Struct ChannelBinding 

pub struct ChannelBinding { /* private fields */ }

A parsed TLS channel binding: the RFC 9266 tls-exporter keying material for one connection.

Parse, don’t validate: the only way to hold a ChannelBinding is through ChannelBinding::from_exporter, which enforces the length. Downstream code (the envelope key derivation) can therefore trust the bytes without re-checking. Two ChannelBindings compare equal iff their exporter bytes match — i.e. iff they came from the same TLS connection. The comparison is constant-time so a relay attacker learns nothing from timing.

Implementations

impl ChannelBinding

pub fn from_exporter(material: &[u8]) -> Result<Self, ChannelBindingError>

Parse raw TLS exporter material into a channel binding.

material MUST be the keying material a TLS stack exported under TLS_EXPORTER_LABEL with an absent context and length TLS_EXPORTER_LEN — see the module docs for the normative parameters. Any other length is rejected so an invalid binding is unrepresentable past this boundary.

pub fn as_bytes(&self) -> &[u8; 32]

The raw exporter bytes, for folding into a key derivation as HKDF info-adjacent material. Not part of any serialized wire format — the binding never travels; each endpoint recomputes it from its own TLS connection.

Trait Implementations

impl Clone for ChannelBinding

fn clone(&self) -> ChannelBinding

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ChannelBinding

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for ChannelBinding

impl PartialEq for ChannelBinding

Constant-time equality: equal iff the two bindings come from the same TLS connection. Constant-time so a relay attacker probing “is my forged binding close to the real one?” learns nothing from response timing.

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.