### Use PASERK Keys with PASETO Tokens in Rust Source: https://context7.com/conradludgate/rusty-paserk/llms.txt Demonstrates converting PASERK keys into rusty_paseto compatible key types for creating and verifying PASETO tokens. This integration allows leveraging PASERK's advanced key management features within the PASETO token ecosystem. The example shows generating a PASERK key and converting it for use with rusty_paseto's token builder. ```rust use rusty_paserk::{Key, Local, V4}; use rusty_paseto::core::{V4 as PasetoV4, Local as PasetoLocal, PasetoSymmetricKey}; // Generate a PASERK key let paserk_key = Key::::new_os_random(); // Convert to rusty_paseto key type let paseto_key: PasetoSymmetricKey = paserk_key.into(); // Use with rusty_paseto to create tokens // let token = Paseto::::builder() // .set_encryption_key(&paseto_key) // .set_claim(...) // .build()?; ``` -------------------------------- ### Handle PASERK Operation Errors in Rust Source: https://context7.com/conradludgate/rusty-paserk/llms.txt Illustrates robust error handling for PASERK operations, which return Result types containing PasetoError. The examples cover successful and failed key unwrapping using passwords, as well as handling parsing errors for invalid key strings. This ensures applications can gracefully manage potential issues during key operations. ```rust use rusty_paserk::{Key, PwWrappedKey, Local, V4}; use rusty_paseto::core::PasetoError; let correct_password = b"correct-password"; let wrong_password = b"wrong-password"; let local_key = Key::::new_os_random(); let wrapped = local_key.pw_wrap(correct_password); // Successful unwrap match wrapped.clone().unwrap_key(correct_password) { Ok(key) => assert_eq!(key, local_key), Err(e) => panic!("Should not fail: {:?}", e), } // Failed unwrap with wrong password match wrapped.unwrap_key(wrong_password) { Ok(_) => panic!("Should fail with wrong password"), Err(PasetoError::InvalidSignature) => { // Expected error for authentication failure } Err(e) => panic!("Unexpected error: {:?}", e), } // Handle parse errors let invalid_string = "k4.local.invalid-base64!!!"; match invalid_string.parse::>() { Ok(_) => panic!("Should fail parsing"), Err(PasetoError::PayloadBase64Decode { .. }) => { // Expected error for invalid base64 } Err(e) => panic!("Unexpected error: {:?}", e), } ``` -------------------------------- ### Configure Password Derivation Settings (Argon2) Source: https://context7.com/conradludgate/rusty-paserk/llms.txt Allows customization of Argon2 parameters for password-based key derivation, enabling the creation of stronger or faster keys. Users can specify memory usage, iterations, and parallelism to fine-tune the security and performance of the key wrapping process. ```rust use rusty_paserk::{Key, Local, V4, Argon2State}; let password = b"my-secure-password"; let local_key = Key::::new_os_random(); // Configure custom Argon2 settings let settings = Argon2State { mem: 128 * 1024 * 1024, // 128 MiB memory time: 3, // 3 iterations para: 1, // 1 thread }; let wrapped = local_key.pw_wrap_with_settings(password, settings); let unwrapped = wrapped.unwrap_key(password).unwrap(); assert_eq!(local_key, unwrapped); ``` -------------------------------- ### Import Keys from Hex, PEM, and Raw Bytes (V3/V4) Source: https://context7.com/conradludgate/rusty-paserk/llms.txt Loads keys into the rusty-paserk library from various common formats including hex-encoded keypairs and seeds, raw bytes, and PEM-encoded private keys. This functionality supports both V4 and V3 protocols, allowing for seamless integration with existing key material. ```rust use rusty_paserk::{Key, Secret, Public, V4}; // Import V4 secret key from hex-encoded keypair let keypair_hex = "407796f4bc4b8184e9fe0c54b336822d34823092ad873d87ba14c3efb9db8c1db7715bd661458d928654d3e832f53ff5c9480542e0e3d4c9b032c768c7ce6023"; let keypair_bytes = hex::decode(keypair_hex).unwrap(); let secret_key = Key::::from_keypair_bytes(&keypair_bytes).unwrap(); // Import V4 secret key from 32-byte seed let seed_hex = "407796f4bc4b8184e9fe0c54b336822d34823092ad873d87ba14c3efb9db8c1d"; let seed_bytes = hex::decode(seed_hex).unwrap(); let seed: [u8; 32] = seed_bytes.try_into().unwrap(); let secret_from_seed = Key::::from_secret_key(seed); // Import V4 public key from bytes let pubkey_hex = "b7715bd661458d928654d3e832f53ff5c9480542e0e3d4c9b032c768c7ce6023"; let pubkey_bytes = hex::decode(pubkey_hex).unwrap(); let public_key = Key::::from_public_key(&pubkey_bytes).unwrap(); // Import V3 keys from PEM (requires v3 feature) #[cfg(feature = "v3")] { use rusty_paserk::V3; let v3_pem = "-----BEGIN EC PRIVATE KEY----- MIGkAgEBBDAhUb6WGhABE1MTj0x7E/5acgyap23kh7hUAVoAavKyfhYcmI3n1Q7L JpHxNb792H6gBwYFK4EEACKhZANiAAT5H7mTSOyjfILDtSuavZfalI3doM8pRUlb TzNyYLqM9iVmajpc0JRXvKuBtGtYi7Yft+eqFr6BuzGrdb4Z1vkvRcI504m0qKiE zjhi6u4sNgzW23rrVkRYkb2oE3SJPko= -----END EC PRIVATE KEY-----"; let v3_secret = Key::::from_sec1_pem(v3_pem).unwrap(); let v3_public = v3_secret.public_key(); } ``` -------------------------------- ### Wrap Keys with Password Encryption (PBKDF2/Argon2) Source: https://context7.com/conradludgate/rusty-paserk/llms.txt Encrypts keys using password-based key derivation. For V4, Argon2 is used, while V3 uses PBKDF2. This function takes a password and a key, returning a wrapped key string that can be unwrapped using the same password. It's crucial to check the KDF settings before unwrapping to prevent denial-of-service attacks. ```rust use rusty_paserk::{PwWrappedKey, Key, Local, Secret, V4, Argon2State}; let password = b"correct-horse-battery-staple"; // Wrap a local key with a password let local_key = Key::::new_os_random(); let wrapped = local_key.pw_wrap(password); let wrapped_string = wrapped.to_string(); // Returns: "k4.local-pw.{base64-salt-params-nonce-encrypted-key-tag}" // Parse and unwrap with the password let wrapped_parsed: PwWrappedKey = wrapped_string.parse().unwrap(); // Check KDF settings before unwrapping to prevent DoS let settings = wrapped_parsed.settings(); assert!(settings.mem <= 256 * 1024 * 1024); // Max 256 MiB assert!(settings.time <= 10); // Max 10 iterations let unwrapped = wrapped_parsed.unwrap_key(password).unwrap(); assert_eq!(local_key, unwrapped); // Wrap a secret key with password let secret_key = Key::::new_os_random(); let wrapped_secret = secret_key.pw_wrap(password); let wrapped_secret_string = wrapped_secret.to_string(); let wrapped_secret_parsed: PwWrappedKey = wrapped_secret_string.parse().unwrap(); let unwrapped_secret = wrapped_secret_parsed.unwrap_key(password).unwrap(); assert_eq!(secret_key, unwrapped_secret); ``` -------------------------------- ### Wrap Local Keys with Symmetric Encryption using PIE Source: https://context7.com/conradludgate/rusty-paserk/llms.txt Wraps a local or secret key using another local key with the Paragon Initiative Enterprises (PIE) standard. This method is useful for securely storing or transmitting keys. It returns a string representation of the wrapped key, which can then be parsed and unwrapped using the original wrapping key. ```rust use rusty_paserk::{PieWrappedKey, Key, Local, Secret, V4}; // Generate a wrapping key and a key to wrap let wrapping_key = Key::::new_os_random(); let local_key = Key::::new_os_random(); // Wrap the local key let wrapped = local_key.wrap_pie(&wrapping_key); let wrapped_string = wrapped.to_string(); // Returns: "k4.local-wrap.pie.{base64-tag-nonce-encrypted-key}" // Parse and unwrap let wrapped_parsed: PieWrappedKey = wrapped_string.parse().unwrap(); let unwrapped_key = wrapped_parsed.unwrap_key(&wrapping_key).unwrap(); assert_eq!(local_key, unwrapped_key); // Wrap a secret key with symmetric encryption let secret_key = Key::::new_os_random(); let wrapped_secret = secret_key.wrap_pie(&wrapping_key); let wrapped_secret_string = wrapped_secret.to_string(); // Returns: "k4.secret-wrap.pie.{base64-tag-nonce-encrypted-secret}" let wrapped_secret_parsed: PieWrappedKey = wrapped_secret_string.parse().unwrap(); let unwrapped_secret = wrapped_secret_parsed.unwrap_key(&wrapping_key).unwrap(); assert_eq!