Crate coven_crypto 

Store keys, circle keys, member keys, cryptography and key custody (Appendix D).

Object and file chunks authenticate their storage path, cleartext prefix and coordinates. Every file has an independent key and uses its index as nonce. Secret material is erased on drop and redacted in diagnostic output.

Modules

custody

Where this device keeps its opened keys and its member’s two key pairs (E1).

Structs

AuthorshipHasher

Keyed hashing of one write part’s authorship leaves (D11). Each leaf is keyed with the part’s audience key, so a member who cannot read the audience cannot confirm a guessed row from a published root. Branches and the empty tree are unkeyed: a device holding a part’s leaf hashes can open any of its leaves again without the key.

CircleId

A circle’s identity, independent of its name or current key (§15.5).

CircleKey

One circle’s identified 32-byte key, introduced by creation or rotation (§12.1). Cloning supplies an independent unlocked snapshot to in-memory custody.

ConfirmationNumber

Six digits naming a join request’s keys, which the requester’s device and the admin’s both compute (§13.2). It names only the keys and the invite: the invite secret adds nothing a stranger who saw the code lacks, and the device name is the requester’s free choice. Displays as 041 778.

ContentHash

SHA-256 of a file’s bytes, kept inside encrypted writes (§17).

ContentHasher

A stream’s incremental SHA-256 state; the file never has to fit in memory.

DerivedKeys

Separate encryption and authorship keys for one audience.

EncryptionKey

A purpose-derived key for objects, including an invite’s join request (Appendix D).

FileKey

A random 32-byte key for one immutable file, erased on drop. Never reuse this key and a chunk index with different plaintext.

InviteSecret

The one-time invite secret lets a person ask to join, not open the store (§13.2).

MemberIdentity

This device’s member: the stable id and every private pair it holds (E1, E11). Identity custody keeps it; the id never derives from the keys. The active pair is the one the last installed binding made current. A self-replacement keeps its candidate here before publishing it, and every pair a kept replacement retired stays held, because copies name the exact credential they open with (§12.1). Which pair may sign is replay’s decision, never this record’s (§12.3).

MemberKeys

A member’s Ed25519 signing pair and independent X25519 sealing pair (Appendix D). Both secrets erase on drop. Clone is needed by in-memory custody to keep its keys while returning an independently owned unlocked pair.

MemberPublicKeys

A member’s public signing and sealing keys, independent of their stable MemberId (§10, D2). Creation, addition and replacement bind a pair to an id.

ObjectDigest

SHA-256 of every object byte before its signature, including its sealed chunks.

ObjectHasher

Incremental SHA-256 state for an object’s bytes in storage order.

SealingKey

The public half of a member’s X25519 pair, used for anonymous sealed keys. A copy names the exact sealing key it is sealed to (D9).

SecretBytes

Secret bytes for custody or a restore code, erased on drop and never printed. Callers retaining a copy are responsible for erasing that copy too.

SecretText

UTF-8 secret text, erased on drop and redacted in diagnostic output. Callers retaining a copy are responsible for erasing that copy too.

Signature

A detached Ed25519 signature on bytes authored by a member (§12).

SigningKey

A member’s validated Ed25519 public signing key (Appendix D). It is bound to a stable MemberId by admin entries and is never that identity.

StoreKey

A store’s identified 32-byte key (§12), erased on drop. Cloning supplies an independent unlocked snapshot to in-memory custody.

StoreKeyring

Every store and circle key this device has opened, including older keys (§12.2). Cloning lets in-memory custody keep its copy while returning an unlocked one.

Enums

CryptoError

A cryptographic operation could not produce or authenticate its result.

MaterialError

A key or serialized secret violates its representation.

Constants

FILE_CHUNK_TAG_LEN

Bytes added to a file chunk: its authentication tag, without a stored nonce.

KEY_BOX_HEAD_LEN

A key box’s bytes before its ciphertext: the ephemeral public key, then the nonce.

KEY_BOX_TAG_LEN

A key box’s authentication tag, after its ciphertext.

SEALED_OBJECT_CHUNK_OVERHEAD

Bytes added to each sealed object chunk: its stored nonce and authentication tag.

SIGNATURE_LEN

The bytes of a detached Ed25519 signature.

Functions

authorship_empty

The root of an authorship tree with no leaves (D11).

authorship_node

A branch of an authorship tree over its ordered children (D11).

aws_request_signature

AWS Signature Version 4 over a request’s string to sign. The signing key derives from the secret through the date, region and service scope; intermediate keys and the prefixed secret are erased on drop.

gcs_request_signature

Google V4 HMAC signature using the account’s interoperability secret. Date and region are the exact credential-scope components in the request. Intermediate signing keys and the prefixed secret are erased on drop.

kept_value_digest

The digest an accepted change’s kept record holds in place of a value nothing reads in full (D7.3): SHA-256 over the context-framed label coven/kept-value/v1 and the value’s encoded bytes. Two values have equal digests exactly when their encodings are equal, under SHA-256’s collision resistance.

random_secret

A fresh random secret of 32 bytes as lowercase hex, for a credential coven sets but nobody keeps, such as a service’s parent user (Appendix E.12).

refuse_randomness

Refuse the next count requests for randomness on this thread, as a system whose random source fails would. Randomness comes from the system with no handle to arm, and a thread’s count leaves other tests alone.

s3_request_hash

SHA-256 of a native request body or canonical request, before V4 signing.

seal_circle_key

Seal a circle key anonymously, authenticating its path and exact clear prefix (D11). Returns ephemeral key, nonce, ciphertext and tag; format supplies the prefix. Panics if the storage path is empty.

seal_store_key

Seal a store key anonymously, authenticating its path and exact clear prefix (D11). Returns ephemeral key, nonce, ciphertext and tag; format supplies the prefix. Panics if the storage path is empty.