Struct PskReceiver

pub struct PskReceiver { /* private fields */ }

The PskReceiver is used along with the [PskProvider] to perform TLS 1.3 out-of-band PSK authentication, using PSK’s generated from KMS.

This struct can be enabled on a config with s2n_tls::config::Builder::set_client_hello_callback.

Implementations

impl PskReceiver

pub fn new( kms_client: Client, trusted_key_arns: Vec<KeyArn>, obfuscation_keys: Vec<ObfuscationKey>, ) -> Self

Create a new PskReceiver.

This will receive the ciphertext datakey identities from a TLS client hello, then decrypt them using KMS. This establishes a mutually authenticated TLS handshake between parties with IAM permissions to generate and decrypt data keys

• kms_client: The KMS Client that will be used for the decrypt calls

• trusted_key_arns: The list of KMS KeyArns that the PskReceiver will accept PSKs from. This is necessary because an attacker could grant the server decrypt permissions on AttackerKeyArn, but the PskReceiver should not trust any Psk’s from AttackerKeyArn.

• obfuscation_keys: The keys that will be used to deobfuscate the received identities. The client PskProvider must be using one of the obfuscation keys in this list. If the PskReceiver receives a Psk identity obfuscated using a key not on this list, then the handshake will fail.

Trait Implementations

impl ClientHelloCallback for PskReceiver

fn on_client_hello( &self, connection: &mut Connection, ) -> Result<Option<Pin<Box<dyn ConnectionFuture>>>, Error>

The application can return an Ok(None) to resolve the callback synchronously or return an Ok(Some(ConnectionFuture)) if it wants to run some asynchronous task before resolving the callback.