Enum SealingKeysRequest 

pub enum SealingKeysRequest {
    CreateSealingKey {
        key_info: Vec<u8>,
        responder: SealingKeysCreateSealingKeyResponder,
    },
    Seal {
        key_info: Vec<u8>,
        key_blob: Vec<u8>,
        secret: Vec<u8>,
        responder: SealingKeysSealResponder,
    },
    Unseal {
        key_info: Vec<u8>,
        key_blob: Vec<u8>,
        sealed_secret: Vec<u8>,
        responder: SealingKeysUnsealResponder,
    },
    UpgradeSealingKey {
        key_info: Vec<u8>,
        key_blob: Vec<u8>,
        responder: SealingKeysUpgradeSealingKeyResponder,
    },
}

Allows a client to generate sealing keys and then use these keys to seal and unseal secrets. Sealed secrets are safe for offline storage.

Note that (un)seal is synonymous with (un)wrap, e.g., wrapping an encryption key is the same as sealing an encryption key.

Variants

CreateSealingKey

Generates a new sealing key to seal and unseal secrets.

|key_info| is information to be cryptographically bound to the returned key.

• The client will have to supply it in all uses (other than key deletion) of the returned key.
• It serves two purposes: (1) internally by the key manager to identify the key owner and (2) as a password to mitigate potential attacks from the key manager and as well as other clients.
• It is recommended to include sufficient entropy in it (using it as a password) to mitigage potential attacks from the secure world (the key manager’s execution environment) or from other clients.
• It is acceptible to pass a constant if deriving and persisting a password is too cumbersome and the client fully trust the secure world and there are not many other clients.

The client is responsible for persisting both |key_info| and the returned |key_blob|. The key blob is encrypted with a TEE-private key. It is guaranteed to be unique for each call (even with the same key info). It can be stored in unsecure storage.

Returns:

• The sealing key if everything worked.
• FAILED_CREATE if the key creation failed, e.g., the |key_info| was empty.

Fields

key_info: Vec<u8>

responder: SealingKeysCreateSealingKeyResponder

Seal

Seals a secret using a sealing key identified by its info and blob:

• The key info has to match the one supplied when generating the sealing key.

Note that the secret may be a key itself. It has no bearing on the seal operation.

Returns:

• The sealed secret if everything worked.
• KEY_REQUIRES_UPGRADE if keymint indicates that the sealing key requires upgrade.
• FAILED_SEAL if the sealing failed for another reason, e.g., sealing key info or blob mismatch.

Fields

key_info: Vec<u8>

key_blob: Vec<u8>

secret: Vec<u8>

responder: SealingKeysSealResponder

Unseal

Unseals a sealed secret using a sealing key identified by its info and blob:

• The key info has to match the one supplied when generating the sealing key.
• The key blob has to match the one used to seal the secret.

Note that the secret may be a key itself. It has no bearing on the unseal operation.

Returns:

• The unsealed secret if everything worked.
• KEY_REQUIRES_UPGRADE if keymint indicates that the sealing key requires upgrade.
• FAILED_UNSEAL if the unsealing failed for another reason, e.g., sealing key info or blob mismatch.

Fields

key_info: Vec<u8>

key_blob: Vec<u8>

sealed_secret: Vec<u8>

responder: SealingKeysUnsealResponder

UpgradeSealingKey

Upgrades a sealing key that has been deemed out-of-date by keymint. The sealing key to upgrade is identified by its info and blob:

• The key info has to match the one supplied when generating the sealing key.
• The key blob has to match the blob returned when generating the sealing key.

Note that the client is responsible for discarding the input key_blob and using, instead, the output key_blob for all operations involving the upgraded sealing key.

Returns

• The upgraded key blob if everything worked.
• FAILED_UPGRADE if the upgrade failed.

Fields

key_info: Vec<u8>

key_blob: Vec<u8>

responder: SealingKeysUpgradeSealingKeyResponder

Implementations

impl SealingKeysRequest

pub fn into_create_sealing_key( self, ) -> Option<(Vec<u8>, SealingKeysCreateSealingKeyResponder)>

pub fn into_seal( self, ) -> Option<(Vec<u8>, Vec<u8>, Vec<u8>, SealingKeysSealResponder)>

pub fn into_unseal( self, ) -> Option<(Vec<u8>, Vec<u8>, Vec<u8>, SealingKeysUnsealResponder)>

pub fn into_upgrade_sealing_key( self, ) -> Option<(Vec<u8>, Vec<u8>, SealingKeysUpgradeSealingKeyResponder)>

pub fn method_name(&self) -> &'static str

Name of the method defined in FIDL

Trait Implementations

impl Debug for SealingKeysRequest

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.