reallyme_crypto/operations/
platform_key.rs

1// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
2//
3// SPDX-License-Identifier: Apache-2.0
4
5use super::OperationFamily;
6
7/// Platform-owned key operations represented by the shared domain model.
8///
9/// This enum is intentionally descriptive rather than executable. Apple and
10/// Android SDK providers retain custody of platform key handles and must fail
11/// closed when an operation is unavailable; the Rust core must never substitute
12/// an exportable software key for a platform-owned key.
13#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
14#[non_exhaustive]
15pub enum PlatformKeyOperation {
16    /// Generate a new non-exportable platform key.
17    Generate,
18    /// Return the public half of an existing platform key.
19    GetPublicKey,
20    /// Sign with an existing platform key.
21    Sign,
22    /// Verify with an existing platform key.
23    Verify,
24    /// Derive a shared secret with an existing platform key.
25    DeriveSharedSecret,
26    /// Delete an existing platform key.
27    Delete,
28    /// Request provider attestation for an existing platform key.
29    Attest,
30}
31
32impl PlatformKeyOperation {
33    /// Returns the semantic operation family used by policy and telemetry.
34    #[must_use]
35    pub const fn family(self) -> OperationFamily {
36        OperationFamily::PlatformKey
37    }
38
39    /// Returns whether the operation requires a previously created key handle.
40    #[must_use]
41    pub const fn requires_existing_key(self) -> bool {
42        !matches!(self, Self::Generate)
43    }
44
45    /// Returns whether successful execution can produce secret material.
46    ///
47    /// Callers use this classification to require a zeroizing managed owner for
48    /// the shared-secret result before crossing an SDK or FFI boundary.
49    #[must_use]
50    pub const fn produces_secret_material(self) -> bool {
51        matches!(self, Self::DeriveSharedSecret)
52    }
53}
reallyme_crypto/operations/platform_key.rs

reallyme_crypto/operations/
platform_key.rs
