Struct NodeKeyManager 

pub struct NodeKeyManager { /* private fields */ }

Node Key Manager for certificate requests and management

Implementations

impl NodeKeyManager

pub fn new(logger: Arc<Logger>) -> Result<Self>

Create a new Node Key Manager with fresh keys

pub fn get_node_public_key(&self) -> Vec<u8>

Get the node public key (node ID) - keys are always available

pub fn get_node_id(&self) -> String

Get the node ID (compact Base58 encoding of public key)

pub fn get_storage_key(&self) -> &[u8]

Get the node storage key for local encryption

pub fn ensure_symmetric_key(&mut self, key_name: &str) -> Result<Vec<u8>>

Ensure a symmetric key exists with the given name, creating it if it doesn’t exist

pub fn encrypt_local_data(&self, data: &[u8]) -> Result<Vec<u8>>

Encrypt local data using the node storage key

pub fn decrypt_local_data(&self, encrypted_data: &[u8]) -> Result<Vec<u8>>

Decrypt local data using the node storage key

pub fn decrypt_envelope_data( &self, envelope_data: &EnvelopeEncryptedData, ) -> Result<Vec<u8>>

Decrypt envelope-encrypted data using network key

pub fn create_envelope_for_network( &self, data: &[u8], network_id: Option<&str>, ) -> Result<EnvelopeEncryptedData>

Create an envelope-encrypted data structure for sharing

pub fn generate_csr(&mut self) -> Result<SetupToken>

Generate a certificate signing request (CSR) for this node

pub fn dns_safe_node_id(&self, node_id: &str) -> String

Convert a compact ID to a DNS-safe format by replacing invalid characters

pub fn get_node_key_pair(&self) -> &EcdsaKeyPair

Get the node key pair for certificate creation

pub fn install_certificate( &mut self, cert_message: NodeCertificateMessage, ) -> Result<()>

Install certificate received from mobile CA

pub fn get_quic_certificate_config(&self) -> Result<QuicCertificateConfig>

Get QUIC-compatible certificate configuration

pub fn validate_peer_certificate( &self, peer_cert: &X509Certificate, ) -> Result<()>

Validate peer certificate during QUIC handshake

pub fn install_network_key( &mut self, network_key_message: NetworkKeyMessage, ) -> Result<()>

Install network key from mobile with ECIES decryption

pub fn get_network_agreement(&self, network_id: &str) -> Result<&P256SecretKey>

Get network agreement key for decryption

pub fn get_network_public_key(&self, network_id: &str) -> Result<Vec<u8>>

pub fn encrypt_for_network( &self, data: &[u8], network_id: &str, ) -> Result<EnvelopeEncryptedData>

Encrypt data for network transmission

pub fn decrypt_network_data( &self, envelope_data: &EnvelopeEncryptedData, ) -> Result<Vec<u8>>

Decrypt network data

pub fn get_certificate_status(&self) -> CertificateStatus

Check certificate status with proper cryptographic validation

pub fn get_certificate_info(&self) -> Option<NodeCertificateInfo>

Get certificate information

pub fn get_statistics(&self) -> NodeKeyManagerStatistics

Get statistics about the node key manager

pub fn sign_data(&self, data: &[u8]) -> Result<Vec<u8>>

Sign data with the node’s private key

pub fn verify_peer_signature( &self, data: &[u8], signature: &[u8], peer_cert: &X509Certificate, ) -> Result<()>

Verify signature from another node

pub fn encrypt_message_for_mobile( &self, message: &[u8], mobile_public_key: &[u8], ) -> Result<Vec<u8>>

Encrypt a message for the mobile user using their public key (ECIES)

pub fn decrypt_message_from_mobile( &self, encrypted_message: &[u8], ) -> Result<Vec<u8>>

Decrypt a message from the mobile user using the node’s private key (ECIES)

pub fn create_envelope_key(&self) -> Result<Vec<u8>>

Create an envelope key for per-object encryption Envelope keys are ephemeral - generated fresh for each object

pub fn encrypt_with_envelope( &self, data: &[u8], network_id: Option<&String>, profile_public_keys: Vec<Vec<u8>>, ) -> Result<EnvelopeEncryptedData>

Create an envelope‐encrypted payload. For the node side we only support network recipients – any supplied profile_ids will be ignored. This signature exists solely to allow generic code (e.g. serializer key-store adapter) to call the same method on both key manager types without cfg branching.

pub fn encrypt_for_public_key( &self, data: &[u8], public_key: &[u8], ) -> Result<EnvelopeEncryptedData>

Envelope-encrypt for a recipient network public key.

pub fn has_public_key(&self, public_key: &[u8]) -> bool

Check if the manager holds the private key for the given network public key.

pub fn install_profile_public_key(&mut self, public_key: Vec<u8>)

Install a user profile public key so the node can encrypt data for that profile

impl NodeKeyManager

pub fn export_state(&self) -> NodeKeyManagerState

Export state for persistence

pub fn from_state( state: NodeKeyManagerState, logger: Arc<Logger>, ) -> Result<Self>

Import state from persistence

Trait Implementations

impl EnvelopeCrypto for NodeKeyManager

fn encrypt_with_envelope( &self, data: &[u8], network_id: Option<&str>, _profile_public_keys: Vec<Vec<u8>>, ) -> Result<EnvelopeEncryptedData>

fn decrypt_envelope_data(&self, env: &EnvelopeEncryptedData) -> Result<Vec<u8>>