reallyme-crypto 0.3.1

Cross-platform cryptographic primitives, key formats, and conformance-tested provider bindings.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149

// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
//
// SPDX-License-Identifier: Apache-2.0

//! Semantic owner for public-key byte encoding helpers.

use super::{BackendErrorReason, OperationError, PrimitiveErrorReason};
use crate::secret_material::{bind_operation_policy, SecretMaterialOperation};

/// Validates a fixed-width public key and returns its canonical byte form.
pub fn copy_fixed_public_key(
    public_key: &[u8],
    expected_len: usize,
) -> Result<Vec<u8>, OperationError> {
    let _policy = bind_operation_policy(SecretMaterialOperation::PublicKeyEncoding);
    if public_key.len() != expected_len {
        return Err(invalid_public_key());
    }
    Ok(public_key.to_vec())
}

#[cfg(feature = "ed25519")]
/// Validates and returns canonical Ed25519 public-key bytes.
pub fn encode_ed25519_public_key(public_key: &[u8]) -> Result<Vec<u8>, OperationError> {
    let _policy = bind_operation_policy(SecretMaterialOperation::PublicKeyEncoding);
    crypto_ed25519::encode_public_key(public_key).map_err(map_public_key_error)
}

#[cfg(feature = "ed25519")]
/// Decodes Ed25519 public-key bytes into the canonical raw representation.
pub fn decode_ed25519_public_key(public_key: &[u8]) -> Result<Vec<u8>, OperationError> {
    let _policy = bind_operation_policy(SecretMaterialOperation::PublicKeyEncoding);
    crypto_ed25519::decode_public_key(public_key).map_err(map_public_key_error)
}

#[cfg(feature = "p256")]
/// Compresses an uncompressed P-256 SEC1 public key.
pub fn compress_p256_public_key(public_key: &[u8]) -> Result<Vec<u8>, OperationError> {
    let _policy = bind_operation_policy(SecretMaterialOperation::PublicKeyEncoding);
    crypto_p256::compress_p256(public_key).map_err(map_public_key_error)
}

#[cfg(feature = "p256")]
/// Decompresses a compressed P-256 SEC1 public key.
pub fn decompress_p256_public_key(public_key: &[u8]) -> Result<Vec<u8>, OperationError> {
    let _policy = bind_operation_policy(SecretMaterialOperation::PublicKeyEncoding);
    crypto_p256::decompress_p256(public_key).map_err(map_public_key_error)
}

#[cfg(feature = "p384")]
/// Compresses an uncompressed P-384 SEC1 public key.
pub fn compress_p384_public_key(public_key: &[u8]) -> Result<Vec<u8>, OperationError> {
    let _policy = bind_operation_policy(SecretMaterialOperation::PublicKeyEncoding);
    crypto_p384::compress_p384(public_key).map_err(map_public_key_error)
}

#[cfg(feature = "p384")]
/// Decompresses a compressed P-384 SEC1 public key.
pub fn decompress_p384_public_key(public_key: &[u8]) -> Result<Vec<u8>, OperationError> {
    let _policy = bind_operation_policy(SecretMaterialOperation::PublicKeyEncoding);
    crypto_p384::decompress_p384(public_key).map_err(map_public_key_error)
}

#[cfg(feature = "p521")]
/// Compresses an uncompressed P-521 SEC1 public key.
pub fn compress_p521_public_key(public_key: &[u8]) -> Result<Vec<u8>, OperationError> {
    let _policy = bind_operation_policy(SecretMaterialOperation::PublicKeyEncoding);
    crypto_p521::compress_p521(public_key).map_err(map_public_key_error)
}

#[cfg(feature = "p521")]
/// Decompresses a compressed P-521 SEC1 public key.
pub fn decompress_p521_public_key(public_key: &[u8]) -> Result<Vec<u8>, OperationError> {
    let _policy = bind_operation_policy(SecretMaterialOperation::PublicKeyEncoding);
    crypto_p521::decompress_p521(public_key).map_err(map_public_key_error)
}

