38 lines
1.6 KiB
Markdown
38 lines
1.6 KiB
Markdown
# kestrove-core
|
|
|
|
Rust workspace that holds **all** Kestrove crypto and vault logic. Apple,
|
|
Android and desktop apps call it through UniFFI. The server uses only `kv-proto`.
|
|
|
|
| Crate | Status | Purpose |
|
|
|---|---|---|
|
|
| `kv-proto` | ✅ M0 | Wire types (Envelope, KDF params, API bodies). No secrets. |
|
|
| `kv-crypto` | ✅ M0 | 2SKD (Argon2id + Secret Key), XChaCha20-Poly1305 envelopes, HPKE vault-key sealing, keyset, Ed25519, Secret Key format |
|
|
| `kv-model` | ✅ M0 | Items, URL matching (PSL), TOTP (RFC 6238), password generator |
|
|
| `kv-ffi` | ✅ M0 (in-memory) | The exported API (`VaultCore`, `totp_code`, `match_url`, `generate_password`) |
|
|
| `kv-store` | 🔜 M1 | SQLite replica (ciphertext only) |
|
|
| `kv-sync` | 🔜 M1 | OPAQUE login, RFC 9421 signing, pull/push/merge, signed manifest |
|
|
|
|
Spec: `../kestrove-spec/docs/02-cryptography.md` and `03-sync-protocol.md`.
|
|
|
|
## Setup
|
|
|
|
```bash
|
|
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh # once
|
|
cargo test --workspace
|
|
```
|
|
|
|
## Bindings
|
|
|
|
```bash
|
|
./scripts/build-apple.sh # → ../kestrove-apple/Packages/KestroveCore (XCFramework + Swift)
|
|
./scripts/build-android.sh # → ../kestrove-android/core-ffi (jniLibs + Kotlin); needs cargo-ndk
|
|
```
|
|
|
|
The desktop (Tauri) app depends on `kv-ffi` directly as a Rust crate.
|
|
|
|
## Rules
|
|
* No `unsafe` outside generated FFI glue.
|
|
* Secrets live in `Zeroizing<_>`. Never log, `Debug`-print or `format!` a secret.
|
|
* Any change to formats needs a spec change first and new vectors in `kestrove-spec/vectors`.
|
|
* `cargo deny check` must pass. There are no GPL dependencies (App Store).
|