Source: aegis/aegis-keys/src/generation.rs. SHA-256: 269bc2cd45a672afd924e928f31b343efb09b3ea812d06d0ffce261ae1bc4a35.

This source reference follows declared modules and preserves feature attributes. It includes public declarations and implementation methods in those modules. Private-module exports and trait resolution still require the compiler; not every declaration is a crate-root import. Function bodies and constant values are omitted. Source comments describe their implementation context and are not a production deployment claim.

generation::ManagedKey

A managed key with metadata (AEGIS Spec SS6.2).

The private key is stored in encrypted form and never exposed directly. All access to the signing key requires the encryption key.

#[derive(Debug)]
pub struct ManagedKey {
/// Unique key identifier (UUID v7-based).

pub key_id: String,
/// Role of this key within the AEGIS identity framework.

pub role: KeyRole,
/// How this key was generated.

pub generation_mode: KeyGenerationMode,
/// The Ed25519 verifying (public) key.

pub public_key: VerifyingKey,
/// Timestamp when this key was created.

pub created_at: DateTime<Utc>
}

Source line: 26.

generation::ManagedKey::from_stored_parts

Reconstruct a ManagedKey from its serialized components.

This constructor is intended for storage backends that need to reconstitute a ManagedKey from persisted columns.

Errors

Returns KeyError::StorageError if the nonce length is invalid or the public key bytes are malformed.

pub fn from_stored_parts(
        key_id: String,
        role: KeyRole,
        generation_mode: KeyGenerationMode,
        public_key: VerifyingKey,
        ciphertext: Vec<u8>,
        nonce: Vec<u8>,
        created_at: DateTime<Utc>,
    ) -> Result<Self, KeyError>;

Source line: 51.

generation::ManagedKey::public_key_multibase

Returns the public key encoded as multibase base58btc (with z prefix).

This is the canonical format for publicKeyMultibase in OAS Identity Documents.

pub fn public_key_multibase(&self) -> String;

Source line: 74.

generation::ManagedKey::decrypt_private

Decrypt the private key using the provided encryption key.

The caller is responsible for zeroizing the returned SigningKey when done.

pub fn decrypt_private(&self, encryption_key: &[u8; 32]) -> Result<SigningKey, KeyError>;

Source line: 81.

generation::ManagedKey::encrypted_ciphertext

Returns the encrypted private key ciphertext bytes (for serialization/storage).

pub fn encrypted_ciphertext(&self) -> &[u8];

Source line: 86.

generation::ManagedKey::encrypted_nonce

Returns the encrypted private key nonce bytes (for serialization/storage).

pub fn encrypted_nonce(&self) -> &[u8];

Source line: 91.

generation::EncryptedKey

An encrypted private key blob (AEGIS Spec SS6.8).

Uses AES-256-GCM with a random 96-bit nonce. The ciphertext contains the 32-byte Ed25519 signing key material plus a 16-byte authentication tag.

#[derive(Debug)]
pub struct EncryptedKey {

}

Source line: 101.

generation::EncryptedKey::encrypt

Encrypt an Ed25519 signing key with AES-256-GCM.

Arguments

• signing_key - The signing key to encrypt.
• encryption_key - A 32-byte AES-256 key.

Errors

Returns KeyError::GenerationFailed if AES-256-GCM encryption fails.

pub fn encrypt(signing_key: &SigningKey, encryption_key: &[u8; 32]) -> Result<Self, KeyError>;

Source line: 117.

generation::EncryptedKey::decrypt

Decrypt the private key using the provided AES-256 encryption key.

Arguments

• encryption_key - The 32-byte AES-256 key used during encryption.

Errors

Returns KeyError::GenerationFailed if decryption fails (wrong key or tampered data).

pub fn decrypt(&self, encryption_key: &[u8; 32]) -> Result<SigningKey, KeyError>;

Source line: 151.

generation::EncryptedKey::ciphertext

Returns the ciphertext bytes (for serialization/storage).

pub fn ciphertext(&self) -> &[u8];

Source line: 192.

generation::EncryptedKey::nonce

Returns the nonce bytes (for serialization/storage).

pub fn nonce(&self) -> &[u8];

Source line: 197.

generation::EncryptedKey::from_parts

Reconstruct an EncryptedKey from stored ciphertext and nonce.

Errors

Returns KeyError::StorageError if the nonce length is invalid.

pub fn from_parts(ciphertext: Vec<u8>, nonce: Vec<u8>) -> Result<Self, KeyError>;

Source line: 206.

generation::KeyGenerator

Key generator supporting multiple generation modes (AEGIS Spec SS6.2).

Currently implements the Direct generation mode using OS CSPRNG. MPC, TEE, and HSM modes will be added as their respective backends become available.

pub struct KeyGenerator;

Source line: 239.

generation::KeyGenerator::generate_direct

Generate a new Ed25519 keypair using CSPRNG (direct generation mode).

The generated signing key is immediately encrypted with the provided encryption key and stored inside the returned ManagedKey. The raw signing key material never leaves memory unencrypted beyond the scope of this function.

Arguments

• role - The role this key will serve (identity, authentication, etc.).
• encryption_key - A 32-byte AES-256 key used to encrypt the private key at rest.

Errors

Returns KeyError::GenerationFailed if key encryption fails.

pub fn generate_direct(
        role: KeyRole,
        encryption_key: &[u8; 32],
    ) -> Result<ManagedKey, KeyError>;

Source line: 257.

generation::KeyGenerator::generate_key_id

Generate a UUID v7-based key identifier.

UUID v7 is time-ordered, which allows keys to be naturally sorted by creation time. The format is key-<uuid-v7>.

pub fn generate_key_id() -> String;

Source line: 283.