Struct SecurityValidator 

pub struct SecurityValidator { /* private fields */ }

Centralized security validator for lib-Q

This validator provides comprehensive security validation for all cryptographic operations, including algorithm validation, key validation, timing attack prevention, and entropy validation.

Implementations

impl SecurityValidator

pub fn new() -> Result<SecurityValidator, Error>

Create a new security validator

Returns

A new instance of SecurityValidator with all validation components initialized.

Errors

Returns an error if any validation component fails to initialize.

pub fn validate_algorithm_category( &self, algorithm: Algorithm, expected_category: AlgorithmCategory, ) -> Result<(), Error>

Validate that an algorithm is appropriate for the given operation category

Arguments

• algorithm - The algorithm to validate
• expected_category - The expected algorithm category

Returns

Returns Ok(()) if the algorithm supports the category, or an error if it doesn’t.

pub fn validate_key_size( &self, algorithm: Algorithm, key_data: &[u8], is_secret: bool, ) -> Result<(), Error>

Validate key size for a given algorithm

Arguments

• algorithm - The algorithm to validate against
• key_data - The key data to validate
• is_secret - Whether this is a secret key (affects expected size)

Returns

Returns Ok(()) if the key size is correct, or an error if it’s not.

pub fn validate_key_material(&self, key_data: &[u8]) -> Result<(), Error>

Validate that key material is not all zeros (security check)

Arguments

• key_data - The key data to validate

Returns

Returns Ok(()) if the key material is valid, or an error if it’s not.

pub fn validate_public_key( &self, algorithm: Algorithm, key_data: &[u8], ) -> Result<(), Error>

Validate public key for a given algorithm

Arguments

• algorithm - The algorithm to validate against
• key_data - The public key data to validate

Returns

Returns Ok(()) if the public key is valid, or an error if it’s not.

pub fn validate_secret_key( &self, algorithm: Algorithm, key_data: &[u8], ) -> Result<(), Error>

Validate secret key for a given algorithm

Arguments

• algorithm - The algorithm to validate against
• key_data - The secret key data to validate

Returns

Returns Ok(()) if the secret key is valid, or an error if it’s not.

pub fn validate_aead_message(&self, message: &[u8]) -> Result<(), Error>

Validate AEAD plaintext, ciphertext, or associated data size for one operation.

pub fn validate_hash_input(&self, data: &[u8]) -> Result<(), Error>

Validate hash absorb input length.

pub fn validate_signature_message(&self, message: &[u8]) -> Result<(), Error>

Validate signature message preimage length (same policy as Self::validate_hash_input).

pub fn security_constants(&self) -> &SecurityConstants

Immutable access to configured security constants.

pub fn security_constants_mut(&mut self) -> &mut SecurityConstants

Mutable access to security constants (message size ceilings, nonce size, …).

pub fn validate_nonce(&self, nonce: &[u8]) -> Result<(), Error>

Validate nonce size and uniqueness for AEAD operations

Arguments

• nonce - The nonce to validate

Returns

Returns Ok(()) if the nonce is valid, or an error if it’s not.

pub fn validate_ciphertext( &self, algorithm: Algorithm, ciphertext: &[u8], ) -> Result<(), Error>

Validate ciphertext size for a given algorithm

Arguments

• algorithm - The algorithm to validate against
• ciphertext - The ciphertext to validate

Returns

Returns Ok(()) if the ciphertext size is valid, or an error if it’s not.

pub fn validate_signature( &self, algorithm: Algorithm, signature: &[u8], ) -> Result<(), Error>

Validate signature size for a given algorithm

Arguments

• algorithm - The algorithm to validate against
• signature - The signature to validate

Returns

Returns Ok(()) if the signature size is valid, or an error if it’s not.

pub fn validate_randomness(&self, randomness: &[u8]) -> Result<(), Error>

Validate randomness for cryptographic operations

Arguments

• randomness - The randomness to validate

Returns

Returns Ok(()) if the randomness is valid, or an error if it’s not.

pub fn constant_time_compare(&self, a: &[u8], b: &[u8]) -> bool

Perform constant-time comparison of two byte slices

Arguments

• a - First byte slice
• b - Second byte slice

Returns

Returns true if the slices are equal, false otherwise. The comparison is performed in constant time to prevent timing attacks.

pub fn entropy_validator(&self) -> &EntropyValidator

Get immutable access to the entropy validator

This method provides access to the entropy validator for configuration and inspection purposes.

pub fn entropy_validator_mut(&mut self) -> &mut EntropyValidator

Get mutable access to the entropy validator

This method provides mutable access to the entropy validator for configuration purposes. Use with caution in production environments.

Security Warning

Disabling entropy validation reduces security. Only use this for testing scenarios with deterministic randomness.

Trait Implementations

impl Clone for SecurityValidator

fn clone(&self) -> SecurityValidator

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.