crypto_dispatch/
lib.rs

1// SPDX-FileCopyrightText: 2026 ReallyMe LLC
2//
3// SPDX-License-Identifier: MIT OR Apache-2.0
4
5//! Algorithm dispatch and structural validation.
6//!
7//! This crate is the runtime seam between an [`Algorithm`](crypto_core::Algorithm)
8//! selector and the concrete primitive that implements it. Given an
9//! algorithm value it routes keygen, sign/verify, key agreement, and KEM
10//! encapsulate/decapsulate to the matching primitive adapter, and it binds public keys to their multicodec/multikey
11//! encodings.
12//!
13//! Two safety properties are enforced here rather than left to callers:
14//! [`verify`] fails closed — an invalid signature is an
15//! [`AlgorithmError::SignatureInvalid`], never `Ok(false)` — and every
16//! secret returned (generated private keys, shared secrets, decapsulated
17//! secrets) is carried in a zeroizing wrapper. Length and key-shape checks are
18//! performed by the selected primitive's typed constructors and are exercised
19//! by dispatch-level negative tests so algorithm routing cannot silently
20//! truncate, pad, or reinterpret caller bytes.
21//!
22//! Constant-time behavior for authentication comparisons is inherited from the
23//! wrapped primitive crates. Dispatch does not reimplement tag, MAC, or
24//! signature comparison logic; it routes to the primitive verifier and maps
25//! the verifier's typed failure into this crate's fail-closed result.
26
27#![doc = include_str!("../README.md")]
28
29// Core modules
30/// Error type returned by dispatch operations.
31pub mod error;
32/// Adapter traits implemented by each algorithm primitive.
33pub mod traits;
34
35// Algorithm adapters
36/// Per-algorithm adapters wiring selectors to concrete primitives.
37pub mod algorithms;
38// Dispatch entry points
39/// Keypair generation with multikey-encoded public keys.
40pub mod keypair;
41/// Multicodec/multikey encoding of public keys.
42pub mod multikey;
43/// Explicit provider selection, custody, lane, and fallback decisions.
44pub mod provider;
45/// Runtime dispatch entry points for sign/verify, key agreement, and KEM.
46pub mod registry;
47mod sec1_identity;
48/// Structural validation of verification-method multikeys.
49pub mod validation;
50#[cfg(feature = "x25519")]
51mod x25519_identity;
52
53// Re-export error type
54pub use error::AlgorithmError;
55// Re-export public dispatch API
56
57pub use registry::{
58    derive_keypair, derive_shared_secret, generate_keypair, kem_decapsulate, kem_encapsulate, sign,
59    verify,
60};
61
62pub use keypair::{generate_multikey_keypair, GeneratedKeypair};
63
64pub use multikey::public_key_to_multikey;
65
66pub use provider::{
67    provider_decision, FallbackPolicy, KeyCopyBoundary, KeyResidency, ProviderDecision,
68    ProviderDisposition, ProviderKind, ProviderLane, ProviderOperation, ProviderOutputPolicy,
69    ProviderPolicyReason,
70};
71
72pub use validation::validate_verification_method_multikey;
crypto_dispatch/lib.rs

crypto_dispatch/
lib.rs
