/// Erases forward secure secret keys before a given epoch
Erases forward secure secret keys before a given epoch
Erases forward secure secret keys before a given epoch
fn update_forward_secure_epoch(
        &self,
        algorithm_id: AlgorithmId,
        epoch: Epoch,
    ) -> Result<(), ni_dkg_errors::CspDkgUpdateFsEpochError> {
        debug!(self.logger; crypto.method_name => "update_forward_secure_epoch", crypto.dkg_epoch => epoch.get());
        let key_id = self.dkg_dealing_encryption_key_id();
        let updated_key_set = match algorithm_id {
            AlgorithmId::NiDkg_Groth20_Bls12_381 => {
                // Retrieve key from key store
                let key_set = self.sks_read_lock().get(&key_id).ok_or_else(|| {
                    ni_dkg_errors::CspDkgUpdateFsEpochError::FsKeyNotInSecretKeyStoreError(
                        ni_dkg_errors::KeyNotFoundError {
                            internal_error: "Cannot update forward secure key if it is missing"
                                .to_string(),
                            key_id,
                        },
                    )
                })?;
                // Specialise to Groth20
                let key_set = specialise::fs_key_set(key_set)
                    .expect("Not a forward secure secret key; it should be impossible to retrieve a key of the wrong type.");
                let mut key_set = specialise::groth20::fs_key_set(key_set)
                    .expect("If key generation is correct, it should be impossible to retrieve a key of the wrong type.");
                // Update secret key to new epoch (deserialize key first)
                let mut secret_key = trusted_secret_key_into_miracl(&key_set.secret_key);
                let seed = Randomness::from(self.rng_write_lock().gen::<[u8; 32]>());
                clib::update_key_inplace_to_epoch(&mut secret_key, epoch, seed);
                // Replace secret key in key set (serialize key first)
                key_set.secret_key = secret_key_from_miracl(&secret_key);
                // Generalise:
                Ok(CspFsEncryptionKeySet::Groth20WithPop_Bls12_381(key_set))
            }
            other => Err(ni_dkg_errors::CspDkgUpdateFsEpochError::UnsupportedAlgorithmId(other)),
        };
        // Save state
        if let Err(err) = self.sks_write_lock().insert_or_replace(
            key_id,
            CspSecretKey::FsEncryption(updated_key_set?),
            Some(NIDKG_FS_SCOPE),
        ) {
            match err {
                SecretKeyStoreError::DuplicateKeyId(_key_id) => unreachable!(),
            };
        };
        // FIN
        Ok(())
    }
fn update_forward_secure_epoch ( & self , algorithm_id : AlgorithmId , epoch : Epoch , ) -> Result < ( ) , ni_dkg_errors :: CspDkgUpdateFsEpochError > { debug ! ( self logger crypto method_name " " crypto dkg_epoch epoch get ( ) ) ; let key_id = self . dkg_dealing_encryption_key_id ( ) ; let updated_key_set = match algorithm_id { AlgorithmId :: NiDkg_Groth20_Bls12_381 => { // Retrieve key from key store let key_set = self . sks_read_lock ( ) . get ( & key_id ) . ok_or_else ( | | { ni_dkg_errors :: CspDkgUpdateFsEpochError :: FsKeyNotInSecretKeyStoreError ( ni_dkg_errors :: KeyNotFoundError { internal_error : " " . to_string ( ) , key_id , } , ) } ) ? ; // Specialise to Groth20 let key_set = specialise :: fs_key_set ( key_set ) . expect ( " " ) ; let mut key_set = specialise :: groth20 :: fs_key_set ( key_set ) . expect ( " " ) ; // Update secret key to new epoch (deserialize key first) let mut secret_key = trusted_secret_key_into_miracl ( & key_set . secret_key ) ; let seed = Randomness :: from ( self . rng_write_lock ( ) . gen :: < [ u8 ; 32 ] > ( ) ) ; clib :: update_key_inplace_to_epoch ( & mut secret_key , epoch , seed ) ; // Replace secret key in key set (serialize key first) key_set . secret_key = secret_key_from_miracl ( & secret_key ) ; // Generalise: Ok ( CspFsEncryptionKeySet :: Groth20WithPop_Bls12_381 ( key_set ) ) } other => Err ( ni_dkg_errors :: CspDkgUpdateFsEpochError :: UnsupportedAlgorithmId ( other ) ) , } ; // Save state if let Err ( err ) = self . sks_write_lock ( ) . insert_or_replace ( key_id , CspSecretKey :: FsEncryption ( updated_key_set ? ) , Some ( NIDKG_FS_SCOPE ) , ) { match err { SecretKeyStoreError :: DuplicateKeyId ( _key_id ) => unreachable ! ( ) , } ; } ; // FIN Ok ( ( ) ) }
Erases forward secure secret keys before a given epoch
Erases forward secure secret keys before a given epoch
&self
algorithm_id
AlgorithmId
epoch
Epoch