Struct SeedHandle 

pub struct SeedHandle { /* private fields */ }

A handle to a cryptographic seed with TTL and memory security.

The seed is held in memory until the TTL expires (or indefinitely if None). On drop, the seed is zeroized. Sovereign tier uses mlock to prevent swapping.

Implementations

impl SeedHandle

pub fn new(seed: &[u8], ttl: Option<Duration>) -> Self

Create a new seed handle from raw seed bytes.

Arguments

• seed - Raw seed bytes (will be copied and zeroized on drop)
• ttl - Optional time-to-live. None = never expires.

pub fn with_tier(seed: &[u8], ttl: Option<Duration>, tier: MemoryTier) -> Self

Create with explicit memory tier.

pub fn is_expired(&self) -> bool

Check if this handle has expired.

pub fn as_bytes(&self) -> Option<&[u8]>

Get the seed bytes. Returns None if expired.

pub fn as_bytes_unchecked(&self) -> &[u8]

Get seed bytes without TTL check (use with caution).

pub fn fingerprint(&self) -> [u8; 32]

Compute a fingerprint (SHA3-256 of the seed).

This is safe to share publicly – it’s a one-way hash of the seed.

pub fn derive_key( &self, domain: &str, info: &str, len: usize, ) -> Option<Vec<u8>>

Derive a domain-specific key using HKDF-SHA3-256.

Arguments

• domain - Domain string (e.g., “signing”, “encryption”, “did:origin:abc”)
• info - Additional info for key separation Derive a domain-specific key using HKDF-SHA3-256.

pub fn tier(&self) -> MemoryTier

Get the memory tier.

pub fn remaining(&self) -> Option<Duration>

Get remaining TTL duration (None if no TTL set).

Trait Implementations

impl Clone for SeedHandle

fn clone(&self) -> SeedHandle

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SeedHandle

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Drop for SeedHandle

fn drop(&mut self)

Executes the destructor for this type.

fn pin_drop(self: Pin<&mut Self>)

🔬This is a nightly-only experimental API. (pin_ergonomics)

Execute the destructor for this type, but different to Drop::drop, it requires self to be pinned.