# Device Signer

`device-signer` is a secure Rust crate that provides cryptographic key generation, secure storage, and identity management tailored for hardware devices.

It derives deterministic **secp256k1 keys** from hardware identifiers (CPU serial, machine ID, etc.) combined with a securely persisted salt — giving each hardware unit a unique, verifiable cryptographic identity usable with both **Ethereum** and **Nostr**.

## Features

- **Hardware-Linked Identity**: Keys derived from unique device entropy (CPU serial, MAC address, machine ID).
- **Ethereum Compatible**: Native secp256k1 ECDSA keys, Ethereum addresses, and hash signing.
- **Nostr Compatible**: Schnorr signing and `npub1…` bech32 public keys — same key, zero extra derivation.
- **Secure Persistence**: Multiple storage backends for persisting the device salt.
- **AES-GCM Encryption**: Secure sealing of data when using enclave-style storage.

## Quick Start

```rust
use device_signer::identity::DeviceIdentity;

fn main() {
    let id = DeviceIdentity::new(Some("CAM-ABC123".to_string())).unwrap();

    // Ethereum identity
    println!("Ethereum address : {}", id.info.eth_address);

    let image_hash = [0u8; 32];
    let eth_sig = id.sign_hash_ecdsa(&image_hash).unwrap();
    println!("ECDSA signature  : {}", eth_sig);

    // Nostr identity 
    println!("Nostr pubkey     : {}", id.info.nostr_pubkey_hex);
    println!("npub             : {}", id.info.nostr_npub);

    let event_id = [0u8; 32]; 
    let schnorr_sig = id.sign_nostr_event(&event_id).unwrap();
    println!("Schnorr sig      : {}", schnorr_sig);
}
```

## Identity Fields

| Field | Description |
|---|---|
| `info.eth_address` | Ethereum address (`0x…`, 42 chars) |
| `info.eth_pubkey_hex` | Compressed secp256k1 public key (hex) |
| `info.nostr_pubkey_hex` | Nostr public key — 32-byte x-coordinate as lowercase hex (NIP-01) |
| `info.nostr_npub` | Nostr public key in `npub1…` bech32 encoding (NIP-19) |

## Signing Methods

| Method | Output | Use case |
|---|---|---|
| `sign_data_ecdsa(data)` | `Vec<u8>` | Sign arbitrary bytes (Ethereum) |
| `sign_hash_ecdsa(hash)` | 128-char hex | Sign a pre-hashed digest (Ethereum) |
| `sign_nostr_event(event_id)` | 128-char hex | Sign a NIP-01 event ID (Nostr Schnorr) |

## Storage Backends

The crate supports flexible storage through the `KeyStorage` trait:

1. **FileSystemStorage** — Persists salt to the local filesystem with primary (e.g., `/boot`) and backup locations.
2. **SecureEnclaveStorage** — Encrypts the salt using AES-256-GCM before persisting to disk, simulating a hardware-secured enclave.

## Running Tests and Examples

```bash
cargo run --example signer_demo   
cargo test                         
```
