Struct SecureMessageChannel 

pub struct SecureMessageChannel {
    encryption_key: LessSafeKey,
    hmac_key: Vec<u8>,
}

Secure message channel with encryption and authentication

This structure provides AES-256-GCM encryption with HMAC authentication for secure IPC communication. It ensures message confidentiality and integrity.

Encryption Flow

TauriIPCMessage
    |
    | 1. Serialize to JSON
    v
Serialized bytes
    |
    | 2. Encrypt with AES-256-GCM
    v
Encrypted bytes + auth tag
    |
    | 3. Generate HMAC
    v
EncryptedMessage (nonce, ciphertext, hmac_tag)

Decryption Flow

EncryptedMessage
    |
    | 1. Verify HMAC
    v
HMAC valid
    |
    | 2. Decrypt with AES-256-GCM
    v
Serialized bytes
    |
    | 3. Deserialize to TauriIPCMessage
    v
TauriIPCMessage

Security Features

• AES-256-GCM: Industry-standard authenticated encryption
• Unique Nonces: Each encryption uses a unique nonce
• HMAC Authentication: Additional layer of message authentication
• Secure Random Generation: Cryptographically secure random keys

Example Usage

let secure_channel = SecureMessageChannel::new()?;

// Encrypt a message
let encrypted = secure_channel.encrypt_message(&message)?;

// Decrypt a message
let decrypted = secure_channel.decrypt_message(&encrypted)?;

// Rotate keys
secure_channel.rotate_keys()?;

Fields

encryption_key: LessSafeKey

AES-256-GCM encryption key

hmac_key: Vec<u8>

HMAC key for message authentication

Implementations

impl SecureMessageChannel

pub fn new() -> Result<Self, String>

Create a new secure channel with randomly generated keys

This method generates cryptographically secure random keys for encryption and HMAC authentication.

Returns

• Ok(SecureMessageChannel): New secure channel
• Err(String): Error message if key generation fails

Example

let secure_channel = SecureMessageChannel::new()?;

pub fn encrypt_message( &self, message: &TauriIPCMessage, ) -> Result<EncryptedMessage, String>

Encrypt and authenticate a message

This method serializes the message, encrypts it with AES-256-GCM, and adds an HMAC tag for authentication.

Parameters

• message: The message to encrypt

Returns

• Ok(EncryptedMessage): Encrypted message with nonce and HMAC tag
• Err(String): Error message if encryption fails

Example

let encrypted = secure_channel.encrypt_message(&message)?;

pub fn decrypt_message( &self, encrypted: &EncryptedMessage, ) -> Result<TauriIPCMessage, String>

Decrypt and verify a message

This method verifies the HMAC tag, decrypts the message with AES-256-GCM, and deserializes it back to the original format.

Parameters

• encrypted: The encrypted message to decrypt

Returns

• Ok(TauriIPCMessage): Decrypted message
• Err(String): Error message if decryption or verification fails

Example

let decrypted = secure_channel.decrypt_message(&encrypted)?;

pub fn rotate_keys(&mut self) -> Result<(), String>

Rotate encryption keys

This method generates new encryption and HMAC keys, effectively rotating the security credentials for the channel.

Returns

• Ok(()): Keys rotated successfully
• Err(String): Error message if key rotation fails

Example

secure_channel.rotate_keys()?;

pub fn hmac_tag_length(&self) -> usize

Get the HMAC tag length (in bytes)

pub fn nonce_length(&self) -> usize

Get the nonce length (in bytes)

pub fn auth_tag_length(&self) -> usize

Get the authentication tag length (in bytes)

pub fn key_length(&self) -> usize

Get the key length (in bytes)