kestrove-core

Rust workspace that holds all Kestrove crypto and vault logic. Apple, Android and desktop apps call it through UniFFI. The server uses only kv-proto.

Crate	Status	Purpose
kv-proto	✅ M0	Wire types (Envelope, KDF params, API bodies). No secrets.
kv-crypto	✅ M0	2SKD (Argon2id + Secret Key), XChaCha20-Poly1305 envelopes, HPKE vault-key sealing, keyset, Ed25519, Secret Key format
kv-model	✅ M0	Items, URL matching (PSL), TOTP (RFC 6238), password generator
kv-ffi	✅ M1	The exported API (VaultCore with SQLite storage, local unlock key, sync; totp_code, match_url, generate_password)
kv-store	✅ M1	SQLite replica (ciphertext only), base copies for merges, 10-version history
kv-sync	✅ M1	TLS 1.3 + SPKI pins, OPAQUE login, RFC 9421 signing, pull/push/merge, signed manifest

Spec: ../kestrove-spec/docs/02-cryptography.md and 03-sync-protocol.md.

Setup

curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh   # once
cargo test --workspace

Bindings

./scripts/build-apple.sh     # → ../kestrove-apple/Packages/KestroveCore (XCFramework + Swift)
./scripts/build-android.sh   # → ../kestrove-android/core-ffi (jniLibs + Kotlin); needs cargo-ndk

The desktop (Tauri) app depends on kv-ffi directly as a Rust crate.

Test vectors and the live-server test

cargo run -p kv-crypto --example gen-vectors   # writes crates/kv-crypto/tests/vectors and ../kestrove-spec/vectors
cargo test -p kv-ffi --test live_server -- --ignored   # against a fresh local kestrove-server; see the test's docs

Rules

• No unsafe outside generated FFI glue.
• Secrets live in Zeroizing<_>. Never log, Debug-print or format! a secret.
• Any change to formats needs a spec change first and new vectors in kestrove-spec/vectors.
• cargo deny check must pass. There are no GPL dependencies (App Store).