Struct NsmSession 

pub struct NsmSession { /* private fields */ }

An open session with the Nitro Security Module (/dev/nsm).

Implements RAII to ensure the device file descriptor is automatically closed via nsm_exit when the session is dropped.

Implementations

impl NsmSession

NSM operations: opening a session, attestation requests and PCR management.

pub fn open() -> Result<Self, AttestationError>

Opens a new session with the Nitro Security Module.

Calls nsm_init to open /dev/nsm. Returns AttestationError::DeviceOpenFailed if the device file cannot be opened (e.g., if not running inside an AWS Nitro Enclave).

pub fn from_raw_fd(fd: i32) -> Result<Self, AttestationError>

Creates an NsmSession from an existing raw file descriptor.

pub fn raw_fd(&self) -> i32

Returns the underlying raw file descriptor.

pub fn create_attestation( &self, params: &AttestationParams, ) -> Result<Vec<u8>, AttestationError>

Requests an Attestation Document from the NSM.

Returns the raw COSE_Sign1 formatted document bytes.

pub fn create_attestation_for_cert( &self, cert_der: &[u8], ) -> Result<Vec<u8>, AttestationError>

Convenience method to create an attestation document binding an ephemeral TLS certificate.

Computes the SHA-256 hash of cert_der and supplies it as user_data.

pub fn describe_nsm(&self) -> Result<NsmDescription, AttestationError>

Describes the connected Nitro Security Module capabilities and configuration.

pub fn get_random(&self) -> Result<Vec<u8>, AttestationError>

Requests cryptographic entropy (random bytes) from the NSM.

pub fn describe_pcr( &self, index: u16, ) -> Result<(bool, Vec<u8>), AttestationError>

Describes a Platform Configuration Register (PCR) at index. Returns (locked, data).

pub fn extend_pcr( &self, index: u16, data: Vec<u8>, ) -> Result<Vec<u8>, AttestationError>

Extends a Platform Configuration Register (PCR) at index with data.

pub fn lock_pcr(&self, index: u16) -> Result<(), AttestationError>

Locks a Platform Configuration Register (PCR) at index against further modification.

Trait Implementations

impl AttestationProvider for NsmSession

Nitro implementation of AttestationProvider, backed by /dev/nsm.

fn name(&self) -> &'static str

Returns "aws-nitro".

fn is_available() -> bool

Returns true if the NSM device /dev/nsm exists.

fn generate_document( &self, params: &AttestationParams, ) -> Result<EatClaimsSet, AttestationError>

Requests a real attestation document from the NSM for params and wraps it as an EAT claims-set.

impl Debug for NsmSession

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Drop for NsmSession

Closes the NSM device file descriptor when the session goes out of scope.

fn drop(&mut self)

Calls nsm_exit on the open file descriptor, at most once.

fn pin_drop(self: Pin<&mut Self>)

🔬This is a nightly-only experimental API. (pin_ergonomics)

Execute the destructor for this type, but different to Drop::drop, it requires self to be pinned.