Source: oas/oas/oas-crypto/src/derivation.rs. SHA-256: a0fbf0f5241327fb49081baadd2a77cc308afdff5b6096f9c1f349ac89a67724.

This source reference follows declared modules and preserves feature attributes. It includes public declarations and implementation methods in those modules. Private-module exports and trait resolution still require the compiler; not every declaration is a crate-root import. Function bodies and constant values are omitted. Source comments describe their implementation context and are not a production deployment claim.

derivation::derive_child_keypair

Derives a child Ed25519 keypair from a parent keypair using HKDF-SHA256.

Implements the key derivation algorithm from OAS Specification §9.3. The derived key material is clamped per RFC 8032 §5.1.5 by ed25519-dalek during key construction.

Arguments

• parent - The parent entity's [OasKeyPair].
• derivation_path - The derivation path string (e.g., "/agent-analyst-42").

Returns

A new [OasKeyPair] for the child entity.

Errors

Returns [CryptoError::DerivationFailed] if HKDF expansion fails (should not happen with valid 32-byte inputs, but handled defensively).

Examples

use oas_crypto::derivation::derive_child_keypair;
use oas_crypto::keypair::OasKeyPair;

let parent = OasKeyPair::generate();
let child = derive_child_keypair(&parent, "/agent-child-1").unwrap();
assert_ne!(parent.verifying_key_bytes(), child.verifying_key_bytes());

pub fn derive_child_keypair(
    parent: &OasKeyPair,
    derivation_path: &str,
) -> Result<OasKeyPair, CryptoError>;

Source line: 51.

derivation::derive_key_material

Derives raw 32-byte key material using HKDF-SHA256.

This is the lower-level function that performs the actual HKDF computation. Use [derive_child_keypair] for the full keypair derivation workflow.

Arguments

• ikm - Input key material (parent private key, 32 bytes).
• salt - Salt (parent public key, 32 bytes).
• info - Info string (derivation path as UTF-8 bytes).

Returns

32 bytes of derived key material.

Errors

Returns [CryptoError::DerivationFailed] if HKDF fails.

Examples

use oas_crypto::derivation::derive_key_material;

let ikm = [0u8; 32];
let salt = [1u8; 32];
let okm = derive_key_material(&ikm, &salt, "/test-path").unwrap();
assert_eq!(okm.len(), 32);

pub fn derive_key_material(ikm: &[u8], salt: &[u8], info: &str) -> Result<[u8; 32], CryptoError>;

Source line: 92.