Module crypto 

Cryptographic primitives for void.

Low-level crypto primitives (AEAD, envelope, KDF, KeyVault) are defined in the void-crypto crate. This module re-exports them and adds void-core-specific extensions:

• CommitReader with decrypt_metadata(), decrypt_shard(), etc.
• collect_ancestor_content_keys_vault() (needs ObjectStore + Commit types)

Re-exports

pub use reader::collect_ancestor_content_keys_vault;

pub use reader::decrypt_shard_data;

pub use reader::CommitPlaintext;

pub use reader::CommitReader;

pub use reader::DecryptedShard;

Modules

reader

CommitReader: encapsulates the commit->metadata->shard key derivation chain.

Structs

CommitCid

CID pointing to an envelope-encrypted commit blob (AAD_COMMIT).

ContentKey

A 32-byte content key derived from a commit’s envelope nonce.

EncryptedCommit

Encrypted commit blob (AAD_COMMIT).

EncryptedIndex

Encrypted workspace index blob (AAD_INDEX).

EncryptedManifest

Encrypted tree manifest blob (AAD_MANIFEST).

EncryptedMetadata

Encrypted metadata bundle blob (AAD_METADATA).

EncryptedRepoManifest

Encrypted repo manifest blob (AAD_REPO_MANIFEST).

EncryptedShard

Encrypted content shard blob (AAD_SHARD).

EncryptedStaged

Encrypted staged file content blob (AAD_STAGED).

EncryptedStash

Encrypted stash stack metadata blob (AAD_STASH).

KeyRing

Key ring holding all derived keys - zeroed on drop.

KeyVault

Holds repository key material and provides all key-dependent operations.

ManifestCid

CID pointing to an AEAD-encrypted tree manifest (AAD_MANIFEST).

MetadataCid

CID pointing to an AEAD-encrypted metadata bundle (AAD_METADATA).

Nonce

A fixed-size cryptographic nonce.

RepoManifestCid

CID pointing to an AEAD-encrypted repo manifest (AAD_REPO_MANIFEST).

RepoSecret

A 32-byte random secret used for shard path hashing (NOT an encryption key).

SecretKey

A 32-byte derived key that is zeroed on drop.

ShardCid

CID pointing to an encrypted shard blob (AAD_SHARD).

Enums

CryptoError

Errors that can occur in void-crypto.

KeyPurpose

Key purposes for derivation.

Constants

AAD_COMMIT

AAD for commit objects.

AAD_INDEX

AAD for index objects.

AAD_MANIFEST

AAD for tree manifest objects.

AAD_METADATA

AAD for metadata bundle objects.

AAD_REPO_MANIFEST

AAD for repo manifest (collaboration manifest JSON).

AAD_SHARD

AAD for shard objects.

AAD_SHARD_KEY

AAD for shard key wrapping (content_key wraps shard_key).

AAD_STAGED

AAD for staged content blobs.

AAD_STASH

AAD for stash objects.

MAGIC_V1

Magic bytes identifying envelope format version 1.

Traits

EncryptedBlob

Common interface for typed encrypted blob newtypes.

Functions

decrypt

Decrypts ciphertext using AES-256-GCM with Additional Authenticated Data (AAD).

decrypt_and_parse

Decrypt and parse a CBOR-encoded type.

decrypt_envelope

Decrypts a blob with envelope format (VD01 header required).

decrypt_to_vec

Decrypts ciphertext into a byte buffer.

derive_key

Derives a 32-byte key from the root key using HKDF-SHA256.

derive_key_for_purpose

Derive a purpose-specific key from the root key.

derive_scoped_key

Derive a scoped read key from a root key.

encrypt

Encrypts plaintext using AES-256-GCM with Additional Authenticated Data (AAD).

encrypt_with_envelope

Encrypts plaintext using a derived key and wraps it in an envelope.

generate_key

Generates a cryptographically secure random 32-byte key.

generate_key_nonce

Generates a cryptographically secure random key nonce.

unwrap_shard_key

Unwrap a shard key that was wrapped under a content key.

wrap_shard_key

Wrap a shard key under a content key using AES-256-GCM.

Type Aliases

CryptoResult

Result type for void-crypto operations.

KeyNonce

16-byte nonce for VD01 envelope key derivation.