Struct ockam_vault::Vault

pub struct Vault { /* private fields */ }

Vault implementation that stores secrets in memory and uses software crypto.

Examples

use ockam_vault::Vault;
use ockam_core::Result;
use ockam_core::vault::{SecretAttributes, SecretType, SecretPersistence, CURVE25519_SECRET_LENGTH_U32, SecretVault, Signer, Verifier};

async fn example() -> Result<()> {
    let mut vault = Vault::default();

    let mut attributes = SecretAttributes::new(
        SecretType::X25519,
        SecretPersistence::Ephemeral,
        CURVE25519_SECRET_LENGTH_U32,
    );

    let secret = vault.secret_generate(attributes).await?;
    let public = vault.secret_public_key_get(&secret).await?;

    let data = "Very important stuff".as_bytes();

    let signature = vault.sign(&secret, data).await?;
    assert!(vault.verify(&signature, &public, data).await?);

    Ok(())
}

Implementations

impl Vault

pub fn check_secret(
    &self,
    secret: &[u8],
    attributes: &SecretAttributes
) -> Result<()>

Validate secret key.

impl Vault

pub fn new(storage: Option<Arc<dyn Storage>>) -> Self

Create a new SoftwareVault

pub fn create() -> Self

Same as Vault::new()

Trait Implementations

impl AsymmetricVault for Vault

fn ec_diffie_hellman<'life0, 'life1, 'life2, 'async_trait>(
    &'life0 self,
    secret: &'life1 KeyId,
    peer_public_key: &'life2 PublicKey
) -> Pin<Box<dyn Future<Output = Result<KeyId>> + Send + 'async_trait>>where
    Self: 'async_trait,
    'life0: 'async_trait,
    'life1: 'async_trait,
    'life2: 'async_trait,

Compute Elliptic-Curve Diffie-Hellman using this secret key and the specified uncompressed public key.

fn compute_key_id_for_public_key<'life0, 'life1, 'async_trait>(
    &'life0 self,
    public_key: &'life1 PublicKey
) -> Pin<Box<dyn Future<Output = Result<KeyId>> + Send + 'async_trait>>where
    Self: 'async_trait,
    'life0: 'async_trait,
    'life1: 'async_trait,

Compute and return the KeyId for a given public key.

impl Clone for Vault

fn clone(&self) -> Vault

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Default for Vault

fn default() -> Vault

Returns the “default value” for a type.

impl Hasher for Vault

fn hkdf_sha256<'life0, 'life1, 'life2, 'life3, 'async_trait>(
    &'life0 self,
    salt: &'life1 KeyId,
    info: &'life2 [u8],
    ikm: Option<&'life3 KeyId>,
    output_attributes: Vec<SecretAttributes>
) -> Pin<Box<dyn Future<Output = Result<Vec<KeyId>>> + Send + 'async_trait>>where
    Self: 'async_trait,
    'life0: 'async_trait,
    'life1: 'async_trait,
    'life2: 'async_trait,
    'life3: 'async_trait,

Compute sha256. Salt and Ikm should be of Buffer type. Output secrets should be only of type Buffer or AES

fn sha256<'life0, 'life1, 'async_trait>(
    &'life0 self,
    data: &'life1 [u8]
) -> Pin<Box<dyn Future<Output = Result<[u8; 32]>> + Send + 'async_trait>>where
    Self: 'async_trait,
    'life0: 'async_trait,
    'life1: 'async_trait,

Compute the SHA-256 digest given input data.

impl SecretVault for Vault

fn secret_generate<'life0, 'async_trait>(
    &'life0 self,
    attributes: SecretAttributes
) -> Pin<Box<dyn Future<Output = Result<KeyId>> + Send + 'async_trait>>where
    Self: 'async_trait,
    'life0: 'async_trait,

