RequestSeal.KeyIdentity (RequestSeal v0.5.2)

Copy Markdown View Source

Internal trusted key equivalence, redacted from default inspection.

Public identities use validated RequestSeal.PublicKey components, with :rsa_pss normalized to :rsa. Symmetric identities are opaque, nonsecret custodian-supplied binaries of 1–256 bytes. RequestSeal never derives one from a secret. A caller must supply the same identity for aliases within its trusted scope. Unknown equivalence never establishes equality, including with itself. Do not place these internal values in general results, logs, or telemetry.

Summary

Types

t()

Functions

same?(arg1, arg2)

Compare known, validated identities; unknown or malformed identities never match.

Types

t()

@type t() :: %RequestSeal.KeyIdentity{
  kind: :public | :symmetric | :unknown,
  value: term()
}

Functions

same?(arg1, arg2)

@spec same?(t(), t()) :: boolean()

Compare known, validated identities; unknown or malformed identities never match.

Parameters

Returns

  • true - both are :public identities whose components validate as RequestSeal.PublicKey material and are equal after :rsa_pss is normalized to :rsa, or both are :symmetric identities with equal binary values of 1–256 bytes.
  • false - in every other case, including any :unknown identity (even compared with itself), identities of different kinds, and malformed values. This function returns no error and does not raise.

Examples

iex> {public, _seed} = :crypto.generate_key(:eddsa, :ed25519)
iex> a = %RequestSeal.KeyIdentity{kind: :public, value: {:ed25519, public}}
iex> RequestSeal.KeyIdentity.same?(a, %RequestSeal.KeyIdentity{kind: :public, value: {:ed25519, public}})
true
iex> {other, _seed} = :crypto.generate_key(:eddsa, :ed25519)
iex> RequestSeal.KeyIdentity.same?(a, %RequestSeal.KeyIdentity{kind: :public, value: {:ed25519, other}})
false
iex> unknown = %RequestSeal.KeyIdentity{kind: :unknown, value: nil}
iex> RequestSeal.KeyIdentity.same?(unknown, unknown)
false