pub struct EntropyPool<S> { /* private fields */ }Expand description
The pool: a 32-byte working key that only ever moves forward.
Implementations§
Source§impl<S: Sha256Provider> EntropyPool<S>
impl<S: Sha256Provider> EntropyPool<S>
Sourcepub fn from_seed(sha: S, seed: &[u8; 32], salt: &[u8]) -> Self
pub fn from_seed(sha: S, seed: &[u8; 32], salt: &[u8]) -> Self
Build the pool from the stored seed.
salt is the per-boot uniqueness: chip id and reset reason are
free (no flash write) and make a restored flash image derive a
different stream on different hardware.
Sourcepub fn next_seed(&self) -> [u8; 32]
pub fn next_seed(&self) -> [u8; 32]
The seed the next boot should load. Derived one-way from the working key, so a flash image reveals nothing about this session, and independent of every draw label, so committing it first leaks nothing about outputs.
Sourcepub fn seed_committed(&mut self)
pub fn seed_committed(&mut self)
The caller has confirmed next_seed is in
storage; draws are now permitted.
Sourcepub fn is_committed(&self) -> bool
pub fn is_committed(&self) -> bool
Whether draws are currently permitted.
Sourcepub fn draw(
&mut self,
label: &[u8],
out: &mut [u8],
) -> Result<(), DrawBeforeCommit>
pub fn draw( &mut self, label: &[u8], out: &mut [u8], ) -> Result<(), DrawBeforeCommit>
Fill out with output bound to label, then ratchet the
working key so this output can never be re-derived from later
pool state.
Sourcepub fn mix(&mut self, entropy: &[u8])
pub fn mix(&mut self, entropy: &[u8])
Fold harvested entropy into the working key.
Hash mixing means adversary-known input cannot reduce the pool’s
entropy, only fail to add any — so anything cheap is fair game.
Marks the pool dirty: the stored seed no longer reflects the
best key we have, and the caller should persist a fresh
next_seed when convenient.
Sourcepub fn seed_refreshed(&mut self)
pub fn seed_refreshed(&mut self)
The caller has persisted a post-mix seed.