Encryption
Encryption primitives in Weave Crypto — X25519 key agreement and authenticated symmetric encryption helpers.
Purpose
Ed25519, X25519, Merkle hashing, HKDF, random bytes, discovery keys, and namespaces.
This page follows the real source shape for Weave Crypto and explains the workflow a developer is likely to use first.
Developer workflow
Start from the smallest constructor or builder, perform one meaningful operation, inspect the returned state, then add the relevant policy, storage, or network integration. The examples below should be expanded whenever the crate API changes.
Nonces for symmetric encryption must be unique per key. Reusing a nonce with the same key catastrophically breaks ChaCha20-Poly1305. Use the counter-based session API in zer0-secret-stream rather than rolling your own nonces.
Primary types to know
EncryptionKeyPair— libs/weave-crypto/src/lib.rsKeyPair— libs/weave-crypto/src/lib.rsNode— libs/weave-crypto/src/lib.rsCryptoError— libs/weave-crypto/src/lib.rsNamespaceCount— libs/weave-crypto/src/lib.rs
Example shape
use weave_crypto::{decrypt, encrypt, encryption_key_pair};
fn main() -> Result<(), Box<dyn std::error::Error>> {
// Curve25519 sealed-box style encryption: a deterministic recipient keypair
// is built from a seed (use None in production for a random keypair).
let recipient = encryption_key_pair(Some(&[0x11; 32]));
// The sender encrypts to the recipient's public key — no shared secret needed.
let plaintext = b"weave secret payload";
let ciphertext = encrypt(plaintext, &recipient.public_key);
// Only the recipient with the matching secret_key can decrypt.
let recovered = decrypt(&ciphertext, &recipient).ok_or("decrypt failed")?;
assert_eq!(recovered, plaintext);
println!("ciphertext={} bytes plaintext_roundtrip_ok", ciphertext.len());
Ok(())
}