Enum SealingKeysRequest

pub enum SealingKeysRequest {
    CreateSealingKey {
        key_info: Vec<u8>,
        responder: SealingKeysCreateSealingKeyResponder,
    },
    Seal {
        key_info: Vec<u8>,
        key_blob: Vec<u8>,
        secret: Vec<u8>,
        responder: SealingKeysSealResponder,
    },
    Unseal {
        key_info: Vec<u8>,
        key_blob: Vec<u8>,
        sealed_secret: Vec<u8>,
        responder: SealingKeysUnsealResponder,
    },
}

Allows a client to generate sealing keys and then use these keys to seal and unseal secrets. Sealed secrets are safe for offline storage.

Note that (un)seal is synonymous with (un)wrap, e.g., wrapping an encryption key is the same as sealing an encryption key.

Variants

CreateSealingKey

Generates a new sealing key to seal and unseal secrets.

|key_info| is information to be cryptographically bound to the returned key.

• The client will have to supply it in all uses (other than key deletion) of the returned key.
• It serves two purposes: (1) internally by the key manager to identify the key owner and (2) as a password to mitigate potential attacks from the key manager and as well as other clients.
• It is recommended to include sufficient entropy in it (using it as a password) to mitigage potential attacks from the secure world (the key manager’s execution environment) or from other clients.
• It is acceptible to pass a constant if deriving and persisting a password is too cumbersome and the client fully trust the secure world and there are not many other clients.

The client is responsible for persisting both |key_info| and the returned |key_blob|. The key blob is encrypted with a TEE-private key. It is guaranteed to be unique for each call (even with the same key info). It can be stored in unsecure storage.

Returns:

• The sealing key if everything worked.
• FAILED_CREATE if the key creation failed, e.g., the |key_info| was empty.

Fields

key_info: Vec<u8>

responder: SealingKeysCreateSealingKeyResponder

Seal

Seals a secret using a sealing key identified by its info and blob:

• The key info has to match the one supplied when generating the sealing key.

Note that the secret may be a key itself. It has no bearing on the seal operation.

Returns:

• The sealed secret if everything worked.
• FAILED_SEAL if the sealing failed, e.g., sealing key info or blob mismatch.

Fields

key_info: Vec<u8>

key_blob: Vec<u8>

secret: Vec<u8>

responder: SealingKeysSealResponder

Unseal

Unseals a sealed secret using a sealing key identified by its info and blob:

• The key info has to match the one supplied when generating the sealing key.
• The key blob has to match the one used to seal the secret.

Note that the secret may be a key itself. It has no bearing on the unseal operation.

Returns:

• The unsealed secret if everything worked.
• FAILED_UNSEAL if the unsealing failed, e.g., sealing key info or blob mismatch.

Fields

key_info: Vec<u8>

key_blob: Vec<u8>

sealed_secret: Vec<u8>

responder: SealingKeysUnsealResponder

Implementations

impl SealingKeysRequest

pub fn into_create_sealing_key( self, ) -> Option<(Vec<u8>, SealingKeysCreateSealingKeyResponder)>

pub fn into_seal( self, ) -> Option<(Vec<u8>, Vec<u8>, Vec<u8>, SealingKeysSealResponder)>

pub fn into_unseal( self, ) -> Option<(Vec<u8>, Vec<u8>, Vec<u8>, SealingKeysUnsealResponder)>

pub fn method_name(&self) -> &'static str

Name of the method defined in FIDL

Trait Implementations

impl Debug for SealingKeysRequest

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.