Generate fresh secret. Only Curve25519 and Buffer types are supported

fn secret_public_key_get<'life0, 'life1, 'async_trait>(
    &'life0 self,
    key_id: &'life1 KeyId
) -> Pin<Box<dyn Future<Output = Result<PublicKey>> + Send + 'async_trait>>where
    Self: 'async_trait,
    'life0: 'async_trait,
    'life1: 'async_trait,

Extract public key from secret. Only Curve25519 type is supported

fn secret_destroy<'life0, 'async_trait>(
    &'life0 self,
    key_id: KeyId
) -> Pin<Box<dyn Future<Output = Result<()>> + Send + 'async_trait>>where
    Self: 'async_trait,
    'life0: 'async_trait,

Remove secret from memory

fn secret_import<'life0, 'async_trait>(
    &'life0 self,
    secret: Secret,
    attributes: SecretAttributes
) -> Pin<Box<dyn Future<Output = Result<KeyId>> + Send + 'async_trait>>where
    Self: 'async_trait,
    'life0: 'async_trait,

Import a secret with the given attributes from binary form into the vault.

fn secret_export<'life0, 'life1, 'async_trait>(
    &'life0 self,
    key_id: &'life1 KeyId
) -> Pin<Box<dyn Future<Output = Result<Secret>> + Send + 'async_trait>>where
    Self: 'async_trait,
    'life0: 'async_trait,
    'life1: 'async_trait,

Export a secret key to the binary form represented as [SecretKey].

fn secret_attributes_get<'life0, 'life1, 'async_trait>(
    &'life0 self,
    key_id: &'life1 KeyId
) -> Pin<Box<dyn Future<Output = Result<SecretAttributes>> + Send + 'async_trait>>where
    Self: 'async_trait,
    'life0: 'async_trait,
    'life1: 'async_trait,

Return the attributes for a secret.

impl Signer for Vault

fn sign<'life0, 'life1, 'life2, 'async_trait>(
    &'life0 self,
    secret_key: &'life1 KeyId,
    data: &'life2 [u8]
) -> Pin<Box<dyn Future<Output = Result<Signature>> + Send + 'async_trait>>where
    Self: 'async_trait,
    'life0: 'async_trait,
    'life1: 'async_trait,
    'life2: 'async_trait,

Sign data.

impl SymmetricVault for Vault

fn aead_aes_gcm_encrypt<'life0, 'life1, 'life2, 'life3, 'life4, 'async_trait>(
    &'life0 self,
    key_id: &'life1 KeyId,
    plaintext: &'life2 [u8],
    nonce: &'life3 [u8],
    aad: &'life4 [u8]
) -> Pin<Box<dyn Future<Output = Result<Buffer<u8>>> + Send + 'async_trait>>where
    Self: 'async_trait,
    'life0: 'async_trait,
    'life1: 'async_trait,
    'life2: 'async_trait,
    'life3: 'async_trait,
    'life4: 'async_trait,

Encrypt a payload using AES-GCM.

fn aead_aes_gcm_decrypt<'life0, 'life1, 'life2, 'life3, 'life4, 'async_trait>(
    &'life0 self,
    key_id: &'life1 KeyId,
    cipher_text: &'life2 [u8],
    nonce: &'life3 [u8],
    aad: &'life4 [u8]
) -> Pin<Box<dyn Future<Output = Result<Buffer<u8>>> + Send + 'async_trait>>where
    Self: 'async_trait,
    'life0: 'async_trait,
    'life1: 'async_trait,
    'life2: 'async_trait,
    'life3: 'async_trait,
    'life4: 'async_trait,

Decrypt a payload using AES-GCM.

impl Verifier for Vault

fn verify<'life0, 'life1, 'life2, 'life3, 'async_trait>(
    &'life0 self,
    signature: &'life1 Signature,
    public_key: &'life2 PublicKey,
    data: &'life3 [u8]
) -> Pin<Box<dyn Future<Output = Result<bool>> + Send + 'async_trait>>where
    Self: 'async_trait,
    'life0: 'async_trait,
    'life1: 'async_trait,
    'life2: 'async_trait,
    'life3: 'async_trait,

Verify signature