Struct Pkcs11Provider 

pub struct Pkcs11Provider { /* private fields */ }

PKCS#11 HSM provider (stub implementation).

This provides the interface for PKCS#11 HSM integration. A full implementation would use the pkcs11 or cryptoki crate.

Enterprise users would implement this against their specific HSM:

• SafeNet Luna
• Thales nShield
• AWS CloudHSM
• YubiHSM

Implementations

impl Pkcs11Provider

pub fn new(config: Pkcs11Config) -> Self

Create a new PKCS#11 provider.

pub fn initialize(&mut self) -> HsmResult<()>

Initialize the PKCS#11 session.

In a real implementation, this would:

1. Load the PKCS#11 library
2. Initialize the library
3. Open a session on the specified slot
4. Login with the provided PIN

pub fn finalize(&mut self) -> HsmResult<()>

Close the PKCS#11 session.

Trait Implementations

impl SigningProvider for Pkcs11Provider

fn name(&self) -> &str

Get the provider name.

fn is_available(&self) -> bool

Check if the provider is available and initialized.

fn generate_key(&self, label: &str) -> HsmResult<KeyId>

Generate a new key pair and return its identifier.

fn import_key(&self, label: &str, _secret_key: &SecretKey) -> HsmResult<KeyId>

Import an existing secret key.

fn get_public_key(&self, key_id: &KeyId) -> HsmResult<PublicKey>

Get the public key for a key identifier.

fn sign(&self, key_id: &KeyId, _message: &[u8]) -> HsmResult<SignatureBytes>

Sign a message using the specified key.

fn list_keys(&self) -> HsmResult<Vec<KeyMetadata>>

List all key identifiers.

fn delete_key(&self, key_id: &KeyId) -> HsmResult<()>

Delete a key.

fn key_exists(&self, _key_id: &KeyId) -> bool

Check if a key exists.

fn verify( &self, public_key: &PublicKey, message: &[u8], signature: &SignatureBytes, ) -> HsmResult<()>

Verify a signature (can use public key directly).

fn export_key(&self, key_id: &KeyId) -> HsmResult<SecretKey>

Export secret key (if allowed by key policy).

fn get_key_metadata(&self, key_id: &KeyId) -> HsmResult<KeyMetadata>

Get key metadata including lifecycle state and usage stats.

fn update_key_state( &self, key_id: &KeyId, state: KeyLifecycleState, ) -> HsmResult<()>

Update key lifecycle state.

fn health_check(&self) -> HsmResult<HealthStatus>

Perform health check and return status.

fn batch_sign( &self, key_id: &KeyId, messages: &[&[u8]], ) -> HsmResult<Vec<SignatureBytes>>

Batch sign multiple messages.

fn get_audit_log(&self, limit: usize) -> HsmResult<Vec<AuditEntry>>

Get audit log entries (if supported).

fn rotate_key(&self, key_id: &KeyId, new_label: &str) -> HsmResult<KeyId>

Rotate a key (generate new version while archiving old one).