Enum SecurityPolicy

Source

pub enum SecurityPolicy {
    Unknown,
    None,
    Aes128Sha256RsaOaep,
    Basic256Sha256,
    Aes256Sha256RsaPss,
    Basic128Rsa15,
    Basic256,
}

Expand description

SecurityPolicy implies what encryption and signing algorithms and their relevant key strengths are used during an encrypted session.

Variants§

§

Unknown

Security policy is unknown, this is generally an error.

§

None

No security.

§

Aes128Sha256RsaOaep

AES128/SHA256 RSA-OAEP.

§

Basic256Sha256

Basic256/SHA256

§

Aes256Sha256RsaPss

AES256/SHA256 RSA-PSS

§

Basic128Rsa15

Basic128. Note that this security policy is deprecated.

§

Basic256

Basic256.

Implementations§

Source §

impl SecurityPolicy

Source

pub fn to_uri(&self) -> &'static str

Get the security policy URI from this policy.

This will panic if the security policy is Unknown.

Source

pub fn is_supported(&self) -> bool

Returns true if the security policy is supported. It might be recognized but be unsupported by the implementation

Source

pub fn is_deprecated(&self) -> bool

Returns true if the security policy has been deprecated by the OPC UA specification

Source

pub fn to_str(&self) -> &'static str

Get a string representation of this policy.

This will panic if the security policy is Unknown.

Source

pub fn asymmetric_encryption_algorithm(&self) -> Option<&'static str>

Get the asymmetric encryption algorithm for this security policy.

This will panic if the security policy is Unknown or None.

Source

pub fn asymmetric_signature_algorithm(&self) -> &'static str

Get the asymmetric signature algorithm for this security policy.

This will panic if the security policy is Unknown or None.

Source

pub fn plain_block_size(&self) -> usize

Plaintext block size in bytes.

This will panic if the security policy is Unknown or None.

Source

pub fn symmetric_signature_size(&self) -> usize

Signature size in bytes.

This will panic if the security policy is Unknown.

Source

pub fn is_valid_keylength(&self, keylength: usize) -> bool

Tests if the supplied key length is valid for this policy

Source

pub fn random_nonce(&self) -> ByteString

Creates a random nonce in a bytestring with a length appropriate for the policy

Source

pub fn secure_channel_nonce_length(&self) -> usize

Length of the secure channel nonce for this security policy.

Source

pub fn from_uri(uri: &str) -> SecurityPolicy

Get the security policy from the given URI. Returns Unknown if the URI does not match any known policy.

Source

pub fn legacy_sequence_numbers(&self) -> bool

Returns whether the security policy uses legacy sequence numbers.

Source

pub fn make_secure_channel_keys( &self, secret: &[u8], seed: &[u8], ) -> AesDerivedKeys

Part 6 6.7.5 Deriving keys Once the SecureChannel is established the Messages are signed and encrypted with keys derived from the Nonces exchanged in the OpenSecureChannel call. These keys are derived by passing the Nonces to a pseudo-random function which produces a sequence of bytes from a set of inputs. A pseudo-random function is represented by the following function declaration:

Byte[] PRF( Byte[] secret,  Byte[] seed,  i32 length,  i32 offset)

Where length is the number of bytes to return and offset is a number of bytes from the beginning of the sequence.

The lengths of the keys that need to be generated depend on the SecurityPolicy used for the channel. The following information is specified by the SecurityPolicy:

a) SigningKeyLength (from the DerivedSignatureKeyLength); b) EncryptingKeyLength (implied by the SymmetricEncryptionAlgorithm); c) EncryptingBlockSize (implied by the SymmetricEncryptionAlgorithm).

The parameters passed to the pseudo random function are specified in Table 33.

Table 33 – Cryptography key generation parameters

The Client keys are used to secure Messages sent by the Client. The Server keys are used to secure Messages sent by the Server.

Source

pub fn asymmetric_sign( &self, signing_key: &PKey<RsaPrivateKey>, data: &[u8], signature: &mut [u8], ) -> Result<usize, Error>

Produce a signature of the data using an asymmetric key. Stores the signature in the supplied signature buffer. Returns the size of the signature within that buffer.

Source

pub fn asymmetric_verify_signature( &self, verification_key: &PKey<RsaPublicKey>, data: &[u8], signature: &[u8], ) -> Result<(), Error>

Verifies a signature of the data using an asymmetric key. In a debugging scenario, the signing key can also be supplied so that the supplied signature can be compared to a freshly generated signature.

Source

pub fn symmetric_padding_info(&self) -> PaddingInfo

Get information about message padding for symmetric encryption using this policy.

Source

pub fn asymmetric_padding_info( &self, remote_key: &PKey<RsaPublicKey>, ) -> PaddingInfo

Get information about message padding for asymmetric encryption using this policy, requires the public key of the receiver.

Source

pub fn calculate_cipher_text_size( &self, plain_text_size: usize, key: &PKey<RsaPublicKey>, ) -> usize

Calculate the size of the cipher text for asymmetric encryption.

Source

pub fn asymmetric_encrypt( &self, encryption_key: &PKey<RsaPublicKey>, src: &[u8], dst: &mut [u8], ) -> Result<usize, Error>

Encrypts a message using the supplied encryption key, returns the encrypted size. Destination buffer must be large enough to hold encrypted bytes including any padding.

Source

pub fn asymmetric_decrypt( &self, decryption_key: &PKey<RsaPrivateKey>, src: &[u8], dst: &mut [u8], ) -> Result<usize, Error>

Decrypts a message whose thumbprint matches the x509 cert and private key pair.

Returns the number of decrypted bytes

Source

pub fn symmetric_sign( &self, keys: &AesDerivedKeys, data: &[u8], signature: &mut [u8], ) -> Result<(), Error>

Produce a signature of some data using the supplied symmetric key. Signing algorithm is determined by the security policy. Signature is stored in the supplied signature argument.

Source