Struct Pbes2KeyWrapper 

pub struct Pbes2KeyWrapper { /* private fields */ }

Available on crate features signatures and key-wrapping-pbes2 only.

PBES2-HS256+A256KW key wrapper (password-based).

Derives a 256-bit KEK from a password using PBKDF2-HMAC-SHA256, then wraps the content encryption key with AES Key Wrap (RFC 3394).

Implementations

impl Pbes2KeyWrapper

pub const DEFAULT_ITERATIONS: u32 = 600_000

Default PBKDF2 iteration count (600,000).

pub const MIN_ITERATIONS: u32 = 10_000

Minimum allowed PBKDF2 iteration count.

pub const MAX_ITERATIONS: u32 = 10_000_000

Maximum allowed PBKDF2 iteration count.

pub fn new(password: impl AsRef<[u8]>, iterations: u32) -> Result<Self>

Create a key wrapper with the given password and iteration count.

Errors

Returns an error if iterations is outside the allowed range (MIN_ITERATIONS..=MAX_ITERATIONS).

pub fn wrap(&self, content_key: &[u8]) -> Result<Pbes2WrappedKeyData>

Wrap a content encryption key.

Generates a random 16-byte salt, derives a KEK via PBKDF2-HMAC-SHA256, then wraps the content key with AES-256 Key Wrap.

Errors

Returns an error if AES key wrapping fails.