Module group_keys 

Keys derived from a group root, the structures a publish signature covers, and sealed commit-log entries.

A group root is 32 secret bytes drawn once per group. HKDF-SHA256 derives one key per use from it (GroupKeys). The group signing key’s public key is the group id, and the commit-log signing key’s public key is the commit-log id. The backend and every client verify a publish signature the same way (verify_publish_signature).

Ed25519 signing is deterministic, so every retry and every publisher signs the same bytes. One faulty signature next to a correct copy of the same signed bytes reveals the signing key. So nothing is released until a self-check passes: sign twice and require equal bytes, then verify as the backend does, over signed bytes rebuilt from the envelope’s own fields. A sealed entry is also opened again, and the nonce derived from the decrypted bytes must equal the envelope’s nonce.

Structs

GroupKeys

The keys of the group key table, derived from one group root.

GroupRoot

The 32-byte secret that a group’s keys derive from.

GroupRootLengthError

A stored group root is not 32 bytes.

Enums

OpenError

A sealed commit-log entry is discarded.

PublishSignatureError

A publish signature fails API verification.

SealError

Signing or sealing failed, and nothing was released.

SealedField

A field of a sealed commit-log entry.

Constants

COMMIT_LOG_NONCE_BYTES

Length of a sealed commit-log entry’s nonce.

COMMIT_LOG_TAG_BYTES

Length of the ChaCha20-Poly1305 tag, so the shortest sealed ciphertext.

GROUP_ROOT_BYTES

Length of a group root.

KEYED_TOPIC_BYTES

Length of a keyed topic: the kind byte and a public key.

PUBLIC_KEY_BYTES

Length of an Ed25519 public key: a group id or a commit-log id.

PUBLISH_SIGNATURE_BYTES

Length of a publish signature, R || S.

Functions

commit_log_entry_tbs

The TLS encoding of CommitLogEntryTBS (API section 3.1), which a sealed commit-log entry’s signature covers. It fails only for a ciphertext of 2^30 bytes or more.

commit_log_topic

The commit-log topic: kind 0x04 followed by the commit-log id. The nonce input, the associated data, the signed structure, and the topic a client reads all use it.

group_message_tbs

The TLS encoding of GroupMessageTBS (API section 3.1), which a group message’s signature covers. It fails only for a field of 2^30 bytes or more.

open_commit_log_entry

Verify and decrypt a sealed commit-log entry read from the conversation’s commit-log topic, and return the encoded PlaintextCommitLogEntry.

seal_commit_log_entry

Seal an encoded PlaintextCommitLogEntry for the conversation’s commit log, after the self-check.

sign_group_message

Sign a group message under the group signing key and set its signature, after the self-check. On an error the message is unchanged.

verify_publish_signature

Verify a publish signature over tbs under public_key.