# `RequestSeal.KeyIdentity`
[🔗](https://github.com/baselabs/request_seal/blob/v0.5.2/lib/request_seal/key_identity.ex#L1)

Internal trusted key equivalence, redacted from default inspection.

Public identities use validated `RequestSeal.PublicKey` components, with
`:rsa_pss` normalized to `:rsa`. Symmetric identities are opaque, nonsecret
custodian-supplied binaries of 1–256 bytes. RequestSeal never derives one from
a secret. A caller must supply the same identity for aliases within its trusted
scope. Unknown equivalence never establishes equality, including with itself.
Do not place these internal values in general results, logs, or telemetry.

# `t`

```elixir
@type t() :: %RequestSeal.KeyIdentity{
  kind: :public | :symmetric | :unknown,
  value: term()
}
```

# `same?`

```elixir
@spec same?(t(), t()) :: boolean()
```

Compare known, validated identities; unknown or malformed identities never match.

## Parameters

  * `a`, `b` - `t:t/0` values, normally returned by
    `RequestSeal.Custody.identity/1`.

## Returns

  * `true` - both are `:public` identities whose components validate as
    `RequestSeal.PublicKey` material and are equal after `:rsa_pss` is
    normalized to `:rsa`, or both are `:symmetric` identities with equal
    binary values of 1–256 bytes.
  * `false` - in every other case, including any `:unknown` identity (even
    compared with itself), identities of different kinds, and malformed values.
    This function returns no error and does not raise.

## Examples

    iex> {public, _seed} = :crypto.generate_key(:eddsa, :ed25519)
    iex> a = %RequestSeal.KeyIdentity{kind: :public, value: {:ed25519, public}}
    iex> RequestSeal.KeyIdentity.same?(a, %RequestSeal.KeyIdentity{kind: :public, value: {:ed25519, public}})
    true
    iex> {other, _seed} = :crypto.generate_key(:eddsa, :ed25519)
    iex> RequestSeal.KeyIdentity.same?(a, %RequestSeal.KeyIdentity{kind: :public, value: {:ed25519, other}})
    false
    iex> unknown = %RequestSeal.KeyIdentity{kind: :unknown, value: nil}
    iex> RequestSeal.KeyIdentity.same?(unknown, unknown)
    false

---

*Consult [api-reference.md](api-reference.md) for complete listing*