rite_sdk/lib.rs
1//! Rite SDK: backend abstractions for cryptographic ceremony execution.
2//!
3//! `rite-sdk` is the stable interface layer between the ceremony runtime and
4//! backend implementations. It defines the trait hierarchy, data types, and
5//! error taxonomy that all backends must implement.
6//!
7//! # Implementing a backend
8//!
9//! Implement [`Backend`] and any combination of capability traits matching
10//! your hardware or software capabilities. Use the [`backend_capabilities!`]
11//! macro to reduce boilerplate for the upcasting methods.
12//!
13//! # Trait composition
14//!
15//! Backends implement only the traits matching their capabilities:
16//!
17//! | Backend type | Typical capabilities |
18//! |-------------------|-----------------------------------------------|
19//! | Software | `KeyStore + Sign + KeyTransport` |
20//! | YubiKey PIV | `KeyStore + Sign + Piv + Yubikey` |
21//! | PKCS#11 HSM | `KeyStore + Sign + KeyTransport + Pkcs11` |
22//! | TPM 2.0 | `KeyStore + Sign + Tpm` |
23//! | Mock (testing) | All traits |
24
25#![warn(missing_docs)]
26
27mod backend;
28pub mod cms;
29mod der;
30mod key_material;
31mod names;
32mod types;
33
34pub use key_material::{CertificateDer, PublicKeyDer};
35
36pub use backend::{
37 AttestationBackend, Backend, BackendError, CertStoreBackend, KeyStoreBackend,
38 KeyTransportBackend, PivBackend, Pkcs11AdminBackend, Pkcs11Backend, RandomBackend,
39 Retriability, SignBackend, TpmBackend, VerifyBackend, YubikeyBackend, lock_device,
40};
41
42pub use types::{
43 Attestation, AttestationKind, BackendConfig, CertRef, DataKey, DeviceInfo, EncryptedData,
44 IncoherentContainer, KeyAlgorithm, KeyCheckValue, KeyId, KeyMetadata, KeyPolicy, KeyProtection,
45 KeySecurityAttributes, KeySpec, KeyUsages, Oid, ParseError, PcrValue, PivDeviceInfo,
46 PivKeyOrigin, PivPinPolicy, PivSlot, PivSlotInfo, PivTouchPolicy, Pkcs11Mechanism,
47 Pkcs11TokenFlags, Pkcs11TokenInfo, RecipientInfoKind, SignAlgorithm, TpmInfo, WrapDescription,
48 WrapScheme, WrappedKey, YubikeySlotMetadata, oid,
49};