Struct LocalSoftwareProvider 

pub struct LocalSoftwareProvider<'a> { /* private fields */ }

Basil’s local-software PQC provider: ML-DSA signing/verification and ML-KEM encapsulation/decapsulation/envelope over software-custodied keys.

Private keys are custodied as encrypted [SoftwareCustodyKeyRecord]s in the backend KV store. For each private-key operation the provider reads the record, validates its non-secret metadata, AEAD-decrypts the seed into a Zeroizing buffer, runs the PQC math, and drops the seed: it never holds standing private material. ML-DSA math lives in ml_dsa_sign; ML-KEM math and the envelope sealing live in ml_kem_envelope.

Provisioning (Self::generate_key for ML-DSA, Self::generate_sealing_key for ML-KEM) generates a fresh seed, seals it under the catalog storage_key AEAD key with the custody-binding AAD, and writes the record; the seed never leaves a Zeroizing buffer and only the public half is returned. BYOK Self::import_key remains unsupported (custody records are broker-sealed).

Implementations

impl<'a> LocalSoftwareProvider<'a>

pub const PROVIDER_VERSION: &'static str = "1"

Stable provider-implementation version token. It is recorded in the crypto_provider_version catalog label and bound into the custody-record AAD, so a record provisioned for a different version fails closed.

pub const fn new(backend: &'a dyn Backend) -> Self

Build a provider over the backend that custodies the encrypted records.

Trait Implementations

impl CryptoProvider for LocalSoftwareProvider<'_>

fn provider_id(&self) -> CryptoProviderId

Stable provider identifier.

fn generate_key<'life0, 'life1, 'async_trait>( &'life0 self, request: GenerateKey<'life1>, ) -> Pin<Box<dyn Future<Output = Result<NewKey, ProviderError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Generate a new provider-native signing key.

fn generate_sealing_key<'life0, 'life1, 'async_trait>( &'life0 self, request: GenerateSealingKey<'life1>, ) -> Pin<Box<dyn Future<Output = Result<NewKey, ProviderError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Generate a new provider-native KEM sealing (recipient) key.

fn import_key<'life0, 'life1, 'async_trait>( &'life0 self, request: ImportKey<'life1>, ) -> Pin<Box<dyn Future<Output = Result<NewKey, ProviderError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Import caller-provided key material.

fn sign<'life0, 'life1, 'async_trait>( &'life0 self, request: SignRequest<'life1>, ) -> Pin<Box<dyn Future<Output = Result<Vec<u8>, ProviderError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Sign in place.

fn verify<'life0, 'life1, 'async_trait>( &'life0 self, request: VerifyRequest<'life1>, ) -> Pin<Box<dyn Future<Output = Result<bool, ProviderError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Verify with provider-held public material.

fn encapsulate<'life0, 'life1, 'async_trait>( &'life0 self, request: EncapsulateRequest<'life1>, ) -> Pin<Box<dyn Future<Output = Result<Encapsulation, ProviderError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

KEM encapsulation.

fn decapsulate<'life0, 'life1, 'async_trait>( &'life0 self, request: DecapsulateRequest<'life1>, ) -> Pin<Box<dyn Future<Output = Result<Zeroizing<Vec<u8>>, ProviderError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

KEM decapsulation.

fn wrap_envelope<'life0, 'life1, 'async_trait>( &'life0 self, request: WrapEnvelopeRequest<'life1>, ) -> Pin<Box<dyn Future<Output = Result<Envelope, ProviderError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

KEM plus envelope encryption.

fn unwrap_envelope<'life0, 'life1, 'async_trait>( &'life0 self, request: UnwrapEnvelopeRequest<'life1>, ) -> Pin<Box<dyn Future<Output = Result<Vec<u8>, ProviderError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

KEM plus envelope decryption.