Struct GuardedKey 

pub struct GuardedKey { /* private fields */ }

Memory-hardened key vault backed by 128 indistinguishable static arrays.

Implementations

impl GuardedKey

pub const fn empty() -> Self

pub fn store_from_keys(&self, keys: &Keys, others: &[&GuardedKey])

Extract the secret key from a Keys struct, store it in the vault, and zeroize the intermediate bytes. One-liner replacement for the repeated extract -> set -> zeroize pattern across login paths.

others is a slice of references to other active GuardedKey instances for cross-key protection during decoy writes.

pub fn set(&self, key: [u8; 32], others: &[&GuardedKey])

Store a key. XOR-split into 4 shares scattered across the 128 arrays, with decoy writes to ALL arrays so real writes are indistinguishable.

others is a slice of references to other active GuardedKey instances for cross-key protection during decoy writes.

INVARIANT: pass EVERY other live key. A key’s lane is chosen by excluding only others’ lanes, so an omitted live key can collide and clobber it.

pub fn get(&self) -> Option<[u8; 32]>

Recover the key. Zero writes — invisible to snapshot diffing.

pub fn clear(&self, others: &[&GuardedKey])

Clear the key. Overwrites shares with random values, writes decoys to all arrays.

others is a slice of references to other active GuardedKey instances for cross-key protection during decoy writes.

pub fn has_key(&self) -> bool

pub fn to_keys(&self) -> Option<Keys>