Struct PqcCredential 

pub struct PqcCredential {
    pub spiffe_id: SpiffeId,
    pub algo: u8,
    pub verifying_key_bytes: Vec<u8>,
    pub created_at: DateTime<Utc>,
    pub expires_at: DateTime<Utc>,
}

A shareable PQC credential containing a verifying key and identity metadata.

PqcCredential contains only public material and is safe to share with peers. It does not contain the signing key. Think of it as the post-quantum equivalent of an X.509 certificate.

Wire format

Serialized with serde/bincode. The algo field identifies the key type for forward compatibility. Version 1 uses hybrid Ed25519+ML-DSA-65.

Examples

use okami::identity::{AgentIdentity, PqcCredential};

// Obtain a credential from an identity (contains only public material).
let identity = AgentIdentity::new("example.com", "agent/worker").unwrap();
let cred: PqcCredential = identity.credential();

assert!(!cred.is_expired());
assert!(cred.is_valid_at(chrono::Utc::now()));

// Round-trip through bytes (e.g. for network transport).
let bytes = cred.to_bytes().unwrap();
let cred2 = PqcCredential::from_bytes(&bytes).unwrap();
assert_eq!(cred.spiffe_id, cred2.spiffe_id);

Fields

spiffe_id: SpiffeId

SPIFFE ID identifying the agent this credential belongs to.

algo: u8

Algorithm version byte (0x01 = hybrid Ed25519+ML-DSA-65).

verifying_key_bytes: Vec<u8>

Raw serialized verifying key bytes (format determined by algo).

created_at: DateTime<Utc>

When this credential was created.

expires_at: DateTime<Utc>

When this credential expires.

Implementations

impl PqcCredential

pub fn is_expired(&self) -> bool

Check whether this credential has expired.

pub fn is_valid_at(&self, t: DateTime<Utc>) -> bool

Check whether this credential is valid at the given time.

pub fn to_bytes(&self) -> Result<Vec<u8>>

Serialize this credential to bytes (bincode).

Errors

Returns Error::Serialization if bincode encoding fails.

pub fn from_bytes(bytes: &[u8]) -> Result<Self>

Deserialize a credential from bytes (bincode).

Enforces a MAX_CREDENTIAL_BYTES allocation cap to prevent DoS via crafted length-prefix fields (e.g. [0xFF; 8] triggering multi-exabyte allocation). See /cso audit Finding #4 (fingerprint 30a553fc).

Errors

Returns Error::Serialization if the input exceeds MAX_CREDENTIAL_BYTES or if bincode decoding fails.

Trait Implementations

impl Clone for PqcCredential

fn clone(&self) -> PqcCredential

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for PqcCredential

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for PqcCredential

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for PqcCredential

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.