Struct KeyPair 

pub struct KeyPair {
    pub master_secret: Vec<u8>,
    pub certificate: Vec<u8>,
}

RedDB cryptographic keypair for vault seal and token signing.

At bootstrap time a random master_secret is generated. The certificate is derived from the master secret via HMAC-SHA256 and given to the admin. The admin uses the certificate to unseal the vault on subsequent restarts.

master_secret  = random_bytes(32)                            // lives in vault
certificate    = HMAC-SHA256(master_secret, "reddb-certificate-v1")  // admin keeps this
vault_key      = Argon2id(certificate, "reddb-vault-seal")   // AES-256-GCM key for vault

Fields

master_secret: Vec<u8>

32-byte master secret (stays encrypted inside the vault).

certificate: Vec<u8>

32-byte certificate derived from master secret (admin keeps this).

Implementations

impl KeyPair

pub fn generate() -> Self

Generate a fresh keypair at bootstrap time.

pub fn from_master_secret(master_secret: Vec<u8>) -> Self

Re-derive a keypair from a known master secret (used when restoring state from the decrypted vault).

pub fn vault_key_from_certificate(certificate: &[u8]) -> SecureKey

Derive the vault encryption key from a certificate.

This is the only operation that does NOT require the master secret – anyone holding the certificate can unseal the vault.

pub fn sign(&self, data: &[u8]) -> Vec<u8>

Sign arbitrary data with the master secret (HMAC-SHA256).

pub fn verify(&self, data: &[u8], signature: &[u8]) -> bool

Verify a signature produced by sign.

pub fn certificate_hex(&self) -> String

Certificate as a hex string (what the admin saves).