Pinset Store
Make a Pinset store that houses the key for the local node and for peers.
Spec
The Pinset record should likely be of format:
- peer_id (hash of SPKI)
- key_type (Ed25519, SPKI, PQ hybrid)
- key_data (raw key bytes)
- added_at (unix seconds)
- expires_at (optional expiration)
- flags (i.e. Active, Retired, TOFU. ... so we can keep a log of them instead of just deleting them (we can delete on some heuristic))
The Pinset Store should likely of of format:
- vector of Pinset records
- version
The Pinset store should be wrapped in an AEAD layer.
The header should likely be of format:
- magic number (i.e "pinsetstore" or "PSET")
- version
- aead_alg (Probably AES-GCM)
- key_source (OSKeyStore, PassphraseKDF)
- kdf (optional for passphrase mode)
- kek_locator (optional for OS key store mode)
- store_id (salt for KEK)
- seq (increments each save and used for unique nonce making)
- nonce (for AES-GCM)
- wrap (optional wrap FEK under a KEK)
All formatting decisions are up to the implementors. These are just suggestions.
The Pinset store needs to be proposed in an RFC. Whoever takes this issue should type up an RFC that describes the structure of the Pinset store. This RFC will likely go through many iterations before passing proposal.
Pinset Store
Make a Pinset store that houses the key for the local node and for peers.
Spec
The Pinset record should likely be of format:
The Pinset Store should likely of of format:
The Pinset store should be wrapped in an AEAD layer.
The header should likely be of format:
All formatting decisions are up to the implementors. These are just suggestions.
The Pinset store needs to be proposed in an RFC. Whoever takes this issue should type up an RFC that describes the structure of the Pinset store. This RFC will likely go through many iterations before passing proposal.