#[cfg(feature = "secp256k1")]
/// Validates and returns canonical compressed secp256k1 public-key bytes.
pub fn encode_secp256k1_public_key(public_key: &[u8]) -> Result<Vec<u8>, OperationError> {
    let _policy = bind_operation_policy(SecretMaterialOperation::PublicKeyEncoding);
    crypto_secp256k1::encode_public_key(public_key).map_err(map_public_key_error)
}

#[cfg(feature = "secp256k1")]
/// Decodes secp256k1 public-key bytes into the canonical compressed representation.
pub fn decode_secp256k1_public_key(public_key: &[u8]) -> Result<Vec<u8>, OperationError> {
    let _policy = bind_operation_policy(SecretMaterialOperation::PublicKeyEncoding);
    crypto_secp256k1::decode_public_key(public_key).map_err(map_public_key_error)
}

#[cfg(feature = "secp256k1")]
/// Decompresses a secp256k1 public key into affine coordinate bytes.
pub fn decompress_secp256k1_public_key(
    public_key: &[u8],
) -> Result<(Vec<u8>, Vec<u8>), OperationError> {
    let _policy = bind_operation_policy(SecretMaterialOperation::PublicKeyEncoding);
    crypto_secp256k1::decompress_public_key(public_key).map_err(map_public_key_error)
}

#[cfg(feature = "secp256k1")]
/// Validates and returns canonical BIP-340 x-only public-key bytes.
pub fn encode_bip340_schnorr_public_key(public_key: &[u8]) -> Result<Vec<u8>, OperationError> {
    let _policy = bind_operation_policy(SecretMaterialOperation::PublicKeyEncoding);
    crypto_secp256k1::encode_bip340_schnorr_public_key(public_key).map_err(map_public_key_error)
}

#[cfg(feature = "secp256k1")]
/// Decodes BIP-340 x-only public-key bytes into the canonical representation.
pub fn decode_bip340_schnorr_public_key(public_key: &[u8]) -> Result<Vec<u8>, OperationError> {
    let _policy = bind_operation_policy(SecretMaterialOperation::PublicKeyEncoding);
    crypto_secp256k1::decode_bip340_schnorr_public_key(public_key).map_err(map_public_key_error)
}

#[cfg(feature = "x25519")]
/// Validates and returns canonical X25519 public-key bytes.
pub fn encode_x25519_public_key(public_key: &[u8]) -> Result<Vec<u8>, OperationError> {
    let _policy = bind_operation_policy(SecretMaterialOperation::PublicKeyEncoding);
    crypto_x25519::encode_public_key(public_key).map_err(map_public_key_error)
}

#[cfg(feature = "x25519")]
/// Decodes X25519 public-key bytes into the canonical raw representation.
pub fn decode_x25519_public_key(public_key: &[u8]) -> Result<Vec<u8>, OperationError> {
    let _policy = bind_operation_policy(SecretMaterialOperation::PublicKeyEncoding);
    crypto_x25519::decode_public_key(public_key).map_err(map_public_key_error)
}

fn map_public_key_error(error: crypto_core::CryptoError) -> OperationError {
    match error {
        crypto_core::CryptoError::InvalidKey => invalid_public_key(),
        crypto_core::CryptoError::Signature {
            kind: crypto_core::SignatureFailureKind::InvalidPublicKey,
            ..
        } => invalid_public_key(),
        crypto_core::CryptoError::Unsupported => OperationError::Provider {
            reason: super::ProviderErrorReason::UnsupportedAlgorithm,
        },
        _ => OperationError::Backend {
            reason: BackendErrorReason::Internal,
        },
    }
}

fn invalid_public_key() -> OperationError {
    OperationError::Primitive {
        reason: PrimitiveErrorReason::InvalidPublicKey,
    }
}