Struct lock_keeper::crypto::generic::Encrypted

pub struct Encrypted<T> {
    pub(super) ciphertext: Vec<u8>,
    pub(super) associated_data: AssociatedData,
    pub(super) nonce: Nonce,
    pub(super) original_type: PhantomData<T>,
}

A ciphertext representing an object of type T, encrypted under the ChaCha20Poly1305 scheme for authenticated encryption with associated data (AEAD).

As implied by the scheme name, this uses the recommended 20 rounds and a standard 96-bit nonce. For more details, see the ChaCha20Poly1305 crate.

Fields

ciphertext: Vec<u8>

associated_data: AssociatedData

nonce: Nonce

original_type: PhantomData<T>

Implementations

impl Encrypted<Secret>

pub fn decrypt_secret( self, storage_key: StorageKey ) -> Result<Secret, LockKeeperError>

Decrypt a secret. This should be run as part of the subprotocol to retrieve a secret from the server.

This must be run by the client.

impl Encrypted<DataBlob>

pub fn decrypt_data_blob( self, remote_storage_key: &RemoteStorageKey ) -> Result<DataBlob, LockKeeperError>

Decrypt data blob server-side.

impl<T> Encrypted<T>

where T: TryFrom<Vec<u8>>, CryptoError: From<<T as TryFrom<Vec<u8>>>::Error> + From<<Vec<u8> as TryFrom<T>>::Error>, Vec<u8>: TryFrom<T>,

pub(super) fn encrypt( rng: &mut (impl CryptoRng + RngCore), enc_key: &EncryptionKey, object: T, associated_data: &AssociatedData ) -> Result<Encrypted<T>, CryptoError>

Encrypt the T and authenticate the AssociatedData under the EncryptionKey.

Raises a [CryptoError::EncryptionFailed] if encryption fails.

pub(super) fn decrypt_inner( self, enc_key: &EncryptionKey ) -> Result<T, CryptoError>

Decrypt the ciphertext to a T.

Raises a [CryptoError::DecryptionFailed] if decryption fails or [CryptoError::ConversionError] if the decrypted plaintext cannot be converted into T.

impl Encrypted<SigningKeyPair>

pub fn decrypt_signing_key( self, storage_key: StorageKey, user_id: UserId, key_id: KeyId ) -> Result<SigningKeyPair, LockKeeperError>

Decrypt a signing key. This should be run as part of the subprotocol to retrieve an encrypted signing key from the server.

This must be run by the client.

pub fn decrypt_signing_key_by_server( self, remote_storage_key: &RemoteStorageKey, user_id: UserId, key_id: KeyId ) -> Result<SigningKeyPair, LockKeeperError>

Decrypt a signing key. This should be run by the server as part of the subprotocol to retrieve a signing key from the server.

fn decrypt( self, encryption_key: &EncryptionKey, user_id: UserId, key_id: KeyId, possible_context_strings: Vec<&str> ) -> Result<SigningKeyPair, LockKeeperError>

impl Encrypted<StorageKey>

pub fn decrypt_storage_key( self, master_key: MasterKey, user_id: &UserId ) -> Result<StorageKey, LockKeeperError>

Decrypt a storage key. This should be run as part of the subprotocol to retrieve a storage key from the server.

This must be run by the client. It takes the following steps:

1. Derive the decryption key from the master key using the associated data
2. Decrypt the encrypted storage key using the decryption key
3. Return the decrypted StorageKey

impl Encrypted<OpaqueSessionKey>

pub fn decrypt_session_key( self, remote_storage_key: &RemoteStorageKey ) -> Result<OpaqueSessionKey, LockKeeperError>

Decrypt a session key server-side.

impl Encrypted<Message>

pub fn decrypt_message( self, session_key: &OpaqueSessionKey ) -> Result<Message, LockKeeperError>

pub fn try_into_message(self) -> Result<Message, LockKeeperError>

Translates an Encrypted<Message> to a Message in order to be sent through an authenticated channel.

pub fn try_from_message(message: Message) -> Result<Self, LockKeeperError>

Translates a Message received through an authenticated channel to an Encrypted<Message>.

Trait Implementations

impl<T: Clone> Clone for Encrypted<T>

fn clone(&self) -> Encrypted<T>

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<T: Debug> Debug for Encrypted<T>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de, T> Deserialize<'de> for Encrypted<T>

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl<T: PartialEq> PartialEq for Encrypted<T>

fn eq(&self, other: &Encrypted<T>) -> bool

This method tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

This method tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl<T> Serialize for Encrypted<T>

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl TryFrom<RetrievedSecret> for Encrypted<Secret>

type Error = LockKeeperError

The type returned in the event of a conversion error.

fn try_from(secret: RetrievedSecret) -> Result<Self, Self::Error>

Performs the conversion.

impl TryFrom<StoredSecret> for Encrypted<SigningKeyPair>

type Error = LockKeeperError

The type returned in the event of a conversion error.

fn try_from(secret: StoredSecret) -> Result<Self, Self::Error>

Performs the conversion.

impl<T: Eq> Eq for Encrypted<T>

impl<T> StructuralPartialEq for Encrypted<T>