Struct KeyDeriver 

pub struct KeyDeriver { /* private fields */ }

Cached HKDF pseudo-random key with zeroize-on-drop.

Runs HKDF-Extract once at construction with the fixed domain-separation salt, stores the 32-byte PRK, and reconstructs the HKDF expander on each derive call. The PRK is root-equivalent key material and is zeroized when the KeyDeriver is dropped.

Implementations

impl KeyDeriver

pub fn new(root_secret: &[u8; 32]) -> Self

Create from a root secret. Runs HKDF-Extract once and stores the PRK.

pub fn derive(&self, purpose: KeyPurpose) -> [u8; 32]

Derive a 32-byte key for a flat (non-parameterized) purpose.

pub fn derive_all(&self) -> DerivedKeys

Derive all flat-purpose keys.

pub fn signing_seed(&self) -> [u8; 32]

Derive THE identity Ed25519 seed (32 bytes). Used for mesh signing, git commit signing, personal attribution.

pub fn ssh_host_seed(&self) -> [u8; 32]

Derive SSH host Ed25519 seed (32 bytes).

pub fn age_secret(&self) -> [u8; 32]

Derive age X25519 private key (32 bytes).

pub fn git_signing_seed(&self) -> [u8; 32]

Derive git commit signing Ed25519 seed (32 bytes). This is now the same key as signing_seed() — the unified identity key.

pub fn i2p_signing_seed(&self) -> [u8; 32]

Derive I2P destination signing key (Ed25519 seed, 32 bytes).

pub fn i2p_encryption_secret(&self) -> [u8; 32]

Derive I2P destination encryption key (X25519, 32 bytes).

pub fn tor_seed(&self) -> [u8; 32]

Derive Tor onion v3 service key (Ed25519 seed, 32 bytes).

pub fn derive_agent_key( &self, agent_name: &str, ) -> Result<[u8; 32], DeriveError>

Derive a per-agent Ed25519 signing seed via two-level HKDF.

pub fn derive_ssh_user_key(&self, label: &str) -> Result<[u8; 32], DeriveError>

Derive a per-label SSH user Ed25519 seed via two-level HKDF.

pub fn derive_i2p_service( &self, service_name: &str, ) -> Result<([u8; 32], [u8; 32]), DeriveError>

Derive a per-service I2P destination key pair via two-level HKDF. Returns (signing_seed, encryption_secret) — both 32 bytes.

pub fn derive_onion_service( &self, service_name: &str, ) -> Result<[u8; 32], DeriveError>

Derive a per-service Tor onion v3 key via two-level HKDF.

Trait Implementations

impl Drop for KeyDeriver

fn drop(&mut self)

Executes the destructor for this type.