Struct Delegation

Source

pub struct Delegation {
    pub epoch: u64,
    pub release_key: [u8; 32],
    pub expires: u64,
}

Expand description

A statement, signed by a device’s trust anchor, naming the key that may sign its updates.

§Examples

use pamoja_security::DeviceIdentity;
use pamoja_update::{Delegation, DELEGATION_MAX};

let anchor = DeviceIdentity::from_seed(&[1u8; 32]);
let release = DeviceIdentity::from_seed(&[2u8; 32]);

let delegation = Delegation {
    epoch: 1,
    release_key: release.public().to_bytes(),
    expires: 0,
};

let mut buf = [0u8; DELEGATION_MAX];
let written = delegation.sign(&anchor, &mut buf).unwrap();

let adopted = Delegation::open(&buf[..written], &anchor.public()).unwrap();
assert_eq!(adopted, delegation);

Fields§

§epoch: u64

Rises with every rotation. A device refuses a delegation not above the one it holds, so a retired key cannot be reinstated by replaying the statement that once authorised it.

§release_key: [u8; 32]

The public key that may sign manifests while this delegation stands.

§expires: u64

When this delegation stops being honoured, in seconds since the Unix epoch, or 0 to never expire. Setting one requires the device to have a clock.

Implementations§

Source §

impl Delegation

Source

pub fn encode(&self, buf: &mut [u8]) -> Result<usize>

Encodes the delegation body, which is the part a signature covers.

§Arguments

buf - the destination.

§Returns

How many bytes were written.

§Errors

Returns Refusal::Malformed if buf is too small.

Source

pub fn decode(bytes: &[u8]) -> Result<Self>

Decodes a delegation body.

§Arguments

bytes - an encoded delegation body.

§Returns

The delegation.

§Errors

Returns Refusal::Malformed if the encoding is not a well-formed delegation with its keys in order.

Source

pub fn sign(&self, anchor: &DeviceIdentity, buf: &mut [u8]) -> Result<usize>

Encodes the delegation and signs it with the trust anchor.

§Arguments

anchor - the trust anchor’s identity, which alone may delegate.
buf - the destination, at least DELEGATION_MAX bytes.

§Returns

How many bytes of buf the envelope occupies.

§Errors

Returns Refusal::Malformed if buf is too small.

Source

pub fn open(envelope: &[u8], anchor: &PublicIdentity) -> Result<Self>

Checks a delegation envelope against a trust anchor and reads it.

§Arguments

envelope - the signed delegation.
anchor - the key the device anchors its trust in.

§Returns

The delegation, now known to be from the anchor and unaltered.

§Errors

Returns Refusal::Signature if it is not the anchor’s, or a decoding refusal if the body is not a valid delegation.

Source

pub fn signer(&self) -> Result<PublicIdentity>

Returns the release key as an identity that can check a manifest.

§Returns

The delegated public key.

§Errors

Returns Refusal::Signature if the delegated bytes are not a usable public key, so a malformed delegation cannot leave a device trusting nothing while believing it trusts something.