Trait SecureStore 

pub trait SecureStore {
    // Required methods
    fn wrap_key(&self) -> Result<[u8; 32], SecureStoreError>;
    fn rollback_counter(&self) -> Result<u64, SecureStoreError>;
    fn bump_rollback_counter(&self) -> Result<u64, SecureStoreError>;
}

Platform secure storage backing rollback-resistant persisted state (export_state_sealed and its restore siblings): a wrapping key and a monotonic counter, both held where an attacker who can rewrite the state file cannot reach them.

See the module documentation in secure_store.rs for the guarantees an implementation must meet (the module is private, so rustdoc does not show it); they are the entirety of what anchor B is worth.

Required Methods

fn wrap_key(&self) -> Result<[u8; 32], SecureStoreError>

Return the wrapping key, creating and persisting it on first use.

Called once per export and once per restore. Implementations may cache, but the returned key must be identical across process restarts for the same install — a key that changed between runs would make every restore look like tampering.

fn rollback_counter(&self) -> Result<u64, SecureStoreError>

Read the highest rollback counter this store has committed, or 0 if it never has. Read-only; used on restore to tell whether the state being restored is older than the newest this device produced.

The counter must be rollback-resistant to a file-rewriter — kept in secure storage, never beside the state blob — and it must survive restarts. This is the freshness anchor that catches a same-generation rollback: an attacker who keeps an old sealed file and restores it later presents a counter below this high-water mark.

fn bump_rollback_counter(&self) -> Result<u64, SecureStoreError>

Atomically increment the rollback counter, persist it, and return the new value. Never decreases. Called on every send and every ratchet-advancing receive (the client commits one advance each), not on export — export_state_sealed binds the current value read via rollback_counter. Because the counter tracks ratchet advances rather than export cadence, a later restore of any state older than the latest send presents a lower counter than this store now holds and is caught as a rollback.

Dyn Compatibility

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors