Struct MobileKeyManager 

pub struct MobileKeyManager { /* private fields */ }

Mobile Key Manager that acts as a Certificate Authority

Implementations

impl MobileKeyManager

pub fn new(logger: Arc<Logger>) -> Result<Self>

Create a new Mobile Key Manager

pub fn install_network_public_key( &mut self, network_public_key: &[u8], ) -> Result<()>

pub fn initialize_user_root_key(&mut self) -> Result<Vec<u8>>

Initialize user root key - Master key that never leaves the mobile device

pub fn get_user_root_public_key(&self) -> Result<Vec<u8>>

Get the user root public key

pub fn derive_user_profile_key(&mut self, label: &str) -> Result<Vec<u8>>

Derive a user profile agreement key from the root key using HKDF-SHA-256.

• IKM: raw 32-byte scalar of the user root signing key
• info: “runar-v1:profile:agreement:{label}[:{counter}]”
• output: 32-byte scalar interpreted as P-256 SecretKey (with rejection sampling)

pub fn get_network_public_key(&self, network_id: &str) -> Result<Vec<u8>>

pub fn generate_network_data_key(&mut self) -> Result<String>

Generate a network data key for envelope encryption and return the network ID (compact Base64 public key)

pub fn create_envelope_key(&self) -> Result<Vec<u8>>

Create an envelope key for per-object encryption Envelope keys are ephemeral - generated fresh for each object

pub fn encrypt_with_envelope( &self, data: &[u8], network_id: Option<&str>, profile_public_keys: Vec<Vec<u8>>, ) -> Result<EnvelopeEncryptedData>

Encrypt data with envelope encryption This implements the envelope encryption pattern:

1. Generate ephemeral envelope key
2. Encrypt data with envelope key
3. Encrypt envelope key with network/profile keys

pub fn decrypt_with_profile( &self, envelope_data: &EnvelopeEncryptedData, profile_id: &str, ) -> Result<Vec<u8>>

Decrypt envelope-encrypted data using profile key

pub fn decrypt_with_network( &self, envelope_data: &EnvelopeEncryptedData, ) -> Result<Vec<u8>>

Decrypt envelope-encrypted data using network key

pub fn initialize_user_identity(&mut self) -> Result<Vec<u8>>

Initialize user identity and generate root keys

pub fn get_ca_certificate(&self) -> &X509Certificate

Get the user CA certificate

pub fn get_ca_public_key(&self) -> Vec<u8>

Get the CA public key bytes

pub fn process_setup_token( &mut self, setup_token: &SetupToken, ) -> Result<NodeCertificateMessage>

Process a setup token from a node and issue a certificate

pub fn get_statistics(&self) -> MobileKeyManagerStatistics

Get statistics about the mobile key manager

pub fn create_network_key_message( &self, network_id: &str, node_agreement_public_key: &[u8], ) -> Result<NetworkKeyMessage>

Create a network key message for a node with proper encryption

pub fn validate_certificate(&self, certificate: &X509Certificate) -> Result<()>

Validate a certificate issued by this CA

pub fn get_issued_certificate(&self, node_id: &str) -> Option<&X509Certificate>

Get issued certificate by node ID

pub fn list_issued_certificates(&self) -> Vec<(String, &X509Certificate)>

List all issued certificates

pub fn encrypt_for_profile( &self, data: &[u8], profile_id: &str, ) -> Result<Vec<u8>>

Encrypt data for a specific profile (legacy method for compatibility)

pub fn encrypt_for_network( &self, data: &[u8], network_id: &str, ) -> Result<Vec<u8>>

Encrypt data for a network (legacy method for compatibility)

pub fn generate_user_profile_key(&mut self, profile_id: &str) -> Result<Vec<u8>>

Generate a user profile key (legacy method name for compatibility)

pub fn encrypt_message_for_node( &self, message: &[u8], node_agreement_public_key: &[u8], ) -> Result<Vec<u8>>

Encrypt a message for a node using its public key (ECIES)

pub fn decrypt_message_from_node( &self, encrypted_message: &[u8], ) -> Result<Vec<u8>>

Decrypt a message from a node using the user’s root key (ECIES)

pub fn export_state(&self) -> MobileKeyManagerState

Export all cryptographic material for persistence.

pub fn from_state( state: MobileKeyManagerState, logger: Arc<Logger>, ) -> Result<Self>

Restore a MobileKeyManager from a previously exported state.

Trait Implementations

impl EnvelopeCrypto for MobileKeyManager

fn encrypt_with_envelope( &self, data: &[u8], network_id: Option<&str>, profile_public_keys: Vec<Vec<u8>>, ) -> Result<EnvelopeEncryptedData>

fn decrypt_envelope_data(&self, env: &EnvelopeEncryptedData) -> Result<Vec<u8>>