nqkstmt(3)

NAME

nqkstmt — make a key statement: a rotation or a revocation

LIBRARY

libnoqtis, -lnoqtis

SYNOPSIS

#include <noqtis.h>

int
nqkstmt(nqsalg alg, const uint8_t *sk, size_t sklen, const uint8_t *pk, size_t pklen, nqsalg nalg, const uint8_t *nsk, size_t nsklen, const uint8_t *npk, size_t npklen, int64_t at, const char *reason, char *out, size_t cap, size_t *outlen);

DESCRIPTION

nqkstmt() writes to out, of cap bytes, a key statement (‘noqtis-keys-1, noqtis-capsule(5)’) in canonical JSON. With nsk and npk given, it is a rotation: the holder of the key pair sk, pk of alg says that from time at (seconds since 1970-01-01T00:00:00Z) it is replaced by nsk, npk of nalg, and both keys sign it. With nsk and npk NULL, it is a revocation of pk from at, signed by it. reason is NULL or up to 255 bytes of UTF-8 with no control character. *outlen gets the statement's size, also when cap is too small.

Each signature is verified before the statement is written. nqchkx(3) follows statements from a trusted key through its stmt option.

RETURN VALUES

NQOK: The statement was written.
[NQEBUF]: cap is too small.
[NQENOSUP]: An algorithm is not a post-quantum signature (Ed25519 alone).
[NQEARG]: A NULL argument, keys of the wrong sizes or not a pair, the new key equal to the old one, at before 1970 or after 9999, or a reason that is too long or not plain text.
[NQEMEM]: The allocation hook returned NULL.