Struct KeyVault 

pub struct KeyVault { /* private fields */ }

High-level Key Management module for the Qualia Node.

Implementations

impl KeyVault

pub fn new() -> Self

Creates an in-memory KeyVault with a fresh ephemeral key (for tests/stubs only).

pub fn is_locked(&self) -> bool

pub fn lock(&mut self)

pub fn unlock(&mut self) -> Result<(), String>

pub fn load_or_generate(storage_dir: &str) -> Result<Self, String>

pub fn derive_key(&self, context_id: &str) -> SigningKey

Derives a deterministic Pairwise or Front Door key from the Master Key. This ensures we can recover all DIDs from the single master root.

pub fn sign_payload( &self, signing_key: &SigningKey, payload: &[u8], ) -> Signature

Computes an Ed25519 signature over a generic byte payload

pub fn get_master_key_bytes(&self) -> [u8; 32]

Exposes the raw bytes of the master key for libp2p identity bindings

pub fn public_key_bytes_for_context(&self, context_id: &str) -> [u8; 32]

Ed25519 verifying key bytes for a context-derived pairwise key.

pub fn verify_signature( public_key_bytes: &[u8; 32], payload: &[u8], signature_bytes: &[u8; 64], ) -> Result<(), String>

Verifies a payload against a given public key bytes

pub fn generate_webid_tls_cert( &self, key: &SigningKey, did_uri: &str, ) -> Result<(String, String), String>

Generates a WebID-TLS / mTLS compatible self-signed X.509 certificate.

The DID URI is placed in the Subject Alternative Name URI extension so transport identity can be bound to the Qualia principal. Uses real rcgen PEM output (not a mock). Private key material is the provided Ed25519 seed encoded as PKCS#8 PEM.

impl KeyVault

pub fn issue_qapp_token( &self, qapp_did: &str, audience: &str, expiry_epoch: u64, nonce: &str, capabilities: Vec<String>, sensitivity_clearance: SubgraphLayer, ) -> Result<String, String>

Issues a cryptographically signed Semantic Token for an installed qapp. The token enforces gatekeeper boundary policies (which shapes the qapp can access).

pub fn verify_qapp_token( &self, token: &str, expected_audience: &str, ) -> Result<QappSessionTokenV2, String>

Verifies a qapp token’s signature using the Master Key, and checks expiry and audience.

impl KeyVault

pub fn generate_layer_key(&self, layer: SubgraphLayer) -> SubgraphKey

Derive a deterministic AES-256-GCM key for layer using HKDF-SHA-256.

IKM = master ed25519 secret key bytes (32 bytes) Salt = b“qualia:subgraph:salt:v1“ Info = layer.label() bytes

pub fn encapsulate_for_recipient( &self, layer_key: &SubgraphKey, recipient_x25519_pub: &[u8; 32], nonce_entropy: &[u8; 32], ) -> Result<EncapsulatedKey, String>

Encapsulate layer_key for a recipient identified by their X25519 public key bytes.

Uses ephemeral X25519 ECDH + AES-256-GCM to wrap the 32-byte layer key. The recipient_x25519_pub is typically derived from the recipient’s DID key material.

Errors

Returns Err if the recipient public key bytes are invalid.

pub fn decapsulate( &self, encapsulated: &EncapsulatedKey, recipient_x25519_secret: &[u8; 32], ) -> Result<SubgraphKey, String>

Decapsulate an EncapsulatedKey using the recipient’s X25519 static secret key bytes.

Returns the 32-byte layer key on success.

pub fn derive_x25519_secret(&self) -> [u8; 32]

Derive the X25519 static secret for this node from the master Ed25519 key.

Used when the node itself is a VC recipient.