keychain_type Enum

namespace keychain → enum class keychain_type

Overview

The keychain_type enumeration distinguishes between different types of keychains based on their cryptographic purpose and usage patterns.

Syntax

namespace keychain {
    enum class keychain_type {
        ENCRYPTION,    // Keychain for encryption/decryption operations
        SIGNATURE      // Keychain for signing/verification operations
    };
}

Members

ENCRYPTION

Value: keychain_type::ENCRYPTION

Keychain optimized for encryption and decryption operations.

Characteristics: * Contains encryption key pairs * Supports public key encryption schemes * Used for confidentiality operations * Recipients use public keys for encryption * Owners use private keys for decryption

Typical Algorithms: * ECIES (Elliptic Curve Integrated Encryption) * RSA-OAEP (RSA with OAEP padding) * ElGamal encryption

SIGNATURE

Value: keychain_type::SIGNATURE

Keychain optimized for digital signature operations.

Characteristics: * Contains signature key pairs * Supports digital signature schemes * Used for authentication and integrity * Signers use private keys for signing * Verifiers use public keys for verification

Typical Algorithms: * ECDSA (Elliptic Curve Digital Signature Algorithm) * RSA-PSS (RSA with PSS padding) * EdDSA (Edwards-curve Digital Signature Algorithm)

Usage

#include <keychain/keychain.h>

// Create typed keychains
keychain::keychain encryption_keychain(keychain::keychain_type::ENCRYPTION);
keychain::keychain signature_keychain(keychain::keychain_type::SIGNATURE);

// Check keychain type
keychain::keychain existing_keychain = persona.get_keychain();
keychain::keychain_type type = existing_keychain.get_type();

switch (type) {
    case keychain::keychain_type::ENCRYPTION:
        std::cout << "Encryption keychain - use for confidentiality" << std::endl;
        break;
    case keychain::keychain_type::SIGNATURE:
        std::cout << "Signature keychain - use for authentication" << std::endl;
        break;
}

// Type-specific operations
void perform_operation(keychain::keychain& kc, const std::string& data) {
    if (kc.get_type() == keychain::keychain_type::ENCRYPTION) {
        // Encryption operations
        auto encrypted = gateway.encrypt(persona, data, recipients);
    } else if (kc.get_type() == keychain::keychain_type::SIGNATURE) {
        // Signature operations
        auto signed_data = gateway.sign(persona, data);
    }
}

Keychain Type Comparison

Aspect	Encryption Keychain	Signature Keychain
Primary Purpose	Confidentiality	Authentication & Integrity
Key Usage	Public key encrypts, private key decrypts	Private key signs, public key verifies
Trust Model	Encrypt to trusted recipients	Trust verified signers
Key Distribution	Public keys widely distributed	Public keys authenticated & distributed
Performance	Slower (asymmetric encryption)	Faster (signature generation/verification)
Composability	Can encrypt signed data	Can sign encrypted data

Aspect

Encryption Keychain

Signature Keychain

Primary Purpose

Confidentiality

Authentication & Integrity

Key Usage

Public key encrypts, private key decrypts

Private key signs, public key verifies

Trust Model

Encrypt to trusted recipients

Trust verified signers

Key Distribution

Public keys widely distributed

Public keys authenticated & distributed

Performance

Slower (asymmetric encryption)

Faster (signature generation/verification)

Composability

Can encrypt signed data

Can sign encrypted data

Dual-Purpose Personas

Some personas may have both encryption and signature keychains:

// Persona with both keychain types
keychain::persona dual_purpose_persona = gateway.create_persona(
    "alice", "work", keychain::security_level::HIGH
);

// Get different keychains for different purposes
keychain::keychain enc_keychain = dual_purpose_persona.get_encryption_keychain();
keychain::keychain sig_keychain = dual_purpose_persona.get_signature_keychain();

assert(enc_keychain.get_type() == keychain::keychain_type::ENCRYPTION);
assert(sig_keychain.get_type() == keychain::keychain_type::SIGNATURE);

// Composable operations using different keychains
std::string message = "Confidential and authenticated data";

// Sign with signature keychain, then encrypt with encryption keychain
auto signed_data = gateway.sign(dual_purpose_persona, message);
auto encrypted_signed = gateway.encrypt(dual_purpose_persona,
                                       signed_data.serialize(),
                                       recipients);

Algorithm Compatibility

Different keychain types support different algorithm families:

Encryption Keychain Algorithms

ECIES with various curves (P-256, P-384, P-521)
RSA with OAEP padding (2048, 3072, 4096 bit)
ElGamal encryption
DLIES (Discrete Logarithm Integrated Encryption)

Signature Keychain Algorithms

ECDSA with various curves (P-256, P-384, P-521)
RSA with PSS or PKCS#1 v1.5 padding
EdDSA (Ed25519, Ed448)
DSA (Digital Signature Algorithm)

Security Considerations

Key Separation

Encryption and signature keys should be separate
Different keys mitigate cross-protocol attacks
Enables independent key lifecycle management
Supports principle of least privilege

Algorithm Selection

Choose algorithms appropriate for keychain type
Consider performance requirements
Evaluate long-term security (post-quantum)
Ensure compliance with standards

encryption_algorithm_class - Encryption algorithm families
signature_algorithm_class - Signature algorithm families
keychain - Keychain implementation
security_level - Security level configuration