craton-hsm 0.10.5

// SPDX-License-Identifier: Apache-2.0
// Copyright 2026 Craton Software Company
use rsa::pkcs8::DecodePrivateKey;
use rsa::{Pkcs1v15Sign, RsaPrivateKey, RsaPublicKey};
#[allow(unused_imports)]
use sha2::{Digest, Sha256, Sha384, Sha512};

use crate::error::{HsmError, HsmResult};
use crate::pkcs11_abi::constants::*;
use crate::pkcs11_abi::types::CK_MECHANISM_TYPE;

/// Whether this build permits RustCrypto RSA private-key operations.
///
/// The same condition as [`require_rustcrypto_rsa_private_ops`], exposed as a
/// query so callers that must *branch* on the capability rather than fail on it
/// do not have to construct and discard an error. The power-on self-test uses
/// it to choose between the sign/verify roundtrip KAT and the verify-only KAT:
/// an unconditional signing KAT fails the POST — and therefore
/// `C_Initialize` — in any release build.
pub(crate) const fn rsa_private_ops_permitted() -> bool {
    cfg!(any(
        debug_assertions,
        feature = "insecure-rustcrypto-rsa-private-ops"
    ))
}

/// RUSTSEC-2023-0071 (Marvin) affects RustCrypto RSA private-key operations.
/// Release artifacts must use a hardened backend; debug/vector builds can opt
/// in to these routines only for development coverage.
pub(crate) fn require_rustcrypto_rsa_private_ops() -> HsmResult<()> {
    #[cfg(any(debug_assertions, feature = "insecure-rustcrypto-rsa-private-ops"))]
    {
        Ok(())
    }
    #[cfg(not(any(debug_assertions, feature = "insecure-rustcrypto-rsa-private-ops")))]
    {
        tracing::error!(
            "RustCrypto RSA private-key operation refused in release due to RUSTSEC-2023-0071; use a hardened backend"
        );
        Err(HsmError::MechanismInvalid)
    }
}

// ============================================================================
// RSA Key Caches
// ============================================================================
//
// Parsing PKCS#8 DER → RsaPrivateKey is expensive (bignum reconstruction).
// Since the same key is reused across many sign operations, we maintain two
// caches:
//
// 1. **DER-hash cache** (`RSA_KEY_CACHE`) — the legacy/slow path keyed by
//    SHA-256(DER).  Used by callers that don't have an object handle.
//
// 2. **Handle-based caches** (`RSA_PRIV_CACHE`, `RSA_PUB_CACHE`) — the fast
//    path keyed by `CK_OBJECT_HANDLE` (u64).  O(1) lookup with no hashing,
//    returns `Arc` (no clone of the inner key), and supports both private and
//    public RSA keys.
//
// When either cache is full (64 entries), a single arbitrary entry is evicted
// instead of clearing the entire map, avoiding thundering-herd repopulation.

use std::sync::{Arc, LazyLock};
use zeroize::Zeroize;

/// Maximum number of entries per cache.
const RSA_KEY_CACHE_MAX: usize = 64;

// ---------------------------------------------------------------------------
// Handle-based Arc caches (fast path)
// ---------------------------------------------------------------------------

/// Handle-based RSA private key cache.
///
/// Keyed by (slot_id, handle) to prevent cross-slot cache collisions.
/// The Arc avoids cloning RSA BigNums on cache hits but note that
/// SigningKey construction still requires a clone due to the rsa crate's
/// ownership API.
static RSA_PRIV_CACHE: LazyLock<dashmap::DashMap<(u64, u64), Arc<RsaPrivateKey>>> =
    LazyLock::new(|| dashmap::DashMap::with_capacity(RSA_KEY_CACHE_MAX));

/// Handle-based RSA public key cache.
///
/// Keyed by (slot_id, handle) to prevent cross-slot cache collisions.
/// The Arc avoids cloning RSA BigNums on cache hits but note that
/// SigningKey construction still requires a clone due to the rsa crate's
/// ownership API.
static RSA_PUB_CACHE: LazyLock<dashmap::DashMap<(u64, u64), Arc<RsaPublicKey>>> =
    LazyLock::new(|| dashmap::DashMap::with_capacity(RSA_KEY_CACHE_MAX));

/// Evict one arbitrary entry from a `DashMap` when it is at capacity.
/// This avoids clearing the entire cache (thundering herd) while keeping
/// the implementation simple (no LRU metadata overhead).
fn evict_one_if_full<K: std::hash::Hash + Eq + Clone, V>(map: &dashmap::DashMap<K, V>) {
    if map.len() >= RSA_KEY_CACHE_MAX {
        if let Some(entry) = map.iter().next() {
            let key = entry.key().clone();
            drop(entry); // release the read guard before removing
            map.remove(&key);
        }
    }
}

/// Cache an already-parsed RSA private key by (slot_id, handle).
pub fn cache_rsa_private_key(slot_id: u64, handle: u64, key: Arc<RsaPrivateKey>) {
    evict_one_if_full(&RSA_PRIV_CACHE);
    RSA_PRIV_CACHE.insert((slot_id, handle), key);
}

/// Get a cached RSA private key by (slot_id, handle). Returns `None` on miss.
pub fn get_cached_rsa_private_key(slot_id: u64, handle: u64) -> Option<Arc<RsaPrivateKey>> {
    RSA_PRIV_CACHE
        .get(&(slot_id, handle))
        .map(|entry| Arc::clone(entry.value()))
}

/// Cache an already-parsed RSA public key by (slot_id, handle).
pub fn cache_rsa_public_key(slot_id: u64, handle: u64, key: Arc<RsaPublicKey>) {
    evict_one_if_full(&RSA_PUB_CACHE);
    RSA_PUB_CACHE.insert((slot_id, handle), key);
}

/// Get a cached RSA public key by (slot_id, handle). Returns `None` on miss.
pub fn get_cached_rsa_public_key(slot_id: u64, handle: u64) -> Option<Arc<RsaPublicKey>> {
    RSA_PUB_CACHE
        .get(&(slot_id, handle))
        .map(|entry| Arc::clone(entry.value()))
}

/// Evict all cached keys for a given (slot_id, handle) pair (call on C_DestroyObject).
pub fn evict_cached_keys(slot_id: u64, handle: u64) {
    RSA_PRIV_CACHE.remove(&(slot_id, handle));
    RSA_PUB_CACHE.remove(&(slot_id, handle));
}

/// Evict every cached RSA key (both private and public) that belongs to
/// `slot_id`.  Intended for slot-wide events such as `C_InitToken`, which
/// destroys all objects on the token and therefore invalidates every
/// `(slot_id, handle)` entry for that slot.
///
/// Handles persist across same-slot sessions per the PKCS#11 spec, so this
/// MUST NOT be called from `C_CloseSession` / `C_CloseAllSessions`.
pub fn clear_for_slot(slot_id: u64) {
    RSA_PRIV_CACHE.retain(|&(s, _), _| s != slot_id);
    RSA_PUB_CACHE.retain(|&(s, _), _| s != slot_id);
}

/// Drop every entry from both handle-based RSA caches.  Intended for
/// process-wide cleanup such as `C_Finalize`.
pub fn clear_all() {
    RSA_PRIV_CACHE.clear();
    RSA_PUB_CACHE.clear();
}

// ---------------------------------------------------------------------------
// DER-hash cache (legacy / slow path)
// ---------------------------------------------------------------------------

/// Wrapper around `RsaPrivateKey` that zeroizes the PKCS#8 DER encoding on drop.
///
/// The `rsa` crate's `RsaPrivateKey` does not implement `Zeroize` (its bignums
/// are heap-allocated via `num-bigint`). We work around this by re-exporting
/// the key to PKCS#8 DER, zeroizing those bytes, and overwriting the struct's
/// in-memory fields with a minimal dummy key. This ensures sensitive key material
/// does not linger in freed heap memory.
struct ZeroizingRsaKey {
    key: RsaPrivateKey,
}

impl ZeroizingRsaKey {
    fn new(key: RsaPrivateKey) -> Self {
        Self { key }
    }
}

impl Drop for ZeroizingRsaKey {
    fn drop(&mut self) {
        // Best-effort zeroization: export to DER and zeroize those bytes.
        // This clears the most accessible copy of the key material.
        use rsa::pkcs8::EncodePrivateKey;
        if let Ok(der) = self.key.to_pkcs8_der() {
            let mut der_bytes = der.as_bytes().to_vec();
            der_bytes.zeroize();
        }
        // Overwrite the in-memory struct fields by assigning a minimal dummy key.
        // This forces the allocator to drop (and eventually reuse) the original
        // bignum heap allocations, limiting the window of exposure.
        use rsa::BigUint;
        if let Ok(dummy) = RsaPrivateKey::from_components(
            BigUint::from(3u32),       // n (minimal)
            BigUint::from(3u32),       // e
            BigUint::from(1u32),       // d
            vec![BigUint::from(3u32)], // primes
        ) {
            self.key = dummy;
        }
    }
}

/// Cache of parsed RSA private keys, keyed by SHA-256(DER).
/// Uses DashMap for lock-free concurrent access. Values are wrapped in
/// `ZeroizingRsaKey` to best-effort zeroize key material on eviction.
///
/// **Slow path** — prefer the handle-based `RSA_PRIV_CACHE` when an object
/// handle is available.
static RSA_KEY_CACHE: LazyLock<dashmap::DashMap<[u8; 32], ZeroizingRsaKey>> =
    LazyLock::new(|| dashmap::DashMap::with_capacity(RSA_KEY_CACHE_MAX));

