Struct RingCryptoProvider 

pub struct RingCryptoProvider;

Native crypto provider powered by ring (Ed25519) and p256 (ECDSA P-256).

Offloads CPU-bound operations to Tokio’s blocking pool via spawn_blocking to prevent async reactor starvation under load.

Usage:

use auths_crypto::{CryptoProvider, RingCryptoProvider};

let provider = RingCryptoProvider;
provider.verify_ed25519(&pubkey, &msg, &sig).await.unwrap();

Implementations

impl RingCryptoProvider

pub fn p256_generate() -> Result<(SecureSeed, Vec<u8>), CryptoError>

Generate a P-256 keypair. Returns (seed, compressed_public_key).

pub fn p256_sign( seed: &[u8; 32], message: &[u8], ) -> Result<Vec<u8>, CryptoError>

Sign with P-256. Returns 64-byte raw r||s.

pub fn ed25519_verify( pubkey: &[u8], message: &[u8], signature: &[u8], ) -> Result<(), CryptoError>

Verify an Ed25519 signature synchronously. Pubkey must be 32 raw bytes.

pub fn ed25519_sign( seed: &[u8; 32], message: &[u8], ) -> Result<Vec<u8>, CryptoError>

Sign with Ed25519 synchronously. Returns 64-byte raw signature.

Exists so key_ops::sign (the sync curve-agnostic dispatcher) can route through a single cfg-swappable provider entry point without taking the spawn-blocking cost the trait path pays. When FIPS/CNSA swap in, this inherent method is the one line that changes.

pub fn ed25519_public_key(seed: &[u8; 32]) -> Result<[u8; 32], CryptoError>

Derive 32-byte Ed25519 public key from a raw seed, synchronously.

pub fn p256_verify( pubkey: &[u8], message: &[u8], signature: &[u8], ) -> Result<(), CryptoError>

Verify a P-256 signature. Accepts 33-byte compressed or 65-byte uncompressed pubkey.

pub fn p256_public_key_from_seed( seed: &[u8; 32], ) -> Result<Vec<u8>, CryptoError>

Derive compressed public key from P-256 seed.

Trait Implementations

impl CryptoProvider for RingCryptoProvider

fn verify_p256<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, pubkey: &'life1 [u8], message: &'life2 [u8], signature: &'life3 [u8], ) -> Pin<Box<dyn Future<Output = Result<(), CryptoError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait,

Verify an ECDSA P-256 signature (r||s, 64 bytes) against a public key (33-byte compressed or 65-byte uncompressed SEC1) and message.

fn verify_ed25519<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, pubkey: &'life1 [u8], message: &'life2 [u8], signature: &'life3 [u8], ) -> Pin<Box<dyn Future<Output = Result<(), CryptoError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait,

Verify an Ed25519 signature against a public key and message.

fn sign_ed25519<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, seed: &'life1 SecureSeed, message: &'life2 [u8], ) -> Pin<Box<dyn Future<Output = Result<Vec<u8>, CryptoError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Sign a message using a raw 32-byte Ed25519 seed.

fn generate_ed25519_keypair<'life0, 'async_trait>( &'life0 self, ) -> Pin<Box<dyn Future<Output = Result<(SecureSeed, [u8; 32]), CryptoError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Generate a fresh Ed25519 keypair.

fn ed25519_public_key_from_seed<'life0, 'life1, 'async_trait>( &'life0 self, seed: &'life1 SecureSeed, ) -> Pin<Box<dyn Future<Output = Result<[u8; 32], CryptoError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Derive the 32-byte public key from a raw seed.

fn sign_p256<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, seed: &'life1 SecureSeed, message: &'life2 [u8], ) -> Pin<Box<dyn Future<Output = Result<Vec<u8>, CryptoError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Sign a message using a raw 32-byte P-256 scalar seed. Deterministic ECDSA per RFC 6979. Returns a 64-byte compact r||s signature.

fn generate_p256_keypair<'life0, 'async_trait>( &'life0 self, ) -> Pin<Box<dyn Future<Output = Result<(SecureSeed, Vec<u8>), CryptoError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Generate a fresh P-256 keypair. Returns the raw 32-byte scalar seed and the 33-byte SEC1 compressed public key.

fn p256_public_key_from_seed<'life0, 'life1, 'async_trait>( &'life0 self, seed: &'life1 SecureSeed, ) -> Pin<Box<dyn Future<Output = Result<Vec<u8>, CryptoError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Derive the 33-byte SEC1 compressed P-256 public key from a raw seed.

