Struct SealingKeysProxy

pub struct SealingKeysProxy { /* private fields */ }

Implementations

impl SealingKeysProxy

pub fn new(channel: AsyncChannel) -> Self

Create a new Proxy for fuchsia.security.keymint/SealingKeys.

pub fn take_event_stream(&self) -> SealingKeysEventStream

Get a Stream of events from the remote end of the protocol.

Panics

Panics if the event stream was already taken.

pub fn create_sealing_key( &self, key_info: &[u8], ) -> QueryResponseFut<SealingKeysCreateSealingKeyResult, DefaultFuchsiaResourceDialect>

Generates a new sealing key to seal and unseal secrets.

|key_info| is information to be cryptographically bound to the returned key.

• The client will have to supply it in all uses (other than key deletion) of the returned key.
• It serves two purposes: (1) internally by the key manager to identify the key owner and (2) as a password to mitigate potential attacks from the key manager and as well as other clients.
• It is recommended to include sufficient entropy in it (using it as a password) to mitigage potential attacks from the secure world (the key manager’s execution environment) or from other clients.
• It is acceptible to pass a constant if deriving and persisting a password is too cumbersome and the client fully trust the secure world and there are not many other clients.

The client is responsible for persisting both |key_info| and the returned |key_blob|. The key blob is encrypted with a TEE-private key. It is guaranteed to be unique for each call (even with the same key info). It can be stored in unsecure storage.

Returns:

• The sealing key if everything worked.
• FAILED_CREATE if the key creation failed, e.g., the |key_info| was empty.

pub fn seal( &self, key_info: &[u8], key_blob: &[u8], secret: &[u8], ) -> QueryResponseFut<SealingKeysSealResult, DefaultFuchsiaResourceDialect>

Seals a secret using a sealing key identified by its info and blob:

• The key info has to match the one supplied when generating the sealing key.

Note that the secret may be a key itself. It has no bearing on the seal operation.

Returns:

• The sealed secret if everything worked.
• FAILED_SEAL if the sealing failed, e.g., sealing key info or blob mismatch.

pub fn unseal( &self, key_info: &[u8], key_blob: &[u8], sealed_secret: &[u8], ) -> QueryResponseFut<SealingKeysUnsealResult, DefaultFuchsiaResourceDialect>

Unseals a sealed secret using a sealing key identified by its info and blob:

• The key info has to match the one supplied when generating the sealing key.
• The key blob has to match the one used to seal the secret.

Note that the secret may be a key itself. It has no bearing on the unseal operation.

Returns:

• The unsealed secret if everything worked.
• FAILED_UNSEAL if the unsealing failed, e.g., sealing key info or blob mismatch.

Trait Implementations

impl Clone for SealingKeysProxy

fn clone(&self) -> SealingKeysProxy

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SealingKeysProxy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Proxy for SealingKeysProxy

type Protocol = SealingKeysMarker

The protocol which this Proxy controls.

fn from_channel(inner: AsyncChannel) -> Self

Create a proxy over the given channel.

fn into_channel(self) -> Result<AsyncChannel, Self>

Attempt to convert the proxy back into a channel.

fn as_channel(&self) -> &AsyncChannel

Get a reference to the proxy’s underlying channel.

fn into_client_end(self) -> Result<ClientEnd<Self::Protocol>, Self>

Attempt to convert the proxy back into a client end.

fn is_closed(&self) -> bool

Returns true if the proxy has received the PEER_CLOSED signal.

fn on_closed(&self) -> OnSignals<'_, Unowned<'_, Handle>>

Returns a future that completes when the proxy receives the PEER_CLOSED signal.

impl SealingKeysProxyInterface for SealingKeysProxy

type CreateSealingKeyResponseFut = QueryResponseFut<Result<Vec<u8>, CreateError>>

type SealResponseFut = QueryResponseFut<Result<Vec<u8>, SealError>>

type UnsealResponseFut = QueryResponseFut<Result<Vec<u8>, UnsealError>>

fn create_sealing_key( &self, key_info: &[u8], ) -> Self::CreateSealingKeyResponseFut

fn seal( &self, key_info: &[u8], key_blob: &[u8], secret: &[u8], ) -> Self::SealResponseFut

fn unseal( &self, key_info: &[u8], key_blob: &[u8], sealed_secret: &[u8], ) -> Self::UnsealResponseFut