/// Parse an RSA private key from PKCS#8 DER, using the DER-hash cache.
///
/// **Slow path** — computes SHA-256(DER) on every call and clones the key on
/// cache hit.  Prefer the `*_cached` function variants when a
/// `CK_OBJECT_HANDLE` is available.
fn parse_rsa_private_key(der: &[u8]) -> HsmResult<RsaPrivateKey> {
    let cache_key: [u8; 32] = Sha256::digest(der).into();

    // Fast path: cache hit (still clones — use handle cache to avoid this)
    if let Some(entry) = RSA_KEY_CACHE.get(&cache_key) {
        return Ok(entry.value().key.clone());
    }

    // Slow path: parse and cache
    let private_key = RsaPrivateKey::from_pkcs8_der(der).map_err(|_| HsmError::KeyHandleInvalid)?;

    // Evict one arbitrary entry instead of clearing the whole cache.
    evict_one_if_full_zeroizing(&RSA_KEY_CACHE);

    RSA_KEY_CACHE.insert(cache_key, ZeroizingRsaKey::new(private_key.clone()));
    Ok(private_key)
}

/// Single-entry eviction for the ZeroizingRsaKey DER-hash cache.
fn evict_one_if_full_zeroizing(map: &dashmap::DashMap<[u8; 32], ZeroizingRsaKey>) {
    if map.len() >= RSA_KEY_CACHE_MAX {
        if let Some(entry) = map.iter().next() {
            let key = *entry.key();
            drop(entry);
            map.remove(&key);
        }
    }
}

/// Clear all RSA key caches. Called on C_Finalize / C_InitToken.
/// Each evicted private-key entry in the DER-hash cache is zeroized via
/// `ZeroizingRsaKey::drop()`.
pub fn clear_rsa_key_cache() {
    RSA_KEY_CACHE.clear();
    RSA_PRIV_CACHE.clear();
    RSA_PUB_CACHE.clear();
}

/// Minimum RSA modulus size in bits. Keys below this threshold are rejected
/// for all operations (sign, verify, encrypt, decrypt) regardless of how
/// the key was imported. Per NIST SP 800-131A Rev 2, 2048-bit is the floor.
const RSA_MIN_MODULUS_BITS: usize = 2048;

/// Maximum data size for sign/verify operations (64 MiB).
/// Prevents resource exhaustion from hashing arbitrarily large inputs.
/// This is a practical upper bound; legitimate signing payloads are
/// typically much smaller (documents, certificates, etc.).
const SIGN_MAX_DATA_SIZE: usize = 64 * 1024 * 1024; // 64 MiB

/// Validate that the data to be signed/verified does not exceed the DoS limit.
fn validate_data_size(data: &[u8]) -> HsmResult<()> {
    if data.len() > SIGN_MAX_DATA_SIZE {
        tracing::warn!(
            "Sign/verify data size {} exceeds maximum {} bytes — rejecting to prevent DoS",
            data.len(),
            SIGN_MAX_DATA_SIZE
        );
        return Err(HsmError::DataLenRange);
    }
    Ok(())
}

/// Validate that a pre-computed digest has the correct length for the specified hash algorithm.
/// Accepting a mismatched digest length could cause undefined behavior or silent misoperation
/// in the underlying RSA/ECDSA library (e.g., truncation or padding).
fn validate_digest_length(digest: &[u8], hash_alg: HashAlg) -> HsmResult<()> {
    let expected_len = match hash_alg {
        HashAlg::Sha256 => 32,
        HashAlg::Sha384 => 48,
        HashAlg::Sha512 => 64,
    };
    if digest.len() != expected_len {
        tracing::error!(
            "Prehash digest length mismatch: got {} bytes, expected {} for {:?}",
            digest.len(),
            expected_len,
            hash_alg
        );
        return Err(HsmError::DataLenRange);
    }
    Ok(())
}

/// Validate that an RSA private key meets the minimum key size requirement.
fn validate_rsa_private_key_size(private_key: &RsaPrivateKey) -> HsmResult<()> {
    use rsa::traits::PublicKeyParts;
    let modulus_bits = private_key.n().bits();
    if modulus_bits < RSA_MIN_MODULUS_BITS {
        tracing::warn!(
            "Rejecting RSA operation: key size {} bits is below minimum {} bits",
            modulus_bits,
            RSA_MIN_MODULUS_BITS
        );
        return Err(HsmError::KeySizeRange);
    }
    Ok(())
}

/// Validate that RSA public key components meet the minimum key size requirement.
fn validate_rsa_public_key_size(modulus: &[u8]) -> HsmResult<()> {
    // modulus is big-endian bytes; strip leading zero bytes to count significant bits
    let significant = modulus
        .iter()
        .position(|&b| b != 0)
        .unwrap_or(modulus.len());
    let significant_bytes = &modulus[significant..];
    let modulus_bits = if significant_bytes.is_empty() {
        0
    } else {
        // bits = (byte_count - 1) * 8 + significant_bits_in_first_byte
        (significant_bytes.len() - 1) * 8 + (8 - significant_bytes[0].leading_zeros() as usize)
    };
    if modulus_bits < RSA_MIN_MODULUS_BITS {
        tracing::warn!(
            "Rejecting RSA operation: key size {} bits is below minimum {} bits",
            modulus_bits,
            RSA_MIN_MODULUS_BITS
        );
        return Err(HsmError::KeySizeRange);
    }
    Ok(())
}

#[derive(Debug, Clone, Copy)]
pub enum HashAlg {
    Sha256,
    Sha384,
    Sha512,
}

// ============================================================================
// RSA PKCS#1 v1.5
// ============================================================================

/// RSA PKCS#1 v1.5 sign
pub fn rsa_pkcs1v15_sign(
    private_key_der: &[u8],
    data: &[u8],
    hash_alg: Option<HashAlg>,
) -> HsmResult<Vec<u8>> {
    require_rustcrypto_rsa_private_ops()?;
    use rsa::signature::SignatureEncoding;

    validate_data_size(data)?;
    let private_key = parse_rsa_private_key(private_key_der)?;
    validate_rsa_private_key_size(&private_key)?;

    match hash_alg {
        Some(HashAlg::Sha256) => {
            use rsa::pkcs1v15::SigningKey;
            use rsa::signature::Signer;
            let signing_key = SigningKey::<Sha256>::new(private_key);
            let signature = signing_key.sign(data);
            Ok(signature.to_vec())
        }
        Some(HashAlg::Sha384) => {
            use rsa::pkcs1v15::SigningKey;
            use rsa::signature::Signer;
            let signing_key = SigningKey::<Sha384>::new(private_key);
            let signature = signing_key.sign(data);
            Ok(signature.to_vec())
        }
        Some(HashAlg::Sha512) => {
            use rsa::pkcs1v15::SigningKey;
            use rsa::signature::Signer;
            let signing_key = SigningKey::<Sha512>::new(private_key);
            let signature = signing_key.sign(data);
            Ok(signature.to_vec())
        }
        None => {
            // Reject unprefixed PKCS#1 v1.5 signing — vulnerable to Bleichenbacher forgery.
            // Callers must specify a hash algorithm for DigestInfo wrapping.
            Err(HsmError::MechanismParamInvalid)
        }
    }
}

/// RSA PKCS#1 v1.5 verify
pub fn rsa_pkcs1v15_verify(
    modulus: &[u8],
    public_exponent: &[u8],
    data: &[u8],
    signature: &[u8],
    hash_alg: Option<HashAlg>,
) -> HsmResult<bool> {
    validate_data_size(data)?;
    validate_rsa_public_key_size(modulus)?;
    let n = rsa::BigUint::from_bytes_be(modulus);
    let e = rsa::BigUint::from_bytes_be(public_exponent);
    let public_key = RsaPublicKey::new(n, e).map_err(|_| HsmError::KeyHandleInvalid)?;

    match hash_alg {
        Some(HashAlg::Sha256) => {
            use rsa::pkcs1v15::VerifyingKey;
            use rsa::signature::Verifier;
            let verifying_key = VerifyingKey::<Sha256>::new(public_key);
            let sig = rsa::pkcs1v15::Signature::try_from(signature)
                .map_err(|_| HsmError::SignatureInvalid)?;
            Ok(verifying_key.verify(data, &sig).is_ok())
        }
        Some(HashAlg::Sha384) => {
            use rsa::pkcs1v15::VerifyingKey;
            use rsa::signature::Verifier;
            let verifying_key = VerifyingKey::<Sha384>::new(public_key);
            let sig = rsa::pkcs1v15::Signature::try_from(signature)
                .map_err(|_| HsmError::SignatureInvalid)?;
            Ok(verifying_key.verify(data, &sig).is_ok())
        }
        Some(HashAlg::Sha512) => {
            use rsa::pkcs1v15::VerifyingKey;
            use rsa::signature::Verifier;
            let verifying_key = VerifyingKey::<Sha512>::new(public_key);
            let sig = rsa::pkcs1v15::Signature::try_from(signature)
                .map_err(|_| HsmError::SignatureInvalid)?;
            Ok(verifying_key.verify(data, &sig).is_ok())
        }
        None => {
            // Reject unprefixed PKCS#1 v1.5 verification — vulnerable to
            // Bleichenbacher signature forgery with low public exponents (e=3).
            // Callers must specify a hash algorithm for DigestInfo validation.
            Err(HsmError::MechanismParamInvalid)
        }
    }
}

// ============================================================================
// RSA-PSS
// ============================================================================

