Enum bonsaidb::core::connection::TokenChallengeAlgorithm

pub enum TokenChallengeAlgorithm {
    Blake3,
}

A token challenge algorith designates with which algorthm to authenticate tokens.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Blake3

Authenticate tokens using blake3.

The initial request requires a hash of TimestampAsNanoseconds::now() to be performed using [blake3::keyed_hash()]. The key is derived using [blake3::derive_key()] using a context formatted like this: bonsaidb {now} token-authentication. The now value should be timestamp’s nanoseconds relative to BonsaiEpoch, and the hash’s contents should be the 8-byte big-endian representation of the nanoseconds as an i64.

The storage will verify that the timestamp is within a reasonable delta of the server’s current time, and it will verify the private token was used to generate the hash sent. To prevent replay attacks and add additional security, the server will return a new Session whose authentication field is SessionAuthentication::TokenChallenge.

The connector must use the new connection to call authenticate() with Authentication::TokenChallengeResponse. It is possible that the server will elect a different challenge algorithm than the connector chose when initially authenticating.

To generate the challenge response for [blake3], [blake3::keyed_hash()] is used to hash the nonce. The key is derived using [blake3::derive_key()] using a context formatted like this: bonsaidb {server_timestamp} token-challenge. The server_timestamp value should be timestamp’s nanoseconds relative to BonsaiEpoch.

Trait Implementations

impl Clone for TokenChallengeAlgorithm

fn clone(&self) -> TokenChallengeAlgorithm

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TokenChallengeAlgorithm

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for TokenChallengeAlgorithm

fn deserialize<__D>( __deserializer: __D ) -> Result<TokenChallengeAlgorithm, <__D as Deserializer<'de>>::Error>where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Hash for TokenChallengeAlgorithm

fn hash<__H>(&self, state: &mut __H)where __H: Hasher,

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq<TokenChallengeAlgorithm> for TokenChallengeAlgorithm

fn eq(&self, other: &TokenChallengeAlgorithm) -> bool

This method tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

This method tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for TokenChallengeAlgorithm

fn serialize<__S>( &self, __serializer: __S ) -> Result<<__S as Serializer>::Ok, <__S as Serializer>::Error>where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Copy for TokenChallengeAlgorithm

impl Eq for TokenChallengeAlgorithm

impl StructuralEq for TokenChallengeAlgorithm

impl StructuralPartialEq for TokenChallengeAlgorithm