Weave Crypto
Discovery Keys and Namespaces
Keys and namespaces in Weave Crypto — keypair derivation, namespace keys, and discovery key generation under HKDF.
Purpose
Ed25519, X25519, Merkle hashing, HKDF, random bytes, discovery keys, and namespaces.
This page follows the real source shape for Weave Crypto and explains the workflow a developer is likely to use first.
Network contract
Document peer identity, topic selection, message framing, session lifetime, retry behavior, metrics, and what must be stable between releases. Any change here can strand peers, so examples should be exercised with at least two real processes.
Primary types to know
EncryptionKeyPair— libs/weave-crypto/src/lib.rsKeyPair— libs/weave-crypto/src/lib.rsNode— libs/weave-crypto/src/lib.rsCryptoError— libs/weave-crypto/src/lib.rsNamespaceCount— libs/weave-crypto/src/lib.rs
Example shape
use weave_crypto::{
derive_nonce, discovery_key, hkdf_sha256, key_pair, namespace, validate_key_pair,
};
fn main() {
// Build a deterministic Ed25519 keypair from a seed (None randomises).
let kp = key_pair(Some(&[7u8; 32]));
assert!(validate_key_pair(&kp));
// discovery_key is an HMAC-Blake3 tag used to advertise strands without
// leaking the public key.
let dk = discovery_key(&kp.public_key);
// HKDF-SHA256 expands a seed across labels — Weave uses this for per-feed
// encryption namespaces and per-session nonces.
let okm = hkdf_sha256(&kp.public_key, b"weave/salt", b"feed/v1", 64);
let nonce = derive_nonce("locus.metadata", &kp.public_key);
// `namespace` produces N distinct [u8; 32] tags under a parent name.
let tags = namespace("woven.dsocial", 4usize);
println!(
"discovery_key={} okm_len={} nonce_len={} namespace_count={}",
hex::encode(dk),
okm.len(),
nonce.len(),
tags.len(),
);
}