/// RSA-PSS sign
///
/// Uses the SP 800-90A HMAC_DRBG for salt generation (via `DrbgRng`)
/// instead of `OsRng` directly, ensuring all randomness benefits from
/// the DRBG's continuous health testing and prediction resistance.
pub fn rsa_pss_sign(private_key_der: &[u8], data: &[u8], hash_alg: HashAlg) -> HsmResult<Vec<u8>> {
    require_rustcrypto_rsa_private_ops()?;
    use crate::crypto::drbg::DrbgRng;
    use rsa::pss::SigningKey;
    use rsa::signature::{RandomizedSigner, SignatureEncoding};

    validate_data_size(data)?;
    let private_key = parse_rsa_private_key(private_key_der)?;
    validate_rsa_private_key_size(&private_key)?;

    let mut rng = DrbgRng::new()?;

    match hash_alg {
        HashAlg::Sha256 => {
            let signing_key = SigningKey::<Sha256>::new(private_key);
            let signature = signing_key.sign_with_rng(&mut rng, data);
            Ok(signature.to_vec())
        }
        HashAlg::Sha384 => {
            let signing_key = SigningKey::<Sha384>::new(private_key);
            let signature = signing_key.sign_with_rng(&mut rng, data);
            Ok(signature.to_vec())
        }
        HashAlg::Sha512 => {
            let signing_key = SigningKey::<Sha512>::new(private_key);
            let signature = signing_key.sign_with_rng(&mut rng, data);
            Ok(signature.to_vec())
        }
    }
}

/// RSA-PSS verify
pub fn rsa_pss_verify(
    modulus: &[u8],
    public_exponent: &[u8],
    data: &[u8],
    signature: &[u8],
    hash_alg: HashAlg,
) -> HsmResult<bool> {
    use rsa::pss::VerifyingKey;
    use rsa::signature::Verifier;

    validate_data_size(data)?;
    validate_rsa_public_key_size(modulus)?;
    let n = rsa::BigUint::from_bytes_be(modulus);
    let e = rsa::BigUint::from_bytes_be(public_exponent);
    let public_key = RsaPublicKey::new(n, e).map_err(|_| HsmError::KeyHandleInvalid)?;

    match hash_alg {
        HashAlg::Sha256 => {
            let verifying_key = VerifyingKey::<Sha256>::new(public_key);
            let sig =
                rsa::pss::Signature::try_from(signature).map_err(|_| HsmError::SignatureInvalid)?;
            Ok(verifying_key.verify(data, &sig).is_ok())
        }
        HashAlg::Sha384 => {
            let verifying_key = VerifyingKey::<Sha384>::new(public_key);
            let sig =
                rsa::pss::Signature::try_from(signature).map_err(|_| HsmError::SignatureInvalid)?;
            Ok(verifying_key.verify(data, &sig).is_ok())
        }
        HashAlg::Sha512 => {
            let verifying_key = VerifyingKey::<Sha512>::new(public_key);
            let sig =
                rsa::pss::Signature::try_from(signature).map_err(|_| HsmError::SignatureInvalid)?;
            Ok(verifying_key.verify(data, &sig).is_ok())
        }
    }
}

// ============================================================================
// RSA-OAEP
// ============================================================================

/// Hash algorithm selection for RSA-OAEP, derived from CK_RSA_PKCS_OAEP_PARAMS.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum OaepHash {
    Sha256,
    Sha384,
    Sha512,
}

/// RSA-OAEP encrypt (using public key components)
///
/// Uses the SP 800-90A HMAC_DRBG for OAEP padding randomness (via `DrbgRng`)
/// instead of `OsRng` directly, ensuring all randomness benefits from
/// the DRBG's continuous health testing and prediction resistance.
fn oaep_padding(hash_alg: OaepHash, label: &[u8]) -> HsmResult<rsa::Oaep> {
    use rsa::Oaep;
    let label_str = if label.is_empty() {
        None
    } else {
        Some(
            std::str::from_utf8(label)
                .map_err(|_| HsmError::MechanismParamInvalid)?
                .to_owned(),
        )
    };
    Ok(match (hash_alg, label_str) {
        (OaepHash::Sha256, None) => Oaep::new::<Sha256>(),
        (OaepHash::Sha384, None) => Oaep::new::<Sha384>(),
        (OaepHash::Sha512, None) => Oaep::new::<Sha512>(),
        (OaepHash::Sha256, Some(l)) => Oaep::new_with_label::<Sha256, _>(l),
        (OaepHash::Sha384, Some(l)) => Oaep::new_with_label::<Sha384, _>(l),
        (OaepHash::Sha512, Some(l)) => Oaep::new_with_label::<Sha512, _>(l),
    })
}

pub fn rsa_oaep_encrypt(
    modulus: &[u8],
    public_exponent: &[u8],
    plaintext: &[u8],
    hash_alg: OaepHash,
    label: &[u8],
) -> HsmResult<Vec<u8>> {
    use crate::crypto::drbg::DrbgRng;

    let n = rsa::BigUint::from_bytes_be(modulus);
    let e = rsa::BigUint::from_bytes_be(public_exponent);
    let public_key = RsaPublicKey::new(n, e).map_err(|_| HsmError::KeyHandleInvalid)?;

    let mut rng = DrbgRng::new()?;
    let padding = oaep_padding(hash_alg, label)?;
    public_key
        .encrypt(&mut rng, padding, plaintext)
        .map_err(|_| HsmError::GeneralError)
}

/// RSA-OAEP decrypt (using private key DER)
pub fn rsa_oaep_decrypt(
    private_key_der: &[u8],
    ciphertext: &[u8],
    hash_alg: OaepHash,
    label: &[u8],
) -> HsmResult<Vec<u8>> {
    require_rustcrypto_rsa_private_ops()?;

    let private_key = parse_rsa_private_key(private_key_der)?;
    validate_rsa_private_key_size(&private_key)?;

    let padding = oaep_padding(hash_alg, label)?;
    private_key
        .decrypt(padding, ciphertext)
        .map_err(|_| HsmError::EncryptedDataInvalid)
}

// ============================================================================
// Handle-cached RSA PKCS#1 v1.5 (fast path)
// ============================================================================

/// RSA PKCS#1 v1.5 sign using handle-based cache (avoids SHA-256(DER) hashing
/// and BigNum cloning on cache hits).
pub fn rsa_pkcs1v15_sign_cached(
    slot_id: u64,
    handle: u64,
    private_key_der: &[u8],
    data: &[u8],
    hash_alg: Option<HashAlg>,
) -> HsmResult<Vec<u8>> {
    require_rustcrypto_rsa_private_ops()?;
    use rsa::signature::SignatureEncoding;

    validate_data_size(data)?;
    let key = get_or_parse_private_key(slot_id, handle, private_key_der)?;
    validate_rsa_private_key_size(&key)?;

    match hash_alg {
        Some(HashAlg::Sha256) => {
            use rsa::pkcs1v15::SigningKey;
            use rsa::signature::Signer;
            let signing_key = SigningKey::<Sha256>::new((*key).clone());
            let signature = signing_key.sign(data);
            Ok(signature.to_vec())
        }
        Some(HashAlg::Sha384) => {
            use rsa::pkcs1v15::SigningKey;
            use rsa::signature::Signer;
            let signing_key = SigningKey::<Sha384>::new((*key).clone());
            let signature = signing_key.sign(data);
            Ok(signature.to_vec())
        }
        Some(HashAlg::Sha512) => {
            use rsa::pkcs1v15::SigningKey;
            use rsa::signature::Signer;
            let signing_key = SigningKey::<Sha512>::new((*key).clone());
            let signature = signing_key.sign(data);
            Ok(signature.to_vec())
        }
        None => Err(HsmError::MechanismParamInvalid),
    }
}

/// RSA PKCS#1 v1.5 verify using handle-based cache (avoids BigUint
/// reconstruction on cache hits).
pub fn rsa_pkcs1v15_verify_cached(
    slot_id: u64,
    handle: u64,
    modulus: &[u8],
    public_exponent: &[u8],
    data: &[u8],
    signature: &[u8],
    hash_alg: Option<HashAlg>,
) -> HsmResult<bool> {
    validate_data_size(data)?;
    validate_rsa_public_key_size(modulus)?;
    let key = get_or_build_public_key(slot_id, handle, modulus, public_exponent)?;

    match hash_alg {
        Some(HashAlg::Sha256) => {
            use rsa::pkcs1v15::VerifyingKey;
            use rsa::signature::Verifier;
            let verifying_key = VerifyingKey::<Sha256>::new((*key).clone());
            let sig = rsa::pkcs1v15::Signature::try_from(signature)
                .map_err(|_| HsmError::SignatureInvalid)?;
            Ok(verifying_key.verify(data, &sig).is_ok())
        }
        Some(HashAlg::Sha384) => {
            use rsa::pkcs1v15::VerifyingKey;
            use rsa::signature::Verifier;
            let verifying_key = VerifyingKey::<Sha384>::new((*key).clone());
            let sig = rsa::pkcs1v15::Signature::try_from(signature)
                .map_err(|_| HsmError::SignatureInvalid)?;
            Ok(verifying_key.verify(data, &sig).is_ok())
        }
        Some(HashAlg::Sha512) => {
            use rsa::pkcs1v15::VerifyingKey;
            use rsa::signature::Verifier;
            let verifying_key = VerifyingKey::<Sha512>::new((*key).clone());
            let sig = rsa::pkcs1v15::Signature::try_from(signature)
                .map_err(|_| HsmError::SignatureInvalid)?;
            Ok(verifying_key.verify(data, &sig).is_ok())
        }
        None => Err(HsmError::MechanismParamInvalid),
    }
}

// ============================================================================
// Handle-cached RSA-PSS (fast path)
// ============================================================================

/// RSA-PSS sign using handle-based cache.
pub fn rsa_pss_sign_cached(
    slot_id: u64,
    handle: u64,
    private_key_der: &[u8],
    data: &[u8],
    hash_alg: HashAlg,
) -> HsmResult<Vec<u8>> {
    require_rustcrypto_rsa_private_ops()?;
    use crate::crypto::drbg::DrbgRng;
    use rsa::pss::SigningKey;
    use rsa::signature::{RandomizedSigner, SignatureEncoding};

    validate_data_size(data)?;
    let key = get_or_parse_private_key(slot_id, handle, private_key_der)?;
    validate_rsa_private_key_size(&key)?;

    let mut rng = DrbgRng::new()?;

    match hash_alg {
        HashAlg::Sha256 => {
            let signing_key = SigningKey::<Sha256>::new((*key).clone());
            let signature = signing_key.sign_with_rng(&mut rng, data);
            Ok(signature.to_vec())
        }
        HashAlg::Sha384 => {
            let signing_key = SigningKey::<Sha384>::new((*key).clone());
            let signature = signing_key.sign_with_rng(&mut rng, data);
            Ok(signature.to_vec())
        }
        HashAlg::Sha512 => {
            let signing_key = SigningKey::<Sha512>::new((*key).clone());
            let signature = signing_key.sign_with_rng(&mut rng, data);
            Ok(signature.to_vec())
        }
    }
}

/// RSA-PSS verify using handle-based cache.
pub fn rsa_pss_verify_cached(
    slot_id: u64,
    handle: u64,
    modulus: &[u8],
    public_exponent: &[u8],
    data: &[u8],
    signature: &[u8],
    hash_alg: HashAlg,
) -> HsmResult<bool> {
    use rsa::pss::VerifyingKey;
    use rsa::signature::Verifier;

    validate_data_size(data)?;
    validate_rsa_public_key_size(modulus)?;
    let key = get_or_build_public_key(slot_id, handle, modulus, public_exponent)?;

    match hash_alg {
        HashAlg::Sha256 => {
            let verifying_key = VerifyingKey::<Sha256>::new((*key).clone());
            let sig =
                rsa::pss::Signature::try_from(signature).map_err(|_| HsmError::SignatureInvalid)?;
            Ok(verifying_key.verify(data, &sig).is_ok())
        }
        HashAlg::Sha384 => {
            let verifying_key = VerifyingKey::<Sha384>::new((*key).clone());
            let sig =
                rsa::pss::Signature::try_from(signature).map_err(|_| HsmError::SignatureInvalid)?;
            Ok(verifying_key.verify(data, &sig).is_ok())
        }
        HashAlg::Sha512 => {
            let verifying_key = VerifyingKey::<Sha512>::new((*key).clone());
            let sig =
                rsa::pss::Signature::try_from(signature).map_err(|_| HsmError::SignatureInvalid)?;
            Ok(verifying_key.verify(data, &sig).is_ok())
        }
    }
}

// ============================================================================
// Handle-cached RSA-OAEP (fast path)
// ============================================================================

/// RSA-OAEP encrypt using handle-based public key cache.
pub fn rsa_oaep_encrypt_cached(
    slot_id: u64,
    handle: u64,
    modulus: &[u8],
    public_exponent: &[u8],
    plaintext: &[u8],
    hash_alg: OaepHash,
    label: &[u8],
) -> HsmResult<Vec<u8>> {
    use crate::crypto::drbg::DrbgRng;

    validate_rsa_public_key_size(modulus)?;
    let key = get_or_build_public_key(slot_id, handle, modulus, public_exponent)?;

    let mut rng = DrbgRng::new()?;
    let padding = oaep_padding(hash_alg, label)?;
    key.encrypt(&mut rng, padding, plaintext)
        .map_err(|_| HsmError::GeneralError)
}

/// RSA-OAEP decrypt using handle-based private key cache.
pub fn rsa_oaep_decrypt_cached(
    slot_id: u64,
    handle: u64,
    private_key_der: &[u8],
    ciphertext: &[u8],
    hash_alg: OaepHash,
    label: &[u8],
) -> HsmResult<Vec<u8>> {
    require_rustcrypto_rsa_private_ops()?;

    let key = get_or_parse_private_key(slot_id, handle, private_key_der)?;
    validate_rsa_private_key_size(&key)?;

    let padding = oaep_padding(hash_alg, label)?;
    key.decrypt(padding, ciphertext)
        .map_err(|_| HsmError::EncryptedDataInvalid)
}

// ============================================================================
// Handle-cached helpers
// ============================================================================

/// Look up a private key in the handle cache, or parse from DER and cache it.
fn get_or_parse_private_key(
    slot_id: u64,
    handle: u64,
    der: &[u8],
) -> HsmResult<Arc<RsaPrivateKey>> {
    if let Some(k) = get_cached_rsa_private_key(slot_id, handle) {
        return Ok(k);
    }
    let k = Arc::new(RsaPrivateKey::from_pkcs8_der(der).map_err(|_| HsmError::KeyHandleInvalid)?);
    cache_rsa_private_key(slot_id, handle, Arc::clone(&k));
    Ok(k)
}

/// Look up a public key in the handle cache, or build from components and cache it.
fn get_or_build_public_key(
    slot_id: u64,
    handle: u64,
    modulus: &[u8],
    public_exponent: &[u8],
) -> HsmResult<Arc<RsaPublicKey>> {
    if let Some(k) = get_cached_rsa_public_key(slot_id, handle) {
        return Ok(k);
    }
    let n = rsa::BigUint::from_bytes_be(modulus);
    let e = rsa::BigUint::from_bytes_be(public_exponent);
    let k = Arc::new(RsaPublicKey::new(n, e).map_err(|_| HsmError::KeyHandleInvalid)?);
    cache_rsa_public_key(slot_id, handle, Arc::clone(&k));
    Ok(k)
}

// ============================================================================
// ECDSA P-256
// ============================================================================

/// ECDSA P-256 sign (hedged — RFC 6979 + DRBG randomness)
///
/// Uses randomized/hedged signing: the deterministic RFC 6979 nonce is mixed
/// with fresh randomness from the DRBG. This protects against fault injection
/// attacks (Rowhammer, voltage glitching) that can recover the private key
/// from a single faulty deterministic signature, while still preventing
/// catastrophic nonce reuse if the RNG fails.
pub fn ecdsa_p256_sign(private_key_bytes: &[u8], data: &[u8]) -> HsmResult<Vec<u8>> {
    use crate::crypto::drbg::DrbgRng;
    use p256::ecdsa::signature::RandomizedSigner;
    use p256::ecdsa::SigningKey;

    validate_data_size(data)?;
    let signing_key =
        SigningKey::from_slice(private_key_bytes).map_err(|_| HsmError::KeyHandleInvalid)?;
    let mut rng = DrbgRng::new()?;
    let signature: p256::ecdsa::Signature = signing_key.sign_with_rng(&mut rng, data);
    // PKCS#11 §2.3.1: ECDSA signature format is raw r || s (fixed-size, no ASN.1 DER).
    // P-256: 64 bytes (32-byte r + 32-byte s).
    Ok(signature.to_bytes().to_vec())
}

/// ECDSA P-256 verify
pub fn ecdsa_p256_verify(public_key_sec1: &[u8], data: &[u8], signature: &[u8]) -> HsmResult<bool> {
    use p256::ecdsa::signature::Verifier;
    use p256::ecdsa::VerifyingKey;

    validate_data_size(data)?;
    // PKCS#11 §2.3.1: ECDSA signature format is raw r || s (fixed-size, no ASN.1 DER).
    // P-256: exactly 64 bytes (32-byte r + 32-byte s).
    if signature.len() != 64 {
        return Err(HsmError::SignatureInvalid);
    }
    let verifying_key =
        VerifyingKey::from_sec1_bytes(public_key_sec1).map_err(|_| HsmError::KeyHandleInvalid)?;
    let sig =
        p256::ecdsa::Signature::from_slice(signature).map_err(|_| HsmError::SignatureInvalid)?;
    Ok(verifying_key.verify(data, &sig).is_ok())
}

// ============================================================================
// ECDSA P-384
// ============================================================================

/// ECDSA P-384 sign (hedged — RFC 6979 + DRBG randomness)
///
/// Uses randomized/hedged signing to protect against fault injection attacks.
/// See `ecdsa_p256_sign` for rationale.
pub fn ecdsa_p384_sign(private_key_bytes: &[u8], data: &[u8]) -> HsmResult<Vec<u8>> {
    use crate::crypto::drbg::DrbgRng;
    use p384::ecdsa::signature::RandomizedSigner;
    use p384::ecdsa::SigningKey;

    validate_data_size(data)?;
    let signing_key =
        SigningKey::from_slice(private_key_bytes).map_err(|_| HsmError::KeyHandleInvalid)?;
    let mut rng = DrbgRng::new()?;
    let signature: p384::ecdsa::Signature = signing_key.sign_with_rng(&mut rng, data);
    // PKCS#11 §2.3.1: ECDSA signature format is raw r || s (fixed-size, no ASN.1 DER).
    // P-384: 96 bytes (48-byte r + 48-byte s).
    Ok(signature.to_bytes().to_vec())
}

/// ECDSA P-384 verify
pub fn ecdsa_p384_verify(public_key_sec1: &[u8], data: &[u8], signature: &[u8]) -> HsmResult<bool> {
    use p384::ecdsa::signature::Verifier;
    use p384::ecdsa::VerifyingKey;

    validate_data_size(data)?;
    // PKCS#11 §2.3.1: ECDSA signature format is raw r || s (fixed-size, no ASN.1 DER).
    // P-384: exactly 96 bytes (48-byte r + 48-byte s).
    if signature.len() != 96 {
        return Err(HsmError::SignatureInvalid);
    }
    let verifying_key =
        VerifyingKey::from_sec1_bytes(public_key_sec1).map_err(|_| HsmError::KeyHandleInvalid)?;
    let sig =
        p384::ecdsa::Signature::from_slice(signature).map_err(|_| HsmError::SignatureInvalid)?;
    Ok(verifying_key.verify(data, &sig).is_ok())
}

