@@ -16,17 +16,20 @@ use crate::{
16
16
KeyStoreContext , SymmetricCryptoKey ,
17
17
} ;
18
18
19
- /// A password-protected key envelope can seal a symmetric key, and protect it with a password. It does so
20
- /// by using a Key Derivation Function (KDF), to increase the difficulty of brute-forcing the password.
19
+ /// A password-protected key envelope can seal a symmetric key, and protect it with a password. It
20
+ /// does so by using a Key Derivation Function (KDF), to increase the difficulty of brute-forcing
21
+ /// the password.
21
22
///
22
- /// The KDF parameters such as iterations and salt are stored in the key-envelope and do not have to be provided.
23
+ /// The KDF parameters such as iterations and salt are stored in the key-envelope and do not have to
24
+ /// be provided.
23
25
pub struct PasswordProtectedKeyEnvelope < Ids : KeyIds > {
24
26
_phantom : PhantomData < Ids > ,
25
27
cose_encrypt : coset:: CoseEncrypt ,
26
28
}
27
29
28
30
impl < Ids : KeyIds > PasswordProtectedKeyEnvelope < Ids > {
29
- /// Seals a symmetric key with a password, using the current default KDF parameters and a random salt.
31
+ /// Seals a symmetric key with a password, using the current default KDF parameters and a random
32
+ /// salt.
30
33
///
31
34
/// This should never fail, except for memory allocation error, when running the KDF.
32
35
pub fn seal (
@@ -60,11 +63,12 @@ impl<Ids: KeyIds> PasswordProtectedKeyEnvelope<Ids> {
60
63
kdf_settings : & Argon2RawSettings ,
61
64
) -> Result < Self , PasswordProtectedKeyEnvelopeError > {
62
65
// Cose does not yet have a standardized way to protect a key using a password.
63
- // This implements content encryption using direct encryption with a KDF derived key, similar to
64
- // "Direct Key with KDF". The KDF settings are placed in a single recipient struct.
66
+ // This implements content encryption using direct encryption with a KDF derived key,
67
+ // similar to "Direct Key with KDF". The KDF settings are placed in a single
68
+ // recipient struct.
65
69
66
- // The envelope key is directly derived from the KDF and used as the key to encrypt the key that should
67
- // be sealed.
70
+ // The envelope key is directly derived from the KDF and used as the key to encrypt the key
71
+ // that should be sealed.
68
72
let envelope_key = derive_key ( kdf_settings, password)
69
73
. map_err ( |_| PasswordProtectedKeyEnvelopeError :: KdfError ) ?;
70
74
@@ -100,7 +104,8 @@ impl<Ids: KeyIds> PasswordProtectedKeyEnvelope<Ids> {
100
104
} )
101
105
}
102
106
103
- /// Unseals a symmetric key from the password-protected envelope, and stores it in the key store context.
107
+ /// Unseals a symmetric key from the password-protected envelope, and stores it in the key store
108
+ /// context.
104
109
pub fn unseal (
105
110
& self ,
106
111
target_keyslot : Ids :: Symmetric ,
@@ -117,7 +122,8 @@ impl<Ids: KeyIds> PasswordProtectedKeyEnvelope<Ids> {
117
122
& self ,
118
123
password : & str ,
119
124
) -> Result < SymmetricCryptoKey , PasswordProtectedKeyEnvelopeError > {
120
- // There must be exactly one recipient in the COSE Encrypt object, which contains the KDF parameters.
125
+ // There must be exactly one recipient in the COSE Encrypt object, which contains the KDF
126
+ // parameters.
121
127
if self . cose_encrypt . recipients . len ( ) != 1 {
122
128
return Err ( PasswordProtectedKeyEnvelopeError :: ParsingError (
123
129
"Invalid number of recipients" . to_string ( ) ,
@@ -209,8 +215,8 @@ impl<Ids: KeyIds> TryFrom<&Vec<u8>> for PasswordProtectedKeyEnvelope<Ids> {
209
215
}
210
216
211
217
/// Raw argon2 settings differ from the KDF struct defined for existing master-password unlock.
212
- /// The memory is represented in kibibytes (KiB) instead of mebibytes (MiB), and the salt is a fixed size of 32 bytes,
213
- /// and randomly generated, instead of being derived from the email.
218
+ /// The memory is represented in kibibytes (KiB) instead of mebibytes (MiB), and the salt is a fixed
219
+ /// size of 32 bytes, and randomly generated, instead of being derived from the email.
214
220
struct Argon2RawSettings {
215
221
iterations : u32 ,
216
222
memory : u32 ,
@@ -322,20 +328,20 @@ pub enum PasswordProtectedKeyEnvelopeError {
322
328
/// The envelope could not be parsed correctly, or the KDF parameters are invalid
323
329
#[ error( "Parsing error {0}" ) ]
324
330
ParsingError ( String ) ,
325
- /// The KDF failed to derive a key, possibly due to invalid parameters or memory allocation issues
331
+ /// The KDF failed to derive a key, possibly due to invalid parameters or memory allocation
332
+ /// issues
326
333
#[ error( "Kdf error" ) ]
327
334
KdfError ,
328
335
}
329
336
330
337
#[ cfg( test) ]
331
338
mod tests {
339
+ use super :: * ;
332
340
use crate :: {
333
341
traits:: tests:: { TestIds , TestSymmKey } ,
334
342
KeyStore ,
335
343
} ;
336
344
337
- use super :: * ;
338
-
339
345
#[ test]
340
346
fn test_make_envelope ( ) {
341
347
let key_store = KeyStore :: < TestIds > :: default ( ) ;
0 commit comments