Struct Source 

pub struct Source { /* private fields */ }

A source and their long-term key material (step 4).

A source’s keys are fully determined by their passphrase: the fetch key, APKE key, and PKE key are all derived from a master key via Argon2id and a domain-separated KDF. Returning sources reconstruct the same keys by calling Source::from_passphrase with the same passphrase.

Implementations

impl Source

pub fn new<R: RngCore + CryptoRng>(rng: R) -> Self

Create a new source with a randomly generated passphrase.

TODO / For testing only - in production the passphrase must be a mnemonic of sufficient entropy generated and displayed to the source.

pub fn passphrase(&self) -> &[u8]

Returns the source’s passphrase.

Security

The passphrase is the root secret from which all source keys are derived. It MUST be stored and transmitted only over secure channels.

pub fn from_passphrase(passphrase: &[u8]) -> Self

Reconstruct source keys from a passphrase (step 4).

Derives a master key via Source::derive_master_key, then derives each private key from the master key using a domain-separated KDF.

pub fn public(&self) -> SourcePublicView

Returns the public key material for this source.

Trait Implementations

impl Api for Source

fn newsroom_verifying_key(&self) -> Option<&VerifyingKey>

Returns the stored newsroom verifying key, if one has been verified.

fn set_newsroom_verifying_key(&mut self, key: VerifyingKey)

Stores a verified newsroom verifying key.

fn fetch_newsroom_keys(&self) -> SourceNewsroomKeyRequest

Creates a request to fetch the newsroom’s public keys from the server.

fn fetch_journalist_keys(&self) -> SourceJournalistKeyRequest

Creates a request to fetch journalist public keys from the server.

fn fetch_message_ids<R: RngCore + CryptoRng>( &self, _rng: &mut R, ) -> MessageChallengeFetchRequest

Creates a request to fetch encrypted message IDs from the server.

fn solve_fetch_challenges( &self, challenges: &[FetchResponse], ) -> Result<Vec<Uuid>, Error>

where Self: Sized + UserSecret,

Solves the encrypted message-ID challenges returned by the server.

fn fetch_message(&self, message_id: Uuid) -> Option<MessageFetchRequest>

Creates a request to fetch a specific message by its ID.

fn submit_message<R, S, P>( &self, rng: &mut R, message: &[u8], sender: &S, recipient: &P, ) -> Result<Envelope, Error>

where R: RngCore + CryptoRng, S: UserSecret, P: UserPublic,

Encrypts and submits a message from sender to recipient.

fn handle_newsroom_key_response( &mut self, response: &SourceNewsroomKeyResponse, fpf_verifying_key: &VerifyingKey, ) -> Result<(), Error>

Verifies and stores the newsroom’s verifying key from a server response.

fn handle_journalist_key_response( &self, response: &SourceJournalistKeyResponse, newsroom_verifying_key: &VerifyingKey, ) -> Result<(), Error>

Verifies a journalist’s key response against the newsroom’s signature.

impl Debug for Source

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl UserSecret for Source

Private, common to all users, implemented for sources

fn num_bundles(&self) -> usize

fn fetch_keypair(&self) -> (&DHPrivateKey, &DHPublicKey)

fn message_auth_key(&self) -> &MessagePrivateKey

The long-term SD-APKE private key sk^APKE.

fn message_auth_pk(&self) -> &MessagePublicKey

The long-term SD-APKE public key pk^APKE.

fn build_message(&self, message: Vec<u8>) -> Plaintext

fn keybundles(&self) -> Vec<&MessageKeyBundle>