// ============================================================================
// Ed25519 EdDSA
// ============================================================================

/// Ed25519 sign (deterministic per RFC 8032)
///
/// Ed25519 is inherently deterministic by specification — the nonce is derived
/// from `SHA-512(expanded_key_prefix || message)`, making it immune to
/// catastrophic nonce reuse from RNG failure.
///
/// **Fault injection caveat:** Unlike ECDSA (which we hedge with additional
/// randomness), Ed25519's nonce derivation cannot be hedged without violating
/// RFC 8032 and breaking interoperability. If fault injection resistance is
/// required, use ECDSA P-256/P-384 (which are hedged) or deploy hardware
/// countermeasures (voltage monitoring, instruction duplication).
pub fn ed25519_sign(private_key_bytes: &[u8], data: &[u8]) -> HsmResult<Vec<u8>> {
    use ed25519_dalek::Signer;
    use ed25519_dalek::SigningKey;

    use zeroize::Zeroizing;

    validate_data_size(data)?;
    if private_key_bytes.len() != 32 {
        return Err(HsmError::KeyHandleInvalid);
    }
    let mut key_array = Zeroizing::new([0u8; 32]);
    key_array.copy_from_slice(private_key_bytes);
    // SigningKey implements ZeroizeOnDrop — key material is scrubbed when
    // `signing_key` goes out of scope at the end of this function.
    let signing_key = SigningKey::from_bytes(&key_array);
    let signature = signing_key.sign(data);
    Ok(signature.to_bytes().to_vec())
}

/// Ed25519 verify
pub fn ed25519_verify(
    public_key_bytes: &[u8],
    data: &[u8],
    signature_bytes: &[u8],
) -> HsmResult<bool> {
    use ed25519_dalek::{Signature, Verifier, VerifyingKey};

    validate_data_size(data)?;
    if public_key_bytes.len() != 32 {
        return Err(HsmError::KeyHandleInvalid);
    }
    // Public keys are not secret — no Zeroizing needed
    let key_array: [u8; 32] = public_key_bytes
        .try_into()
        .map_err(|_| HsmError::KeyHandleInvalid)?;
    let verifying_key =
        VerifyingKey::from_bytes(&key_array).map_err(|_| HsmError::KeyHandleInvalid)?;

    if signature_bytes.len() != 64 {
        return Err(HsmError::SignatureInvalid);
    }
    // Signatures are not secret — no Zeroizing needed
    let sig_array: [u8; 64] = signature_bytes
        .try_into()
        .map_err(|_| HsmError::SignatureInvalid)?;
    let signature = Signature::from_bytes(&sig_array);
    Ok(verifying_key.verify(data, &signature).is_ok())
}

// ============================================================================
// Helpers
// ============================================================================

/// Map CKM mechanism to optional hash algorithm (for PKCS#1v1.5 RSA)
pub fn mechanism_to_hash(mechanism: CK_MECHANISM_TYPE) -> Option<HashAlg> {
    match mechanism {
        CKM_SHA256_RSA_PKCS => Some(HashAlg::Sha256),
        CKM_SHA384_RSA_PKCS => Some(HashAlg::Sha384),
        CKM_SHA512_RSA_PKCS => Some(HashAlg::Sha512),
        CKM_RSA_PKCS => None,
        _ => None,
    }
}

/// Map CKM PSS mechanism to hash algorithm.
///
/// Returns `Ok(hash)` for typed PSS mechanisms (CKM_SHAx_RSA_PKCS_PSS),
/// `Err(MechanismParamInvalid)` for `CKM_RSA_PKCS_PSS` (caller must provide
/// hash via mechanism params), and `Err(MechanismInvalid)` for unknown mechanisms.
pub fn pss_mechanism_to_hash(mechanism: CK_MECHANISM_TYPE) -> HsmResult<HashAlg> {
    match mechanism {
        CKM_SHA256_RSA_PKCS_PSS => Ok(HashAlg::Sha256),
        CKM_SHA384_RSA_PKCS_PSS => Ok(HashAlg::Sha384),
        CKM_SHA512_RSA_PKCS_PSS => Ok(HashAlg::Sha512),
        CKM_RSA_PKCS_PSS => Err(HsmError::MechanismParamInvalid), // caller must specify hash
        _ => Err(HsmError::MechanismInvalid),
    }
}

/// Check if mechanism is an RSA-PSS mechanism
pub fn is_pss_mechanism(mechanism: CK_MECHANISM_TYPE) -> bool {
    matches!(
        mechanism,
        CKM_RSA_PKCS_PSS
            | CKM_SHA256_RSA_PKCS_PSS
            | CKM_SHA384_RSA_PKCS_PSS
            | CKM_SHA512_RSA_PKCS_PSS
    )
}

/// Check if mechanism is an ECDSA mechanism
pub fn is_ecdsa_mechanism(mechanism: CK_MECHANISM_TYPE) -> bool {
    matches!(
        mechanism,
        CKM_ECDSA | CKM_ECDSA_SHA256 | CKM_ECDSA_SHA384 | CKM_ECDSA_SHA512
    )
}

/// Map an ECDSA mechanism to its hash algorithm (`None` for raw `CKM_ECDSA`).
pub fn ecdsa_mechanism_to_hash(mechanism: CK_MECHANISM_TYPE) -> HsmResult<Option<HashAlg>> {
    match mechanism {
        CKM_ECDSA => Ok(None),
        CKM_ECDSA_SHA256 => Ok(Some(HashAlg::Sha256)),
        CKM_ECDSA_SHA384 => Ok(Some(HashAlg::Sha384)),
        CKM_ECDSA_SHA512 => Ok(Some(HashAlg::Sha512)),
        _ => Err(HsmError::MechanismInvalid),
    }
}

/// Check if mechanism is EdDSA
pub fn is_eddsa_mechanism(mechanism: CK_MECHANISM_TYPE) -> bool {
    mechanism == CKM_EDDSA
}

/// Check if a sign mechanism supports multi-part (C_SignUpdate/C_SignFinal).
/// Only mechanisms with a built-in hash algorithm support multi-part.
pub fn sign_mechanism_supports_multipart(mechanism: CK_MECHANISM_TYPE) -> bool {
    matches!(
        mechanism,
        CKM_SHA256_RSA_PKCS
            | CKM_SHA384_RSA_PKCS
            | CKM_SHA512_RSA_PKCS
            | CKM_SHA256_RSA_PKCS_PSS
            | CKM_SHA384_RSA_PKCS_PSS
            | CKM_SHA512_RSA_PKCS_PSS
            | CKM_ECDSA_SHA256
            | CKM_ECDSA_SHA384
            | CKM_ECDSA_SHA512
    )
}

/// Map a sign mechanism to the corresponding digest mechanism for creating hashers.
/// Returns None for mechanisms that don't have a built-in hash (e.g., CKM_RSA_PKCS, CKM_ECDSA).
pub fn sign_mechanism_to_digest_mechanism(
    mechanism: CK_MECHANISM_TYPE,
) -> Option<CK_MECHANISM_TYPE> {
    match mechanism {
        CKM_SHA256_RSA_PKCS | CKM_SHA256_RSA_PKCS_PSS | CKM_ECDSA_SHA256 => Some(CKM_SHA256),
        CKM_SHA384_RSA_PKCS | CKM_SHA384_RSA_PKCS_PSS | CKM_ECDSA_SHA384 => Some(CKM_SHA384),
        CKM_SHA512_RSA_PKCS | CKM_SHA512_RSA_PKCS_PSS | CKM_ECDSA_SHA512 => Some(CKM_SHA512),
        _ => None,
    }
}

// ============================================================================
// Prehashed RSA PKCS#1 v1.5
// ============================================================================

/// RSA PKCS#1 v1.5 sign with a pre-computed digest.
/// The `digest` parameter must be the hash output (e.g., 32 bytes for SHA-256).
/// DigestInfo wrapping is handled internally by the scheme.
pub(crate) fn rsa_pkcs1v15_sign_prehashed(
    private_key_der: &[u8],
    digest: &[u8],
    hash_alg: HashAlg,
) -> HsmResult<Vec<u8>> {
    require_rustcrypto_rsa_private_ops()?;
    validate_digest_length(digest, hash_alg)?;
    let private_key = parse_rsa_private_key(private_key_der)?;
    validate_rsa_private_key_size(&private_key)?;

    let scheme = match hash_alg {
        HashAlg::Sha256 => Pkcs1v15Sign::new::<Sha256>(),
        HashAlg::Sha384 => Pkcs1v15Sign::new::<Sha384>(),
        HashAlg::Sha512 => Pkcs1v15Sign::new::<Sha512>(),
    };

    private_key
        .sign(scheme, digest)
        .map_err(|_| HsmError::GeneralError)
}

/// RSA PKCS#1 v1.5 verify with a pre-computed digest.
pub(crate) fn rsa_pkcs1v15_verify_prehashed(
    modulus: &[u8],
    public_exponent: &[u8],
    digest: &[u8],
    signature: &[u8],
    hash_alg: HashAlg,
) -> HsmResult<bool> {
    validate_digest_length(digest, hash_alg)?;
    validate_rsa_public_key_size(modulus)?;
    let n = rsa::BigUint::from_bytes_be(modulus);
    let e = rsa::BigUint::from_bytes_be(public_exponent);
    let public_key = RsaPublicKey::new(n, e).map_err(|_| HsmError::KeyHandleInvalid)?;

    let scheme = match hash_alg {
        HashAlg::Sha256 => Pkcs1v15Sign::new::<Sha256>(),
        HashAlg::Sha384 => Pkcs1v15Sign::new::<Sha384>(),
        HashAlg::Sha512 => Pkcs1v15Sign::new::<Sha512>(),
    };

    Ok(public_key.verify(scheme, digest, signature).is_ok())
}

// ============================================================================
// Prehashed RSA-PSS
// ============================================================================

/// RSA-PSS sign with a pre-computed digest.
/// Uses randomized signing (random salt) as required by FIPS.
/// Salt randomness is sourced from the SP 800-90A HMAC_DRBG via `DrbgRng`.
pub(crate) fn rsa_pss_sign_prehashed(
    private_key_der: &[u8],
    digest: &[u8],
    hash_alg: HashAlg,
) -> HsmResult<Vec<u8>> {
    require_rustcrypto_rsa_private_ops()?;
    use crate::crypto::drbg::DrbgRng;
    use rsa::pss::SigningKey;
    use rsa::signature::hazmat::RandomizedPrehashSigner;
    use rsa::signature::SignatureEncoding;

    validate_digest_length(digest, hash_alg)?;
    let private_key = parse_rsa_private_key(private_key_der)?;
    validate_rsa_private_key_size(&private_key)?;

    let mut rng = DrbgRng::new()?;

    match hash_alg {
        HashAlg::Sha256 => {
            let signing_key = SigningKey::<Sha256>::new(private_key);
            let signature = signing_key
                .sign_prehash_with_rng(&mut rng, digest)
                .map_err(|_| HsmError::GeneralError)?;
            Ok(signature.to_vec())
        }
        HashAlg::Sha384 => {
            let signing_key = SigningKey::<Sha384>::new(private_key);
            let signature = signing_key
                .sign_prehash_with_rng(&mut rng, digest)
                .map_err(|_| HsmError::GeneralError)?;
            Ok(signature.to_vec())
        }
        HashAlg::Sha512 => {
            let signing_key = SigningKey::<Sha512>::new(private_key);
            let signature = signing_key
                .sign_prehash_with_rng(&mut rng, digest)
                .map_err(|_| HsmError::GeneralError)?;
            Ok(signature.to_vec())
        }
    }
}

/// RSA-PSS verify with a pre-computed digest.
pub(crate) fn rsa_pss_verify_prehashed(
    modulus: &[u8],
    public_exponent: &[u8],
    digest: &[u8],
    signature: &[u8],
    hash_alg: HashAlg,
) -> HsmResult<bool> {
    use rsa::pss::VerifyingKey;
    use rsa::signature::hazmat::PrehashVerifier;

    validate_digest_length(digest, hash_alg)?;
    validate_rsa_public_key_size(modulus)?;
    let n = rsa::BigUint::from_bytes_be(modulus);
    let e = rsa::BigUint::from_bytes_be(public_exponent);
    let public_key = RsaPublicKey::new(n, e).map_err(|_| HsmError::KeyHandleInvalid)?;

    let sig = rsa::pss::Signature::try_from(signature).map_err(|_| HsmError::SignatureInvalid)?;

    match hash_alg {
        HashAlg::Sha256 => {
            let verifying_key = VerifyingKey::<Sha256>::new(public_key);
            Ok(verifying_key.verify_prehash(digest, &sig).is_ok())
        }
        HashAlg::Sha384 => {
            let verifying_key = VerifyingKey::<Sha384>::new(public_key);
            Ok(verifying_key.verify_prehash(digest, &sig).is_ok())
        }
        HashAlg::Sha512 => {
            let verifying_key = VerifyingKey::<Sha512>::new(public_key);
            Ok(verifying_key.verify_prehash(digest, &sig).is_ok())
        }
    }
}

// ============================================================================
// Handle-cached Prehashed RSA PKCS#1 v1.5 (fast path)
// ============================================================================

/// RSA PKCS#1 v1.5 sign with pre-computed digest, using handle-based cache.
pub(crate) fn rsa_pkcs1v15_sign_prehashed_cached(
    slot_id: u64,
    handle: u64,
    private_key_der: &[u8],
    digest: &[u8],
    hash_alg: HashAlg,
) -> HsmResult<Vec<u8>> {
    require_rustcrypto_rsa_private_ops()?;
    validate_digest_length(digest, hash_alg)?;
    let key = get_or_parse_private_key(slot_id, handle, private_key_der)?;
    validate_rsa_private_key_size(&key)?;

    let scheme = match hash_alg {
        HashAlg::Sha256 => Pkcs1v15Sign::new::<Sha256>(),
        HashAlg::Sha384 => Pkcs1v15Sign::new::<Sha384>(),
        HashAlg::Sha512 => Pkcs1v15Sign::new::<Sha512>(),
    };

    key.sign(scheme, digest).map_err(|_| HsmError::GeneralError)
}

/// RSA PKCS#1 v1.5 verify with pre-computed digest, using handle-based cache.
pub(crate) fn rsa_pkcs1v15_verify_prehashed_cached(
    slot_id: u64,
    handle: u64,
    modulus: &[u8],
    public_exponent: &[u8],
    digest: &[u8],
    signature: &[u8],
    hash_alg: HashAlg,
) -> HsmResult<bool> {
    validate_digest_length(digest, hash_alg)?;
    validate_rsa_public_key_size(modulus)?;
    let key = get_or_build_public_key(slot_id, handle, modulus, public_exponent)?;

    let scheme = match hash_alg {
        HashAlg::Sha256 => Pkcs1v15Sign::new::<Sha256>(),
        HashAlg::Sha384 => Pkcs1v15Sign::new::<Sha384>(),
        HashAlg::Sha512 => Pkcs1v15Sign::new::<Sha512>(),
    };

    Ok(key.verify(scheme, digest, signature).is_ok())
}

// ============================================================================
// Handle-cached Prehashed RSA-PSS (fast path)
// ============================================================================

/// RSA-PSS sign with pre-computed digest, using handle-based cache.
pub(crate) fn rsa_pss_sign_prehashed_cached(
    slot_id: u64,
    handle: u64,
    private_key_der: &[u8],
    digest: &[u8],
    hash_alg: HashAlg,
) -> HsmResult<Vec<u8>> {
    require_rustcrypto_rsa_private_ops()?;
    use crate::crypto::drbg::DrbgRng;
    use rsa::pss::SigningKey;
    use rsa::signature::hazmat::RandomizedPrehashSigner;
    use rsa::signature::SignatureEncoding;

    validate_digest_length(digest, hash_alg)?;
    let key = get_or_parse_private_key(slot_id, handle, private_key_der)?;
    validate_rsa_private_key_size(&key)?;

    let mut rng = DrbgRng::new()?;

    match hash_alg {
        HashAlg::Sha256 => {
            let signing_key = SigningKey::<Sha256>::new((*key).clone());
            let signature = signing_key
                .sign_prehash_with_rng(&mut rng, digest)
                .map_err(|_| HsmError::GeneralError)?;
            Ok(signature.to_vec())
        }
        HashAlg::Sha384 => {
            let signing_key = SigningKey::<Sha384>::new((*key).clone());
            let signature = signing_key
                .sign_prehash_with_rng(&mut rng, digest)
                .map_err(|_| HsmError::GeneralError)?;
            Ok(signature.to_vec())
        }
        HashAlg::Sha512 => {
            let signing_key = SigningKey::<Sha512>::new((*key).clone());
            let signature = signing_key
                .sign_prehash_with_rng(&mut rng, digest)
                .map_err(|_| HsmError::GeneralError)?;
            Ok(signature.to_vec())
        }
    }
}

/// RSA-PSS verify with pre-computed digest, using handle-based cache.
pub(crate) fn rsa_pss_verify_prehashed_cached(
    slot_id: u64,
    handle: u64,
    modulus: &[u8],
    public_exponent: &[u8],
    digest: &[u8],
    signature: &[u8],
    hash_alg: HashAlg,
) -> HsmResult<bool> {
    use rsa::pss::VerifyingKey;
    use rsa::signature::hazmat::PrehashVerifier;

    validate_digest_length(digest, hash_alg)?;
    validate_rsa_public_key_size(modulus)?;
    let key = get_or_build_public_key(slot_id, handle, modulus, public_exponent)?;

    let sig = rsa::pss::Signature::try_from(signature).map_err(|_| HsmError::SignatureInvalid)?;

    match hash_alg {
        HashAlg::Sha256 => {
            let verifying_key = VerifyingKey::<Sha256>::new((*key).clone());
            Ok(verifying_key.verify_prehash(digest, &sig).is_ok())
        }
        HashAlg::Sha384 => {
            let verifying_key = VerifyingKey::<Sha384>::new((*key).clone());
            Ok(verifying_key.verify_prehash(digest, &sig).is_ok())
        }
        HashAlg::Sha512 => {
            let verifying_key = VerifyingKey::<Sha512>::new((*key).clone());
            Ok(verifying_key.verify_prehash(digest, &sig).is_ok())
        }
    }
}

// ============================================================================
// Prehashed ECDSA P-256
// ============================================================================

/// ECDSA P-256 sign with a pre-computed digest (hedged).
///
/// Uses `RandomizedPrehashSigner` to mix DRBG randomness into the nonce
/// derivation, protecting against fault injection attacks.
pub(crate) fn ecdsa_p256_sign_prehashed(
    private_key_bytes: &[u8],
    digest: &[u8],
) -> HsmResult<Vec<u8>> {
    use crate::crypto::drbg::DrbgRng;
    use p256::ecdsa::signature::hazmat::RandomizedPrehashSigner;
    use p256::ecdsa::SigningKey;

    let signing_key =
        SigningKey::from_slice(private_key_bytes).map_err(|_| HsmError::KeyHandleInvalid)?;
    let mut rng = DrbgRng::new()?;
    let signature: p256::ecdsa::Signature = signing_key
        .sign_prehash_with_rng(&mut rng, digest)
        .map_err(|_| HsmError::DataLenRange)?;
    // PKCS#11 §2.3.1: ECDSA signature format is raw r || s (fixed-size, no ASN.1 DER).
    // P-256: 64 bytes (32-byte r + 32-byte s).
    Ok(signature.to_bytes().to_vec())
}

/// ECDSA P-256 verify with a pre-computed digest.
pub(crate) fn ecdsa_p256_verify_prehashed(
    public_key_sec1: &[u8],
    digest: &[u8],
    signature: &[u8],
) -> HsmResult<bool> {
    use p256::ecdsa::signature::hazmat::PrehashVerifier;
    use p256::ecdsa::VerifyingKey;

    if digest.len() < 16 {
        return Err(HsmError::DataLenRange);
    }
    // PKCS#11 §2.3.1: ECDSA signature format is raw r || s (fixed-size, no ASN.1 DER).
    // P-256: exactly 64 bytes (32-byte r + 32-byte s).
    if signature.len() != 64 {
        return Err(HsmError::SignatureInvalid);
    }
    let verifying_key =
        VerifyingKey::from_sec1_bytes(public_key_sec1).map_err(|_| HsmError::KeyHandleInvalid)?;
    let sig =
        p256::ecdsa::Signature::from_slice(signature).map_err(|_| HsmError::SignatureInvalid)?;
    Ok(verifying_key.verify_prehash(digest, &sig).is_ok())
}

// ============================================================================
// Prehashed ECDSA P-384
// ============================================================================

/// ECDSA P-384 sign with a pre-computed digest (hedged).
///
/// Uses `RandomizedPrehashSigner` to mix DRBG randomness into the nonce
/// derivation, protecting against fault injection attacks.
pub(crate) fn ecdsa_p384_sign_prehashed(
    private_key_bytes: &[u8],
    digest: &[u8],
) -> HsmResult<Vec<u8>> {
    use crate::crypto::drbg::DrbgRng;
    use p384::ecdsa::signature::hazmat::RandomizedPrehashSigner;
    use p384::ecdsa::SigningKey;

    let signing_key =
        SigningKey::from_slice(private_key_bytes).map_err(|_| HsmError::KeyHandleInvalid)?;
    let mut rng = DrbgRng::new()?;
    let signature: p384::ecdsa::Signature = signing_key
        .sign_prehash_with_rng(&mut rng, digest)
        .map_err(|_| HsmError::DataLenRange)?;
    // PKCS#11 §2.3.1: ECDSA signature format is raw r || s (fixed-size, no ASN.1 DER).
    // P-384: 96 bytes (48-byte r + 48-byte s).
    Ok(signature.to_bytes().to_vec())
}

/// ECDSA P-384 verify with a pre-computed digest.
pub(crate) fn ecdsa_p384_verify_prehashed(
    public_key_sec1: &[u8],
    digest: &[u8],
    signature: &[u8],
) -> HsmResult<bool> {
    use p384::ecdsa::signature::hazmat::PrehashVerifier;
    use p384::ecdsa::VerifyingKey;

    if digest.len() < 24 {
        return Err(HsmError::DataLenRange);
    }
    // PKCS#11 §2.3.1: ECDSA signature format is raw r || s (fixed-size, no ASN.1 DER).
    // P-384: exactly 96 bytes (48-byte r + 48-byte s).
    if signature.len() != 96 {
        return Err(HsmError::SignatureInvalid);
    }
    let verifying_key =
        VerifyingKey::from_sec1_bytes(public_key_sec1).map_err(|_| HsmError::KeyHandleInvalid)?;
    let sig =
        p384::ecdsa::Signature::from_slice(signature).map_err(|_| HsmError::SignatureInvalid)?;
    Ok(verifying_key.verify_prehash(digest, &sig).is_ok())
}

// ============================================================================
// Tests
// ============================================================================

#[cfg(test)]
mod tests {
    use super::*;

    #[cfg(not(any(debug_assertions, feature = "insecure-rustcrypto-rsa-private-ops")))]
    #[test]
    fn release_build_refuses_rustcrypto_rsa_private_operations() {
        assert!(require_rustcrypto_rsa_private_ops().is_err());
    }

    /// Use a per-test slot id derived from a counter so that tests run in
    /// parallel without colliding on cache slots.  Handle ids are picked the
    /// same way.
    fn unique_ids() -> (u64, u64) {
        use std::sync::atomic::{AtomicU64, Ordering};
        static COUNTER: AtomicU64 = AtomicU64::new(1);
        let n = COUNTER.fetch_add(1, Ordering::Relaxed);
        // Spread bits between slot and handle to avoid trivial collisions.
        (0xC0DE_0000 | n, 0xBEEF_0000 | n)
    }

    /// Generate a 2048-bit RSA keypair as (priv_der, modulus, pub_exp).
    ///
    /// The keypair is generated once and cached across unit tests to avoid
    /// running expensive prime generation repeatedly in debug mode.
    /// Test isolation is maintained via `unique_ids()` for slot and handle IDs.
    fn fresh_rsa_keypair() -> (Vec<u8>, Vec<u8>, Vec<u8>) {
        static KEYPAIR: std::sync::OnceLock<(Vec<u8>, Vec<u8>, Vec<u8>)> =
            std::sync::OnceLock::new();
        KEYPAIR
            .get_or_init(|| {
                let (priv_der, modulus, pub_exp) =
                    crate::crypto::keygen::generate_rsa_key_pair(2048, false).unwrap();
                (priv_der.as_bytes().to_vec(), modulus, pub_exp)
            })
            .clone()
    }

    static CACHE_TEST_LOCK: std::sync::Mutex<()> = std::sync::Mutex::new(());

    #[test]
    #[cfg_attr(
        not(any(debug_assertions, feature = "insecure-rustcrypto-rsa-private-ops")),
        ignore = "RustCrypto RSA private-key operations are refused in release builds \
                  (RUSTSEC-2023-0071); run in debug or with \
                  --features insecure-rustcrypto-rsa-private-ops"
    )]
    fn rsa_pkcs1v15_verify_cached_populates_pub_cache() {
        let _lock = CACHE_TEST_LOCK.lock().unwrap();
        let (slot, handle) = unique_ids();
        let (priv_der, modulus, pub_exp) = fresh_rsa_keypair();
        let msg = b"verify hot path";
        let sig = rsa_pkcs1v15_sign(&priv_der, msg, Some(HashAlg::Sha256)).unwrap();

        // Pre-condition: cache miss.
        assert!(get_cached_rsa_public_key(slot, handle).is_none());

        // First verify: builds RsaPublicKey, populates cache.
        let ok = rsa_pkcs1v15_verify_cached(
            slot,
            handle,
            &modulus,
            &pub_exp,
            msg,
            &sig,
            Some(HashAlg::Sha256),
        )
        .expect("first verify");
        assert!(ok, "valid signature must verify");

        // Post-condition: cache hit available.
        let arc1 = get_cached_rsa_public_key(slot, handle)
            .expect("rsa_pkcs1v15_verify_cached should populate the public-key handle cache");

        // Second verify: should reuse the cached Arc<RsaPublicKey>.
        let _ok = rsa_pkcs1v15_verify_cached(
            slot,
            handle,
            &modulus,
            &pub_exp,
            msg,
            &sig,
            Some(HashAlg::Sha256),
        )
        .expect("second verify");
        let arc2 = get_cached_rsa_public_key(slot, handle).unwrap();
        assert!(
            Arc::ptr_eq(&arc1, &arc2),
            "second verify should reuse the cached Arc<RsaPublicKey>, not rebuild BigUint"
        );

        evict_cached_keys(slot, handle);
    }

    #[test]
    #[cfg_attr(
        not(any(debug_assertions, feature = "insecure-rustcrypto-rsa-private-ops")),
        ignore = "RustCrypto RSA private-key operations are refused in release builds \
                  (RUSTSEC-2023-0071); run in debug or with \
                  --features insecure-rustcrypto-rsa-private-ops"
    )]
    fn evict_cached_keys_removes_entries() {
        let _lock = CACHE_TEST_LOCK.lock().unwrap();
        let (slot, handle) = unique_ids();
        let (der, _, _) = fresh_rsa_keypair();
        let _ = rsa_pkcs1v15_sign_cached(slot, handle, &der, b"x", Some(HashAlg::Sha256)).unwrap();
        assert!(get_cached_rsa_private_key(slot, handle).is_some());

        evict_cached_keys(slot, handle);
        assert!(
            get_cached_rsa_private_key(slot, handle).is_none(),
            "evict_cached_keys must drop the entry"
        );
    }

    #[test]
    #[cfg_attr(
        not(any(debug_assertions, feature = "insecure-rustcrypto-rsa-private-ops")),
        ignore = "RustCrypto RSA private-key operations are refused in release builds \
                  (RUSTSEC-2023-0071); run in debug or with \
                  --features insecure-rustcrypto-rsa-private-ops"
    )]
    fn rsa_oaep_decrypt_cached_uses_handle_cache() {
        let _lock = CACHE_TEST_LOCK.lock().unwrap();
        let (slot, handle) = unique_ids();
        let (priv_der, modulus, pub_exp) = fresh_rsa_keypair();
        let ct = rsa_oaep_encrypt_cached(
            slot,
            handle,
            &modulus,
            &pub_exp,
            b"test",
            OaepHash::Sha256,
            &[],
        )
        .expect("encrypt");

        // Pre-condition: cache miss for private key
        assert!(get_cached_rsa_private_key(slot, handle).is_none());

        // Decrypt: should populate private key cache
        let pt = rsa_oaep_decrypt_cached(slot, handle, &priv_der, &ct, OaepHash::Sha256, &[])
            .expect("decrypt");
        assert_eq!(pt, b"test");

        // Post-condition: cache hit for private key
        let arc1 = get_cached_rsa_private_key(slot, handle)
            .expect("rsa_oaep_decrypt_cached should populate the private-key handle cache");

        // Second decrypt: should reuse the cached Arc<RsaPrivateKey>
        let _pt = rsa_oaep_decrypt_cached(slot, handle, &priv_der, &ct, OaepHash::Sha256, &[])
            .expect("second decrypt");
        let arc2 = get_cached_rsa_private_key(slot, handle).unwrap();
        assert!(
            Arc::ptr_eq(&arc1, &arc2),
            "second decrypt should reuse the cached Arc<RsaPrivateKey>, not rebuild BigUint"
        );

        evict_cached_keys(slot, handle);
    }

    #[test]
    #[cfg_attr(
        not(any(debug_assertions, feature = "insecure-rustcrypto-rsa-private-ops")),
        ignore = "RustCrypto RSA private-key operations are refused in release builds \
                  (RUSTSEC-2023-0071); run in debug or with \
                  --features insecure-rustcrypto-rsa-private-ops"
    )]
    fn rsa_pss_verify_cached_populates_pub_cache() {
        let _lock = CACHE_TEST_LOCK.lock().unwrap();
        let (slot, handle) = unique_ids();
        let (priv_der, modulus, pub_exp) = fresh_rsa_keypair();
        let msg = b"pss verify path";
        let sig = rsa_pss_sign(&priv_der, msg, HashAlg::Sha256).unwrap();

        assert!(get_cached_rsa_public_key(slot, handle).is_none());
        let ok =
            rsa_pss_verify_cached(slot, handle, &modulus, &pub_exp, msg, &sig, HashAlg::Sha256)
                .expect("pss verify");
        assert!(ok);
        assert!(
            get_cached_rsa_public_key(slot, handle).is_some(),
            "rsa_pss_verify_cached should populate the public-key handle cache"
        );

        evict_cached_keys(slot, handle);
    }

    #[test]
    #[cfg_attr(
        not(any(debug_assertions, feature = "insecure-rustcrypto-rsa-private-ops")),
        ignore = "RustCrypto RSA private-key operations are refused in release builds \
                  (RUSTSEC-2023-0071); run in debug or with \
                  --features insecure-rustcrypto-rsa-private-ops"
    )]
    fn rsa_oaep_encrypt_cached_populates_pub_cache_and_round_trips() {
        let _lock = CACHE_TEST_LOCK.lock().unwrap();
        let (slot, handle) = unique_ids();
        let (priv_der, modulus, pub_exp) = fresh_rsa_keypair();

        assert!(get_cached_rsa_public_key(slot, handle).is_none());
        let ct = rsa_oaep_encrypt_cached(
            slot,
            handle,
            &modulus,
            &pub_exp,
            b"hello",
            OaepHash::Sha256,
            &[],
        )
        .expect("encrypt");
        assert!(
            get_cached_rsa_public_key(slot, handle).is_some(),
            "rsa_oaep_encrypt_cached should populate the public-key handle cache"
        );

        // Sanity: the ciphertext decrypts back via the legacy decrypt path.
        let pt = rsa_oaep_decrypt(&priv_der, &ct, OaepHash::Sha256, &[]).unwrap();
        assert_eq!(pt, b"hello");

        evict_cached_keys(slot, handle);
    }

    #[test]
    #[cfg_attr(
        not(any(debug_assertions, feature = "insecure-rustcrypto-rsa-private-ops")),
        ignore = "RustCrypto RSA private-key operations are refused in release builds \
                  (RUSTSEC-2023-0071); run in debug or with \
                  --features insecure-rustcrypto-rsa-private-ops"
    )]
    fn evict_cached_keys_clears_public_entry() {
        let _lock = CACHE_TEST_LOCK.lock().unwrap();
        let (slot, handle) = unique_ids();
        let (priv_der, modulus, pub_exp) = fresh_rsa_keypair();
        let msg = b"x";
        let sig = rsa_pkcs1v15_sign(&priv_der, msg, Some(HashAlg::Sha256)).unwrap();
        let _ = rsa_pkcs1v15_verify_cached(
            slot,
            handle,
            &modulus,
            &pub_exp,
            msg,
            &sig,
            Some(HashAlg::Sha256),
        )
        .unwrap();
        assert!(get_cached_rsa_public_key(slot, handle).is_some());

        evict_cached_keys(slot, handle);
        assert!(
            get_cached_rsa_public_key(slot, handle).is_none(),
            "evict_cached_keys must drop the public-key entry"
        );
    }

    #[test]
    #[cfg_attr(
        not(any(debug_assertions, feature = "insecure-rustcrypto-rsa-private-ops")),
        ignore = "RustCrypto RSA private-key operations are refused in release builds \
                  (RUSTSEC-2023-0071); run in debug or with \
                  --features insecure-rustcrypto-rsa-private-ops"
    )]
    fn clear_for_slot_drops_only_targeted_slot() {
        let _lock = CACHE_TEST_LOCK.lock().unwrap();
        // Populate two distinct slots in both caches; make sure clearing one
        // leaves the other untouched.
        let (slot_a, handle_a) = unique_ids();
        let (slot_b, handle_b) = unique_ids();
        let (der_a, mod_a, exp_a) = fresh_rsa_keypair();
        let (der_b, mod_b, exp_b) = fresh_rsa_keypair();

        // Populate private-key cache for both slots.
        let _ = rsa_pkcs1v15_sign_cached(slot_a, handle_a, &der_a, b"x", Some(HashAlg::Sha256))
            .unwrap();
        let _ = rsa_pkcs1v15_sign_cached(slot_b, handle_b, &der_b, b"x", Some(HashAlg::Sha256))
            .unwrap();

        // Populate public-key cache for both slots via OAEP encrypt.
        let _ = rsa_oaep_encrypt_cached(
            slot_a,
            handle_a,
            &mod_a,
            &exp_a,
            b"x",
            OaepHash::Sha256,
            &[],
        )
        .unwrap();
        let _ = rsa_oaep_encrypt_cached(
            slot_b,
            handle_b,
            &mod_b,
            &exp_b,
            b"x",
            OaepHash::Sha256,
            &[],
        )
        .unwrap();

        assert!(get_cached_rsa_private_key(slot_a, handle_a).is_some());
        assert!(get_cached_rsa_public_key(slot_a, handle_a).is_some());
        assert!(get_cached_rsa_private_key(slot_b, handle_b).is_some());
        assert!(get_cached_rsa_public_key(slot_b, handle_b).is_some());

        clear_for_slot(slot_a);

        assert!(
            get_cached_rsa_private_key(slot_a, handle_a).is_none(),
            "clear_for_slot must drop private entries in the targeted slot"
        );
        assert!(
            get_cached_rsa_public_key(slot_a, handle_a).is_none(),
            "clear_for_slot must drop public entries in the targeted slot"
        );
        assert!(
            get_cached_rsa_private_key(slot_b, handle_b).is_some(),
            "clear_for_slot must NOT touch entries in other slots"
        );
        assert!(
            get_cached_rsa_public_key(slot_b, handle_b).is_some(),
            "clear_for_slot must NOT touch public entries in other slots"
        );

        // Tidy up so we don't leak entries to other tests.
        evict_cached_keys(slot_b, handle_b);
    }

    #[test]
    #[cfg_attr(
        not(any(debug_assertions, feature = "insecure-rustcrypto-rsa-private-ops")),
        ignore = "RustCrypto RSA private-key operations are refused in release builds \
                  (RUSTSEC-2023-0071); run in debug or with \
                  --features insecure-rustcrypto-rsa-private-ops"
    )]
    fn clear_all_drops_every_entry() {
        let _lock = CACHE_TEST_LOCK.lock().unwrap();
        // Seed both caches across two slots, then assert clear_all wipes them.
        let (slot_a, handle_a) = unique_ids();
        let (slot_b, handle_b) = unique_ids();
        let (der_a, mod_a, exp_a) = fresh_rsa_keypair();
        let (der_b, _mod_b, _exp_b) = fresh_rsa_keypair();

        let _ = rsa_pkcs1v15_sign_cached(slot_a, handle_a, &der_a, b"x", Some(HashAlg::Sha256))
            .unwrap();
        let _ = rsa_pkcs1v15_sign_cached(slot_b, handle_b, &der_b, b"x", Some(HashAlg::Sha256))
            .unwrap();
        let _ = rsa_oaep_encrypt_cached(
            slot_a,
            handle_a,
            &mod_a,
            &exp_a,
            b"x",
            OaepHash::Sha256,
            &[],
        )
        .unwrap();

        assert!(get_cached_rsa_private_key(slot_a, handle_a).is_some());
        assert!(get_cached_rsa_private_key(slot_b, handle_b).is_some());
        assert!(get_cached_rsa_public_key(slot_a, handle_a).is_some());

        clear_all();

        assert!(
            get_cached_rsa_private_key(slot_a, handle_a).is_none(),
            "clear_all must drop the private cache"
        );
        assert!(
            get_cached_rsa_private_key(slot_b, handle_b).is_none(),
            "clear_all must drop the private cache across slots"
        );
        assert!(
            get_cached_rsa_public_key(slot_a, handle_a).is_none(),
            "clear_all must drop the public cache"
        );
    }
}