refactor(server::crypto): use fixed-size [u8; 32] and KeyCell throughout seal key API

server/crates/arbiter-server/src/crypto/integrity/v1.rs

@@ -215,8 +215,6 @@ mod tests {
         },
         db::{self, schema},
     };
-    use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
-
     use super::{Error, Integrable, sign_entity, verify_entity};
     #[derive(Clone, arbiter_macros::Hashable)]
     struct DummyEntity {
@@ -235,7 +233,7 @@ mod tests {
         );
         actor
             .ask(Bootstrap {
-                seal_key_raw: SafeCell::new([0u8; 32].to_vec()),
+                seal_key: crate::crypto::KeyCell::from([0u8; 32]),
             })
             .await
             .unwrap();

server/crates/arbiter-server/src/crypto/mod.rs

@@ -21,6 +21,15 @@ impl From<SafeCell<Key>> for KeyCell {
         Self(value)
     }
 }
+impl From<[u8; 32]> for KeyCell {
+    fn from(bytes: [u8; 32]) -> Self {
+        let cell = SafeCell::new_inline_default(|key: &mut Key| {
+            key.copy_from_slice(&bytes);
+        });
+        Self(cell)
+    }
+}
+
 impl TryFrom<SafeCell<Vec<u8>>> for KeyCell {
     type Error = ();
 

server/crates/arbiter-server/src/crypto/shamir.rs

@@ -13,15 +13,17 @@ pub enum ShamirError {
 pub fn split_key(
     threshold: usize,
     total: usize,
-    key: &[u8],
+    key: &[u8; 32],
     rng: impl rand_core::RngCore + rand_core::CryptoRng,
 ) -> Result<Vec<Vec<u8>>, ShamirError> {
-    Gf256::split_array(threshold, total, key, rng)
+    Gf256::split_array(threshold, total, key.as_slice(), rng)
         .map_err(|e| ShamirError::Split(format!("{e:?}")))
 }
 
 /// Reconstruct the secret from `threshold` or more shares.
-pub fn combine_shares(shares: &[Vec<u8>]) -> Result<Vec<u8>, ShamirError> {
-    Gf256::combine_array(shares)
-        .map_err(|e| ShamirError::Combine(format!("{e:?}")))
+pub fn combine_shares(shares: &[Vec<u8>]) -> Result<[u8; 32], ShamirError> {
+    let bytes = Gf256::combine_array(shares)
+        .map_err(|e| ShamirError::Combine(format!("{e:?}")))?;
+    <[u8; 32]>::try_from(bytes.as_slice())
+        .map_err(|_| ShamirError::Combine("unexpected reconstructed key length".to_owned()))
 }