Future<Output = Result<PublicKey>> + Send + 'async_trait>> where
    'life0: 'async_trait,
    'life1: 'async_trait,
    Self: 'async_trait, 

Extract public key from secret. Only Curve25519 type is supported

fn secret_destroy<'life0, 'async_trait>(
    &'life0 self,
    context: Secret
) -> Pin<Box<dyn Future<Output = Result<()>> + Send + 'async_trait>> where
    'life0: 'async_trait,
    Self: 'async_trait, 

Remove secret from memory

fn secret_import<'life0, 'life1, 'async_trait>(
    &'life0 self,
    secret: &'life1 [u8],
    attributes: SecretAttributes
) -> Pin<Box<dyn Future<Output = Result<Secret>> + Send + 'async_trait>> where
    'life0: 'async_trait,
    'life1: 'async_trait,
    Self: 'async_trait, 

Import a secret with the given attributes from binary form into the vault.

fn secret_export<'life0, 'life1, 'async_trait>(
    &'life0 self,
    context: &'life1 Secret
) -> Pin<Box<dyn Future<Output = Result<SecretKey>> + Send + 'async_trait>> where
    'life0: 'async_trait,
    'life1: 'async_trait,
    Self: 'async_trait, 

Export a secret key to the binary form represented as SecretKey.

fn secret_attributes_get<'life0, 'life1, 'async_trait>(
    &'life0 self,
    context: &'life1 Secret
) -> Pin<Box<dyn Future<Output = Result<SecretAttributes>> + Send + 'async_trait>> where
    'life0: 'async_trait,
    'life1: 'async_trait,
    Self: 'async_trait, 

Return the attributes for a secret.

impl Signer for Vault

fn sign<'life0, 'life1, 'life2, 'async_trait>(
    &'life0 self,
    secret_key: &'life1 Secret,
    data: &'life2 [u8]
) -> Pin<Box<dyn Future<Output = Result<Signature>> + Send + 'async_trait>> where
    'life0: 'async_trait,
    'life1: 'async_trait,
    'life2: 'async_trait,
    Self: 'async_trait, 

Sign data with xeddsa algorithm. Only curve25519 is supported.

impl SymmetricVault for Vault

fn aead_aes_gcm_encrypt<'life0, 'life1, 'life2, 'life3, 'life4, 'async_trait>(
    &'life0 self,
    context: &'life1 Secret,
    plaintext: &'life2 [u8],
    nonce: &'life3 [u8],
    aad: &'life4 [u8]
) -> Pin<Box<dyn Future<Output = Result<Buffer<u8>>> + Send + 'async_trait>> where
    'life0: 'async_trait,
    'life1: 'async_trait,
    'life2: 'async_trait,
    'life3: 'async_trait,
    'life4: 'async_trait,
    Self: 'async_trait, 

Encrypt a payload using AES-GCM.

fn aead_aes_gcm_decrypt<'life0, 'life1, 'life2, 'life3, 'life4, 'async_trait>(
    &'life0 self,
    context: &'life1 Secret,
    cipher_text: &'life2 [u8],
    nonce: &'life3 [u8],
    aad: &'life4 [u8]
) -> Pin<Box<dyn Future<Output = Result<Buffer<u8>>> + Send + 'async_trait>> where
    'life0: 'async_trait,
    'life1: 'async_trait,
    'life2: 'async_trait,
    'life3: 'async_trait,
    'life4: 'async_trait,
    Self: 'async_trait, 

Decrypt a payload using AES-GCM.

impl Verifier for Vault

fn verify<'life0, 'life1, 'life2, 'life3, 'async_trait>(
    &'life0 self,
    signature: &'life1 Signature,
    public_key: &'life2 PublicKey,
    data: &'life3 [u8]
) -> Pin<Box<dyn Future<Output = Result<bool>> + Send + 'async_trait>> where
    'life0: 'async_trait,
    'life1: 'async_trait,
    'life2: 'async_trait,
    'life3: 'async_trait,
    Self: 'async_trait, 

Verify signature