Struct DeviceKeypair 

pub struct DeviceKeypair { /* private fields */ }

Ed25519 keypair for device identity and authentication.

The keypair consists of:

• A 32-byte secret (signing) key
• A 32-byte public (verifying) key

The DeviceId is derived from the public key.

Example

use peat_mesh::security::DeviceKeypair;

// Generate a new keypair
let keypair = DeviceKeypair::generate();

// Get the device ID
let device_id = keypair.device_id();

// Sign a message
let message = b"hello world";
let signature = keypair.sign(message);

// Verify the signature
assert!(keypair.verify(message, &signature).is_ok());

Implementations

impl DeviceKeypair

pub fn generate() -> DeviceKeypair

Generate a new random keypair.

pub fn from_signing_key(signing_key: SigningKey) -> DeviceKeypair

Create from an existing signing key.

pub fn from_seed( seed: &[u8], context: &str, ) -> Result<DeviceKeypair, SecurityError>

Create a deterministic keypair from a seed and context string.

Uses HKDF-SHA256 to derive 32 bytes from seed (IKM) with context as the info parameter. Same seed + context always produces the same keypair; different context → different key.

Useful for Kubernetes deployments where pods derive stable identities from a shared secret + pod-specific context.

pub fn from_secret_bytes(bytes: &[u8]) -> Result<DeviceKeypair, SecurityError>

Create from raw secret key bytes (32 bytes).

pub fn load_from_file(path: &Path) -> Result<DeviceKeypair, SecurityError>

Load keypair from a file (raw 32-byte secret key).

pub fn save_to_file(&self, path: &Path) -> Result<(), SecurityError>

Save keypair to a file (raw 32-byte secret key).

Security Note

In MVP, this saves the key unencrypted. Production deployments should use encrypted key storage (Phase 2).

pub fn device_id(&self) -> DeviceId

Get the device ID derived from this keypair’s public key.

pub fn verifying_key(&self) -> VerifyingKey

Get the public (verifying) key.

pub fn public_key_bytes(&self) -> [u8; 32]

Get the public key as bytes.

pub fn secret_key_bytes(&self) -> [u8; 32]

Get the secret key bytes (32 bytes).

Security Warning

This exposes the private key material. Only use for:

• Secure storage/persistence
• Cross-crate interop (e.g., converting to peat_btle::DeviceIdentity)

pub fn sign(&self, message: &[u8]) -> Signature

Sign a message with the secret key.

pub fn verify( &self, message: &[u8], signature: &Signature, ) -> Result<(), SecurityError>

Verify a signature against this keypair’s public key.

pub fn verify_with_key( public_key: &VerifyingKey, message: &[u8], signature: &Signature, ) -> Result<(), SecurityError>

Verify a signature against a specific public key.

pub fn signature_from_bytes(bytes: &[u8]) -> Result<Signature, SecurityError>

Parse a signature from bytes.

pub fn verifying_key_from_bytes( bytes: &[u8], ) -> Result<VerifyingKey, SecurityError>

Parse a verifying key from bytes.

Trait Implementations

impl Clone for DeviceKeypair

fn clone(&self) -> DeviceKeypair

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for DeviceKeypair

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.