Enum x509_certificate::signing::InMemorySigningKeyPair

pub enum InMemorySigningKeyPair {
    Ecdsa(EcdsaKeyPair, EcdsaCurve),
    Ed25519(Ed25519KeyPair),
    Rsa(RsaKeyPair),
}

Represents a key pair that exists in memory and can be used to create cryptographic signatures.

This is a wrapper around ring’s various key pair types. It provides abstractions tailored for X.509 certificates.

Variants

Ecdsa(EcdsaKeyPair, EcdsaCurve)

ECDSA key pair.

Ed25519(Ed25519KeyPair)

ED25519 key pair.

Rsa(RsaKeyPair)

RSA key pair.

Implementations

impl InMemorySigningKeyPair

pub fn from_pkcs8_der(data: impl AsRef<[u8]>) -> Result<Self, Error>

Attempt to instantiate an instance from PKCS#8 DER data.

The DER data should be a OneAsymmetricKey ASN.1 structure.

pub fn from_pkcs8_pem(data: impl AsRef<[u8]>) -> Result<Self, Error>

Attempt to instantiate an instance from PEM encoded PKCS#8.

This is just a wrapper for Self::from_pkcs8_der that does the PEM decoding for you.

pub fn generate_random(
    key_algorithm: KeyAlgorithm
) -> Result<(Self, Document), Error>

Generate a random key pair given a key algorithm and optional ECDSA signing algorithm.

The raw PKCS#8 document is returned to facilitate access to the private key.

Not attempt is made to protect the private key in memory.

pub fn public_key_data(&self) -> &[u8]

Obtain the raw bytes constituting the key pair’s public key.

pub fn key_algorithm(&self) -> KeyAlgorithm

Obtain the KeyAlgorithm in use by this instance.

pub fn signature_algorithm(&self) -> SignatureAlgorithm

Obtain the SignatureAlgorithm that this key pair will use.

Instances can be coerced into the ASN.1 AlgorithmIdentifier via .into() for easy inclusion in ASN.1 structures.

pub fn verification_algorithm(&self) -> &'static dyn VerificationAlgorithm

Attempt to resolve a verification algorithm for this key pair.

This is a wrapper around SignatureAlgorithm::resolve_verification_algorithm() with our bound KeyAlgorithm. However, since there are no parameters that can result in wrong choices, this is guaranteed to always work and doesn’t require Result.

pub fn sign(
    &self,
    message: impl AsRef<[u8]>
) -> Result<(Vec<u8>, SignatureAlgorithm), Error>

Sign a message using this signing key.

Returns the raw bytes constituting the signature and which signature algorithm was used. The returned SignatureAlgorithm can be serialized into an ASN.1 AlgorithmIdentifier via .into().

This will use a new instance of ring’s SystemRandom. The RSA padding algorithm is hard-coded to RSA_PCS1_SHA256.

If you want total control over signing parameters, obtain the underlying ring keypair and call its .sign().

Trait Implementations

impl Debug for InMemorySigningKeyPair

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl From<&'_ InMemorySigningKeyPair> for KeyAlgorithm

fn from(key: &InMemorySigningKeyPair) -> Self

Performs the conversion.

impl From<Ed25519KeyPair> for InMemorySigningKeyPair

fn from(key: Ed25519KeyPair) -> Self

Performs the conversion.

impl From<RsaKeyPair> for InMemorySigningKeyPair

fn from(key: RsaKeyPair) -> Self

Performs the conversion.