Struct TimeLockSalts 

pub struct TimeLockSalts {
    pub s1: [u8; 32],
    pub s2: [u8; 32],
    pub s3: [u8; 32],
}

Three independent 32-byte random salts — one per KDF pass.

Generate once at encryption time via TimeLockSalts::generate and store 96 bytes in the ciphertext header. The same TimeLockSalts must be supplied to [derive_key_now] / [derive_key_at] at decryption time.

Salts are not secret — they only prevent precomputation attacks. All three fields are zeroized when this value is dropped.

Fields

s1: [u8; 32]

Salt for the first Argon2id pass.

s2: [u8; 32]

Salt for the scrypt pass.

s3: [u8; 32]

Salt for the final Argon2id pass.

Implementations

impl TimeLockSalts

pub fn generate() -> Self

Generate three independent 32-byte salts from the OS CSPRNG.

Examples found in repository

examples/timelock_round_trip.rs (line 28)

fn main() {
    // ── Encryption side ───────────────────────────────────────────────────────
    // Generate fresh salts.  Salts are NOT secret — store them in plaintext
    // alongside the ciphertext so the decryption side can reproduce the key.
    let salts = TimeLockSalts::generate();

    // Use a deliberately fast preset so the example finishes quickly.
    // In production use KdfPreset::Balanced or stronger.
    let kdf = KdfPreset::Balanced.params();

    // Lock to any Tuesday at 18:00 (hour-precision window = the full 18:00–18:59 block).
    let cadence   = TimeLockCadence::DayOfWeek(Weekday::Tuesday);
    let lock_time = TimeLockTime::new(18, 0).unwrap();

    println!("Deriving encryption key (this may take a few seconds)…");
    let enc_key = TimelockBuilder::encrypt()
        .cadence(cadence.clone())
        .time(lock_time)
        .precision(TimePrecision::Hour)
        .format(TimeFormat::Hour24)
        .salts(salts.clone())
        .kdf(kdf)
        .derive()
        .expect("encryption-side key derivation failed");

    println!("enc_key[:8] = {:02x?}", &enc_key.as_bytes()[..8]);

    // Pack every setting — including salts and KDF params — into a compact header.
    // This header goes into the ciphertext in plaintext; nothing here is secret.
    let header = pack(
        TimePrecision::Hour,
        TimeFormat::Hour24,
        &cadence,
        salts,
        kdf,
    );

    // ── Decryption side ───────────────────────────────────────────────────────
    // Load `header` from the ciphertext and call TimelockBuilder::decrypt at the
    // matching time slot.  All settings are read from the header automatically.
    println!("Deriving decryption key from system clock…");
    let dec_key = TimelockBuilder::decrypt(header)
        .derive()
        .expect("decryption-side key derivation failed");

    println!("dec_key[:8] = {:02x?}", &dec_key.as_bytes()[..8]);

    // ── Verdict ───────────────────────────────────────────────────────────────
    if enc_key.as_bytes() == dec_key.as_bytes() {
        println!("\nKeys match ✓  — running on a Tuesday at 18:xx");
    } else {
        println!("\nKeys differ — not running on a Tuesday at 18:xx (expected outside that window)");
    }
}

pub fn from_bytes(s1: [u8; 32], s2: [u8; 32], s3: [u8; 32]) -> Self

Construct from raw bytes (e.g. when loading from a ciphertext header).

pub fn to_bytes(&self) -> [u8; 96]

Serialize to 96 contiguous bytes (s1 ∥ s2 ∥ s3) for header storage.

pub fn from_slice(b: &[u8; 96]) -> Self

Deserialize from 96 contiguous bytes produced by [to_bytes].

Trait Implementations

impl Clone for TimeLockSalts

fn clone(&self) -> TimeLockSalts

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TimeLockSalts

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Drop for TimeLockSalts

Available on crate features enc-timelock-keygen-now or enc-timelock-keygen-input or enc-timelock-async-keygen-now or enc-timelock-async-keygen-input only.

fn drop(&mut self)

Executes the destructor for this type.

impl Zeroize for TimeLockSalts

Available on crate features enc-timelock-keygen-now or enc-timelock-keygen-input or enc-timelock-async-keygen-now or enc-timelock-async-keygen-input only.

fn zeroize(&mut self)

Zero out this object from memory using Rust intrinsics which ensure the zeroization operation is not “optimized away” by the compiler.