Trait Keystore 

pub trait Keystore: Send + Sync {
    // Required methods
    fn seal(&self, aad: &[u8], plaintext: &[u8]) -> StoreResult<Vec<u8>>;
    fn open_sealed(
        &self,
        aad: Vec<u8>,
        ciphertext: Vec<u8>,
    ) -> StoreResult<Vec<u8>>;
}

Device keystore for sealing and opening secrets under a device-bound key.

Implementations MUST use an AEAD construction (e.g. AES-GCM or ChaCha20-Poly1305) so that aad (additional authenticated data) is authenticated as part of the seal: any mismatch when opening must fail.

Required Methods

fn seal(&self, aad: &[u8], plaintext: &[u8]) -> StoreResult<Vec<u8>>

Seals plaintext under the device-bound key, authenticating aad (additional authenticated data).

plaintext is borrowed rather than owned so that callers holding it in a zeroizing buffer (e.g. Zeroizing<[u8; 32]>) never have to hand ownership of an un-zeroized copy to this trait.

Errors

Returns an error if the keystore refuses the operation or the seal fails.

fn open_sealed(&self, aad: Vec<u8>, ciphertext: Vec<u8>) -> StoreResult<Vec<u8>>

Opens ciphertext under the device-bound key, verifying aad. The same aad supplied at seal time must be supplied here or the open operation must fail.

Errors

Returns an error if authentication fails or the keystore cannot open.

Dyn Compatibility

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors