crypto_dispatch/
lib.rs

1// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
2//
3// SPDX-License-Identifier: Apache-2.0
4
5//! Algorithm dispatch and structural validation.
6//!
7//! This crate is the runtime seam between an [`Algorithm`](crypto_core::Algorithm)
8//! selector and the concrete primitive that implements it. Given an
9//! algorithm value it routes keygen, sign/verify, key agreement, KEM
10//! encapsulate/decapsulate, AEAD, and hashing to the matching primitive
11//! adapter, and it binds public keys to their multicodec/multikey
12//! encodings.
13//!
14//! Two safety properties are enforced here rather than left to callers:
15//! [`verify`] fails closed — an invalid signature is an
16//! [`AlgorithmError::SignatureInvalid`], never `Ok(false)` — and every
17//! secret returned (generated private keys, shared secrets, decapsulated
18//! secrets) is carried in a zeroizing wrapper. Length and key-shape checks are
19//! performed by the selected primitive's typed constructors and are exercised
20//! by dispatch-level negative tests so algorithm routing cannot silently
21//! truncate, pad, or reinterpret caller bytes.
22//!
23//! Constant-time behavior for authentication comparisons is inherited from the
24//! wrapped primitive crates. Dispatch does not reimplement tag, MAC, or
25//! signature comparison logic; it routes to the primitive verifier and maps
26//! the verifier's typed failure into this crate's fail-closed result.
27
28// Core modules
29/// Error type returned by dispatch operations.
30pub mod error;
31/// Adapter traits implemented by each algorithm primitive.
32pub mod traits;
33
34// Algorithm adapters
35/// Per-algorithm adapters wiring selectors to concrete primitives.
36pub mod algorithms;
37/// Hashing dispatch.
38pub mod hash;
39/// Message authentication code dispatch.
40pub mod mac;
41
42// Dispatch entry points
43/// Keypair generation with multikey-encoded public keys.
44pub mod keypair;
45/// Multicodec/multikey encoding of public keys.
46pub mod multikey;
47/// Runtime dispatch entry points for sign/verify, key agreement, KEM, and AEAD.
48pub mod registry;
49/// Structural validation of verification-method multikeys.
50pub mod validation;
51
52// Re-export error type
53pub use error::AlgorithmError;
54pub use traits::{AeadParams, MacParams};
55
56// Re-export public dispatch API
57
58pub use hash::hash_digest;
59pub use mac::{mac_authenticate, mac_verify};
60pub use registry::{
61    aead_decrypt, aead_encrypt, derive_shared_secret, generate_keypair, kem_decapsulate,
62    kem_encapsulate, sign, verify,
63};
64
65pub use keypair::{generate_multikey_keypair, GeneratedKeypair};
66
67pub use multikey::public_key_to_multikey;
68
69pub use validation::validate_verification_method_multikey;
crypto_dispatch/lib.rs

crypto_dispatch/
lib.rs
