Crate ockam_vault

In order to support a variety of cryptographically capable hardware we maintain loose coupling between our protocols and how a specific building block is invoked in a specific hardware. This is achieved using an abstract Vault trait.

A concrete implementation of the Vault trait is called an Ockam Vault. Over time, and with help from the Ockam open source community, we plan to add vaults for several TEEs, TPMs, HSMs, and Secure Enclaves.

This crate provides a software-only Vault implementation that can be used when no cryptographic hardware is available. The primary Ockam crate uses this as the default Vault implementation.

The main [Ockam][main-ockam-crate-link] has optional dependency on this crate.

Modules

• legacy
  Backwards compatibility storage formats
• storage
  Storage

Structs

• AeadSecret
  AEAD Secret.
• AeadSecretKeyHandle
  Handle to a AEAD Secret Key.
• Aes256GcmSecretKeyHandle
  Handle to an AES-256 Secret Key.
• BufferSecret
  Buffer with sensitive data, like HKDF output.
• ECDSASHA256CurveP256PublicKey
  A Curve P-256 Public Key that is only used for ECDSA SHA256 signatures.
• ECDSASHA256CurveP256SecretKey
  ECDSASHA256CurveP256 Secret Key.
• ECDSASHA256CurveP256Signature
  An ECDSA Signature using SHA256 and Curve P-256.
• EdDSACurve25519PublicKey
  A Curve25519 Public Key that is only used for EdDSA signatures.
• EdDSACurve25519SecretKey
  EdDSACurve25519 Secret Key.
• EdDSACurve25519Signature
  An EdDSA Signature using Curve25519.
• HandleToSecret
  Implementation-specific arbitrary vector of bytes that allows a concrete Vault implementation to address a specific secret that it stores.
• HashOutput
  Hash used for Noise handshake.
• HkdfOutput
  HKDF Output.
• SecretBufferHandle
  A handle to a secret Buffer (like an HKDF output).
• Sha256HkdfOutput
  SHA-256 HKDF Output.
• Sha256Output
  SHA-256 Output.
• SoftwareVaultForSecureChannels
  [SecureChannelVault] implementation using software
• SoftwareVaultForSigning
  [SigningVault] implementation using software
• SoftwareVaultForVerifyingSignatures
  [VaultForSigning] implementation using software
• X25519PublicKey
  X25519 Public Key is used for ECDH.
• X25519SecretKey
  X25519 Secret Key.
• X25519SecretKeyHandle
  A handle to a X25519 Secret Key.

Enums

• HKDFNumberOfOutputs
  Possible number of outputs of HKDF.
• Signature
  A cryptographic signature.
• SigningKeyType
  Key type for Signing. See super::signatures::Signature.
• SigningSecret
  Signing secret binary
• SigningSecretKeyHandle
  A handle to signing secret key inside a vault.
• VaultError
  Represents the failures that can occur in an Ockam vault
• VerifyingPublicKey
  A public key for verifying signatures.

Constants

• AEAD_SECRET_LENGTH
  AEAD Secret Length.
• AES256_SECRET_LENGTH
  AES256 private key length.
• AES_NONCE_LENGTH
  AES-GCM nonce length
• ECDSA_SHA256_CURVEP256_PUBLIC_KEY_LENGTH
  NIST P256 public key length.
• ECDSA_SHA256_CURVEP256_SECRET_KEY_LENGTH
  NIST P256 private key length.
• ECDSA_SHA256_CURVEP256_SIGNATURE_LENGTH
  ECDSASHA256CurveP256 signature length.
• EDDSA_CURVE25519_PUBLIC_KEY_LENGTH
  Ed25519 public key length.
• EDDSA_CURVE25519_SECRET_KEY_LENGTH
  Ed25519 private key length.
• EDDSA_CURVE25519_SIGNATURE_LENGTH
  EdDSACurve25519 signature length.
• SHA256_LENGTH
  SHA256 digest length
• X25519_PUBLIC_KEY_LENGTH
  X25519 public key length.
• X25519_SECRET_KEY_LENGTH
  X25519 private key length.

Traits

• VaultForSecureChannels
  Vault for running a Secure Channel
• VaultForSigning
  Vault for signing data.
• VaultForVerifyingSignatures
  Vault for verifying signatures and computing SHA-256.