Struct HardenedConfig 

pub struct HardenedConfig {
    pub enabled: bool,
    pub storage_key_salt: String,
}

Non-TEE hardened configuration: derive storage-encryption and JWT signing keys from the master seed, so neither secret lives in config.toml or on disk.

This PoC mirrors the key-derivation that vta-enclave performs inside the Nitro enclave (see tee::kms_bootstrap), without requiring KMS or an enclave. The seed must reside in a real secret-store backend — the plaintext file fallback (PlaintextSeedStore) defeats the protection.

Enable in config.toml:

[hardened]
enabled = true
storage_key_salt = "my-unique-per-vta-salt"

Enabling on an existing VTA is handled automatically. The first boot after setting this flag converts the existing plaintext rows to the encrypted format before anything reads them (hardened_bootstrap::migrate_store_to_encrypted). The pass is idempotent and crash-safe, so it costs one prefix scan per keyspace on later boots and an interrupted run is finished by the next one.

It has to be automatic: the store’s decrypt path is deliberately fail-closed with no plaintext fallback, so a VTA that started reading an unconverted store would fail on every pre-existing row — including its own ACL entries. Take a backup first regardless; the conversion rewrites every row in place.

Fields

enabled: bool

When true, enables hardened non-TEE configuration:

• All 23 fjall keyspaces are encrypted with AES-256-GCM (VAE1 format, same as TEE mode). The storage-encryption key is derived from the master seed via HKDF.
• The JWT signing key is generated randomly on first boot, AES-GCM sealed under the storage key, and stored in the bootstrap keyspace. It is injected into memory only — [auth] jwt_signing_key in config.toml is absent and ignored.

Default false (standard non-TEE behaviour — plaintext fjall, JWT key in config.toml).

storage_key_salt: String

Salt for the HKDF storage-key derivation.

Changing this invalidates all encrypted data. Set it once at initial setup and treat it as permanent. Ignored when enabled = false.

Trait Implementations

impl Clone for HardenedConfig

fn clone(&self) -> HardenedConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for HardenedConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for HardenedConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for HardenedConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for HardenedConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.