RequestSeal.KeyHandle (RequestSeal v0.2.0)

Caller-owned, algorithm-bound signing, verification, or key-unwrapping capability.

Construct handles through a custodian such as RequestSeal.Custody.Local or RequestSeal.Custody.SSHAgent. Only that custodian interprets ref. Local references contain only a holder PID and token, never key material. The holder is sensitive and lives until RequestSeal.Custody.Local.release/1 or creator exit, including after handle transfer. Dropping a handle does not stop its holder. A long-lived owner such as a GenServer must release handles it no longer needs, or create handles once at startup and reuse them for its lifetime.

Loading the library starts no process or store. Local construction starts one holder per handle. An asymmetric public key is obtained through RequestSeal.Custody.public_key/1; HMAC has no public export.

Summary

Types

t()

Types

t()

@type t() :: %RequestSeal.KeyHandle{
  algorithm: RequestSeal.Custody.algorithm(),
  capabilities: [:sign | :verify | :unwrap],
  custodian: module(),
  ref: (-> term())
}