pub struct FfiDirectMasterKeyStore { /* private fields */ }Expand description
The application’s master key held directly by the platform key store.
The store keeps the material itself (a CNG key on Windows, a Keystore entry on Android) and the host side persists nothing of its own for it. Reading it back returns the same 32 bytes.
§The two forms, and how the host side picks one
FfiWrappedMasterKeyStore is the other form. There is no flag and no mode argument
anywhere in this section: a caller that wants the wrapped form reaches for the other
object, so a platform that implements only one form cannot silently answer for both.
FfiDirectMasterKeyStore::backend reports what actually answered.
§The master key crosses this boundary as bytes, and as nothing else
FfiDirectMasterKeyStore::store takes 32 bytes, FfiDirectMasterKeyStore::load
returns 32 bytes. The material is never formatted, never logged and never part of an
error message; the host side should drop its copy as soon as it has handed the bytes over
or built an FfiVault from them.
§Current state
Windows and Android have a backend. On every other platform
FfiDirectMasterKeyStore::open still succeeds — the object is usable and reports
"unavailable" — and every operation fails with the kind unsupported_platform. Nothing
falls back to an in-process map.
Implementations§
Source§impl FfiDirectMasterKeyStore
impl FfiDirectMasterKeyStore
Sourcepub fn open() -> Result<Arc<Self>, FfiError>
pub fn open() -> Result<Arc<Self>, FfiError>
Opens the direct master key store of the current platform.
§Errors
A FfiError::Core error with the kind hardware_unavailable when no provider on
this machine can hold master key material. A platform whose backend is not
implemented yet still opens: the failures arrive from the operations below, with the
kind unsupported_platform, so the host side can name the platform instead of
reporting a machine that is out of order.
Sourcepub fn backend(&self) -> String
pub fn backend(&self) -> String
The platform key store that holds the material, as a stable short name: "tpm",
"android-keystore", "software", "secure-enclave" or "unavailable".
Reported truthfully, exactly as FfiPlatformKeys::backend does: asking for it
opens no key handle, and a machine without a TPM says "software" rather than
pretending. The host side can use it to tell the user before relying on the store.
Sourcepub fn is_hardware_backed(&self) -> bool
pub fn is_hardware_backed(&self) -> bool
Whether the material cannot leave hardware.
Consistent with FfiDirectMasterKeyStore::backend by construction: true exactly
when that backend is a hardware one.
Sourcepub fn store(&self, label: String, key: Vec<u8>) -> Result<(), FfiError>
pub fn store(&self, label: String, key: Vec<u8>) -> Result<(), FfiError>
Stores the 32-byte key under label, replacing what was stored there.
Replacing is deliberate: a recovery or a re-pairing legitimately replaces the master key, and refusing would leave the host side unable to follow its own vault files.
§Errors
FfiError::InputTooLong for a label over the boundary limit; the core’s
master_key_wrong_length when key is not 32 bytes; key_not_exportable when the
platform takes the material but will not hand it back, which is the case that wants
FfiWrappedMasterKeyStore; otherwise a key store failure, reported as
hardware_unavailable, unsupported_platform or device_error.
Sourcepub fn load(&self, label: String) -> Result<Vec<u8>, FfiError>
pub fn load(&self, label: String) -> Result<Vec<u8>, FfiError>
Reads back the master key stored under label: the 32 bytes
FfiDirectMasterKeyStore::store was given.
Never creates or replaces anything: a label that holds nothing fails instead.
§Errors
FfiError::InputTooLong for an oversized label, and otherwise a key store failure:
a label that holds nothing is device_error today, an unusable platform is
unsupported_platform, and invalid_master_key reports a store that returned
something which is not master key material.
Sourcepub fn delete(&self, label: String) -> Result<(), FfiError>
pub fn delete(&self, label: String) -> Result<(), FfiError>
Deletes the master key stored under label.
§Warning
Every vault of that account becomes unreadable on this device unless the key exists elsewhere — a recovery key, another device. The host side has to ask the user first.
§Errors
FfiError::InputTooLong for an oversized label, and otherwise the same key store
failures as FfiDirectMasterKeyStore::load.