fn aead_encrypt<'life0, 'life1, 'life2, 'life3, 'life4, 'async_trait>( &'life0 self, key: &'life1 [u8; 32], nonce: &'life2 [u8; 12], aad: &'life3 [u8], plaintext: &'life4 [u8], ) -> Pin<Box<dyn Future<Output = Result<Vec<u8>, CryptoError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait, 'life4: 'async_trait,

Encrypt plaintext under a 256-bit symmetric key with a 96-bit nonce and Additional Authenticated Data (AAD). Output is ciphertext || tag (tag is 16 bytes for both ChaCha20-Poly1305 and AES-256-GCM).

fn aead_decrypt<'life0, 'life1, 'life2, 'life3, 'life4, 'async_trait>( &'life0 self, key: &'life1 [u8; 32], nonce: &'life2 [u8; 12], aad: &'life3 [u8], ciphertext: &'life4 [u8], ) -> Pin<Box<dyn Future<Output = Result<Vec<u8>, CryptoError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait, 'life4: 'async_trait,

Decrypt ciphertext (ct || tag) under a 256-bit symmetric key, 96-bit nonce, and matching AAD. Returns the plaintext on success; InvalidSignature on tag mismatch.

fn hkdf_sha256_expand<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, ikm: &'life1 [u8], salt: &'life2 [u8], info: &'life3 [u8], out_len: usize, ) -> Pin<Box<dyn Future<Output = Result<Vec<u8>, CryptoError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait,

One-shot HKDF-SHA256 extract-then-expand (RFC 5869).

fn hkdf_sha384_expand<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, ikm: &'life1 [u8], salt: &'life2 [u8], info: &'life3 [u8], out_len: usize, ) -> Pin<Box<dyn Future<Output = Result<Vec<u8>, CryptoError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait,

One-shot HKDF-SHA384 extract-then-expand. Same shape as [hkdf_sha256_expand] but with SHA-384 as the underlying hash. CNSA 2.0 requires SHA-384 for NSS workloads; default builds may return CryptoError::UnsupportedTarget if SHA-384 is not available.

fn hmac_sha256_compute<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, key: &'life1 [u8], msg: &'life2 [u8], ) -> Pin<Box<dyn Future<Output = Result<[u8; 32], CryptoError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Compute HMAC-SHA256 over msg under key. Returns a 32-byte tag.

fn hmac_sha256_verify<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, key: &'life1 [u8], msg: &'life2 [u8], tag: &'life3 [u8], ) -> Pin<Box<dyn Future<Output = Result<(), CryptoError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait,

Verify an HMAC-SHA256 tag over msg under key, constant-time.

fn hmac_sha384_compute<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, key: &'life1 [u8], msg: &'life2 [u8], ) -> Pin<Box<dyn Future<Output = Result<[u8; 48], CryptoError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Compute HMAC-SHA384 over msg under key. Returns a 48-byte tag. CNSA counterpart of [hmac_sha256_compute].

fn hmac_sha384_verify<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, key: &'life1 [u8], msg: &'life2 [u8], tag: &'life3 [u8], ) -> Pin<Box<dyn Future<Output = Result<(), CryptoError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait,

Verify an HMAC-SHA384 tag over msg under key, constant-time. CNSA counterpart of [hmac_sha256_verify].

fn sign_typed<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, seed: &'life1 TypedSeed, message: &'life2 [u8], ) -> Pin<Box<dyn Future<Output = Result<Vec<u8>, CryptoError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Sign a message using a curve-carrying seed. Dispatches internally based on seed.curve(); the caller never sees a curve-specific method.

fn verify_typed<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, curve: CurveType, pubkey: &'life1 [u8], message: &'life2 [u8], signature: &'life3 [u8], ) -> Pin<Box<dyn Future<Output = Result<(), CryptoError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait,

Verify a signature using a curve and raw public-key bytes. Dispatches internally; callers never see a curve-specific method.

fn generate_typed_keypair<'life0, 'async_trait>( &'life0 self, curve: CurveType, ) -> Pin<Box<dyn Future<Output = Result<(TypedSeed, Vec<u8>), CryptoError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Generate a keypair for the requested curve. Returns a curve-tagged crate::key_ops::TypedSeed plus raw public-key bytes.

fn typed_public_key_from_seed<'life0, 'life1, 'async_trait>( &'life0 self, seed: &'life1 TypedSeed, ) -> Pin<Box<dyn Future<Output = Result<Vec<u8>, CryptoError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Derive the public key from a curve-tagged seed.