Struct PasswordWrapBlob 

pub struct PasswordWrapBlob {
    pub version: u8,
    pub nonce: [u8; 12],
    pub ciphertext: Vec<u8>,
}

Parsed password-wrap blob.

Fields

version: u8

nonce: [u8; 12]

ciphertext: Vec<u8>

32 bytes master key + 16 bytes GCM tag = 48 bytes.

Implementations

impl PasswordWrapBlob

pub fn serialize(&self) -> Vec<u8>

Serialize to the binary format.

pub fn deserialize(data: &[u8]) -> Result<Self, AuthError>

Deserialize from the binary format.

Errors

Returns AuthError::InvalidBlob if the data is truncated or has an unsupported version.

pub fn wrap( master_key: &[u8], kek_bytes: &mut [u8; 32], ) -> Result<Self, AuthError>

Create a new blob by wrapping a master key under a password-derived KEK.

kek_bytes must be 32 bytes (the Argon2id output). Zeroized after use.

Errors

Returns an error if encryption fails or random nonce generation fails.

pub fn unwrap(&self, kek_bytes: &mut [u8; 32]) -> Result<SecureBytes, AuthError>

Unwrap the master key using a password-derived KEK.

kek_bytes must be 32 bytes (the Argon2id output). Zeroized after use.

Errors

Returns AuthError::UnwrapFailed if the KEK is wrong (GCM auth fails).

pub fn path(config_dir: &Path, profile: &TrustProfileName) -> PathBuf

Path to the password-wrap blob for a profile.

pub fn load( config_dir: &Path, profile: &TrustProfileName, ) -> Result<Self, AuthError>

Read blob from disk.

Errors

Returns an error if the file does not exist or is corrupt.

pub fn save( &self, config_dir: &Path, profile: &TrustProfileName, ) -> Result<(), AuthError>

Write blob to disk atomically with restrictive permissions.

Errors

Returns an I/O error if the write fails.

Trait Implementations

impl Drop for PasswordWrapBlob

fn drop(&mut self)

Executes the destructor for this type.