nearby/internal/proto/credential.proto

syntax = "proto2";

package nearby.internal;

import "internal/proto/device_metadata.proto";

option java_package = "com.google.nearby.presence";

enum IdentityType {
  IDENTITY_TYPE_UNSPECIFIED = 0;
  IDENTITY_TYPE_PRIVATE = 1;
  IDENTITY_TYPE_TRUSTED = 2;
  IDENTITY_TYPE_PUBLIC = 3;
  IDENTITY_TYPE_PROVISIONED = 4;
}

// A proto to store the local device's private credential.
message PrivateCredential {
  optional IdentityType identity_type = 1;

  // The unique id of (and hashed based on) a pair of secret
  // key (PrivateCredential.verification_key) and X509Certificate's public
  // key (PublicCredential.verification_key).
  optional bytes secret_id = 2;

  // The aes key to encrypt personal fields in public certificates.
  // A bytes representation of a Secret Key owned by contact, to decrypt the
  // encrypted DeviceMetadata bytes stored within the advertisement.
  optional bytes authenticity_key = 3;

  // Bytes representation of a private key of X509Certificate, used in
  // handshake during contact verification phase.
  optional bytes verification_key = 4;

  // The time in millis from epoch when this credential becomes effective.
  optional uint64 start_time_millis = 5;

  //  The time in millis from epoch when this credential expires.
  optional uint64 end_time_millis = 6;

  // The set of 2-byte salts already used to encrypt the metadata key.
  map<uint32, bool> consumed_salts = 7;

  // The aes key to encrypt DeviceMetadata in public credential.
  optional bytes metadata_encryption_key = 8;

  // The device metadata relates to this private credential.
  optional DeviceMetadata device_metadata = 9;
}

message PublicCredential {
  optional IdentityType identity_type = 1;

  // The unique id of (and hashed based on) a pair of secret
  // key (PrivateCredential.verification_key) and X509Certificate's public
  // key (PublicCredential.verification_key).
  optional bytes secret_id = 2;

  // Bytes representation of a Secret Key owned by contact, to decrypt the
  // metadata_key stored within the advertisement.
  optional bytes authenticity_key = 3;

  // Bytes representation of a public key of X509Certificate, used in
  // handshake during contact verification phase.
  optional bytes verification_key = 4;

  // The time in millis from epoch when this credential becomes effective.
  optional uint64 start_time_millis = 5;

  //  The time in millis from epoch when this credential expires.
  optional uint64 end_time_millis = 6;

  // The encrypted DeviceMetadata in bytes, contains personal information of the
  // device/user who created this certificate. Needs to be decrypted into bytes,
  // and converted back to DeviceMetadata instance to access fields.
  optional bytes encrypted_metadata_bytes = 7;

  // The tag for verifying metadata_encryption_key.
  optional bytes metadata_encryption_key_tag = 8;
}