Struct DerivedKeys 

pub struct DerivedKeys { /* private fields */ }

Separate encryption and authorship keys for one audience.

Implementations

impl DerivedKeys

pub fn authorship_hasher(&self) -> AuthorshipHasher

Hash a write part’s authorship leaves and branches under this audience’s key, so only its readers can test a row guess (D9, D11).

pub fn seal_object_chunk( &self, path: &str, prefix: &[u8], section: u64, index: u64, plaintext: &[u8], ) -> Result<Vec<u8>, CryptoError>

Seal one chunk with this audience’s derived encryption key (Appendix D). See EncryptionKey::seal_object_chunk for section and index numbering.

pub fn reseal_object_chunk( &self, path: &str, prefix: &[u8], section: u64, index: u64, plaintext: &[u8], ) -> Vec<u8>

Re-seal an inner-write or sequence-slot chunk identically on every attempt (D9/D11). The nonce binds the path, complete cleartext prefix, section, index and SHA-256 of the complete chunk plaintext, including any frame bytes. Different content at a reused path has different nonce inputs. Retries fix plaintext, prefix and key choices to reproduce the same bytes. Snapshots, floors and join requests use seal_object_chunk instead.

pub fn open_object_chunk( &self, path: &str, prefix: &[u8], section: u64, index: u64, sealed: &[u8], ) -> Result<Vec<u8>, CryptoError>

Open a chunk only at its authenticated path, prefix, section and index. Panics if the storage path is empty.

pub fn open_identified_header<const N: usize>( &self, prefix: &[u8], sealed: &[u8], identity: impl FnOnce(&[u8; N]) -> Result<String, CryptoError>, ) -> Result<Vec<u8>, CryptoError>

Open a header whose authentication identity is inside its plaintext. identity receives only the fixed routing prefix as an untrusted hint; it must only construct the identity, never install or report that hint. No plaintext is returned until the ordinary AEAD check succeeds with the selected identity, exact prefix, and header coordinates (0, 0).

D9 inner writes use this because their stable write number is sealed. ChaCha’s keystream does not depend on associated data (RFC 8439 §2.8). The tentative bytes and cipher state are erased after routing.

Trait Implementations

impl Debug for DerivedKeys

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.