(secret_key, unwrapped_secret); ``` -------------------------------- ### Serialize and Parse Plaintext Keys in Rust Source: https://context7.com/conradludgate/rusty-paserk/llms.txt Exports and imports keys as base64-encoded plaintext strings using the V4 protocol for storage or transmission. Requires the `rusty_paserk` crate. ```rust use rusty_paserk::{Key, PlaintextKey, Local, Secret, V4}; // Serialize a local key let local_key = Key::::new_os_random(); let plaintext = PlaintextKey(local_key); let serialized = plaintext.to_string(); // Returns: "k4.local.bkwMkk5uhGbHAISf4bzY5nlm6y_sfzOIAZTfj6Tc9y0" // Serialize a secret key let secret_key = Key::::new_os_random(); let plaintext_secret = PlaintextKey(secret_key); let secret_serialized = plaintext_secret.to_string(); // Returns: "k4.secret.{base64-encoded-64-byte-keypair}" // Parse plaintext keys back let parsed: PlaintextKey = serialized.parse().unwrap(); let recovered_key = parsed.0; ``` -------------------------------- ### Export Local Keys to Raw Bytes in Rust Source: https://context7.com/conradludgate/rusty-paserk/llms.txt Converts local PASERK keys into raw byte arrays for system integration. It supports re-importing from bytes and accessing raw byte slices using AsRef. This functionality is useful for passing keys between different parts of an application or to external systems that expect raw key data. ```rust use rusty_paserk::{Key, Local, V4}; // Create and export a local key let local_key = Key::::new_os_random(); let bytes: [u8; 32] = local_key.to_bytes(); // Re-import from bytes let imported_key = Key::::from_bytes(bytes); assert_eq!(local_key, imported_key); // Access raw bytes with AsRef let raw_bytes: &[u8] = local_key.as_ref(); assert_eq!(raw_bytes.len(), 32); ``` -------------------------------- ### Create and Parse Key Identifiers in Rust Source: https://context7.com/conradludgate/rusty-paserk/llms.txt Generates and parses unique identifiers for keys using the V4 protocol. These IDs can be safely stored in PASETO footers. Requires the `rusty_paserk` crate. ```rust use rusty_paserk::{Key, KeyId, Local, Secret, Public, V4}; // Create a local key and generate its ID let local_key = Key::::new_os_random(); let local_id: KeyId = local_key.into(); let id_string = local_id.to_string(); // Returns: "k4.lid.XxPub51WIAEmbVTmrs-lFoFodxTSKk8RuYEJk3gl-DYB" // Create IDs from public/secret keys let secret_key = Key::::new_os_random(); let secret_id: KeyId = secret_key.clone().into(); // Returns: "k4.sid.p26RNihDPsk2QbglGMTmwMMqLYyeLY25UOQZXQDXwn61" let public_id: KeyId = secret_key.public_key().into(); // Returns: "k4.pid.yMgldRRLHBLkhmcp8NG8yZrtyldbYoAjQWPv_Ma1rzRu" // Parse key IDs from strings let parsed_id: KeyId = id_string.parse().unwrap(); assert_eq!(local_id, parsed_id); ``` -------------------------------- ### Seal and Unseal Local Keys with Asymmetric Encryption in Rust Source: https://context7.com/conradludgate/rusty-paserk/llms.txt Encrypts a local symmetric key using a public key with the V4 protocol, allowing decryption only by the holder of the corresponding secret key. Requires the `rusty_paserk` crate. ```rust use rusty_paserk::{SealedKey, Key, Local, Secret, V4}; // Generate keys let local_key = Key::::new_os_random(); let secret_key = Key::::new_os_random(); let public_key = secret_key.public_key(); // Seal the local key with the public key let sealed = local_key.seal(&public_key); let sealed_string = sealed.to_string(); // Returns: "k4.seal.{base64-tag-ephemeral-key-encrypted-data}" // Parse and unseal with the secret key let sealed_parsed: SealedKey = sealed_string.parse().unwrap(); let unsealed_key = sealed_parsed.unseal(&secret_key).unwrap(); // Verify the key was recovered correctly assert_eq!(local_key, unsealed_key); ``` -------------------------------- ### Generate Random Keys in Rust Source: https://context7.com/conradludgate/rusty-paserk/llms.txt Generates cryptographically secure random keys for symmetric local encryption or asymmetric public/secret operations using the V4 protocol. Requires the `rusty_paserk` crate. ```rust use rusty_paserk::{Key, Local, Secret, V4}; // Generate a V4 local symmetric key let local_key = Key::::new_os_random(); // Generate a V4 secret key for signing let secret_key = Key::::new_os_random(); // Derive the corresponding public key let public_key = secret_key.public_key(); ``` === COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.