Skip to main content

CryptoKeyProvider

hiss::provider

Trait CryptoKeyProvider 

Source 
pub trait CryptoKeyProvider<C: Curve> {
    type Error: Error + Send + Sync + 'static;
    type PrivateKey: Send;

    // Required methods
    fn public_key(
        &self,
        key: &Self::PrivateKey,
    ) -> Result<C::PublicKey, Self::Error>;
    fn generate_static_key(&mut self) -> Result<Self::PrivateKey, Self::Error>;
    fn generate_ephemeral_key(
        &mut self,
    ) -> Result<Self::PrivateKey, Self::Error>;
}
Expand description

The shared identity and key lifecycle of a crypto backend: its key/handle types, the (cheap, synchronous) public-key extraction, and synchronous key generation.

Every operation surface — DhProvider (DH), SigningProvider (signing), and their async mirrors — builds on this, so a backend declares its PrivateKey/Error once and may implement any subset of operations independently. Key generation lives here, not on the DH surface, so a sign-only curve can still mint keys. Generic code that only needs the key types or generation (e.g. the handshake state holder) is bounded on this base trait alone.

Required Associated Types§

Source

type Error: Error + Send + Sync + 'static

Error type for this backend’s operations.

'static so it can be preserved as a boxed dyn Error source (e.g. HandshakeError::Crypto).

Source

type PrivateKey: Send

Opaque private key handle.

On macOS this wraps a SecKey; in software it holds raw scalar bytes. Callers never inspect the key material directly — all operations go through these traits.

Intentionally not Clone: secret keys should not be silently duplicated. A backend whose handle is cheap to copy (e.g. an Apple SecKey — a refcounted retain, not a copy of key material) may still derive Clone on its own concrete type; the software backends, which hold raw secret bytes, do not.

Required Methods§

Source

fn public_key( &self, key: &Self::PrivateKey, ) -> Result<C::PublicKey, Self::Error>

Extract the public key from a private key.

Source

fn generate_static_key(&mut self) -> Result<Self::PrivateKey, Self::Error>

Generate a long-term static key pair, synchronously.

Takes &mut self: a backend that owns its CSPRNG advances it here; hardware/deterministic backends ignore the receiver.

Source

fn generate_ephemeral_key(&mut self) -> Result<Self::PrivateKey, Self::Error>

Generate an ephemeral key pair for a single handshake, synchronously.

Mints a fresh per-handshake keypair that is used once and then discarded with the handshake — it is never persisted. This is distinct from a long-term static identity key (generate_static_key): a backend may keep static keys in hardware or on disk, but the ephemeral key is expected to be cheap and transient. Takes &mut self for the same reason: a backend that owns its CSPRNG advances it here.

Dyn Compatibility§

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors§