Struct AgreementKey 

pub struct AgreementKey { /* private fields */ }

A device’s long-term key-agreement secret.

This is the private half a device uses to agree a session key with a peer. It is built from a 32-byte seed the device is provisioned with and keeps in secure storage, so the same agreement key is recreated deterministically across reboots.

It is separate from the device’s ed25519 signing identity in pamoja-security. Key agreement gives confidentiality; it does not by itself prove who the peer is. A deployment authenticates the peer by pinning its public value, or by signing that value with the peer’s pamoja-security identity, the same way it already pins a signing identity. Without that pinning the channel is private but unauthenticated and a man in the middle is possible.

Examples

use pamoja_session::AgreementKey;

let device = AgreementKey::from_seed(&[7u8; 32]);
let public = device.public();
// `public.to_bytes()` is what a peer pins or has signed to trust this device.
assert_eq!(public.to_bytes().len(), 32);

Implementations

impl AgreementKey

pub fn from_seed(seed: &[u8; 32]) -> Self

Builds a key-agreement secret from a 32-byte seed.

Arguments

• seed - the 32 secret bytes the key is derived from.

Returns

The agreement key.

pub fn public(&self) -> AgreementPublicKey

Returns the public key a peer needs to agree a session with this device.

Returns

The matching AgreementPublicKey, safe to share once it is authenticated.