Struct Pkcs11KeyStoreOptions 

#[non_exhaustive]
pub struct Pkcs11KeyStoreOptions {
    pub sessions: usize,
    pub rsa_algorithm: JwsAlgorithm,
    pub algorithms: Option<Vec<JwsAlgorithm>>,
}

Available on crate feature pkcs11 only.

How a Pkcs11KeyStore uses its token.

Examples

use identity_kit::jose::JwsAlgorithm;
use identity_kit::keys::Pkcs11KeyStoreOptions;

let options = Pkcs11KeyStoreOptions::new()
    .sessions(2)
    .rsa_algorithm(JwsAlgorithm::PS256)
    .algorithms([JwsAlgorithm::ES256, JwsAlgorithm::PS256]);
assert_eq!(options.sessions, 2);
assert_eq!(options.rsa_algorithm, JwsAlgorithm::PS256);
assert_eq!(
    options.algorithms,
    Some(vec![JwsAlgorithm::ES256, JwsAlgorithm::PS256])
);

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

sessions: usize

How many sessions the store keeps open at most, 4 by default.

Sessions are opened as needed, logged in and reused; an operation waits for a session when all of them are in use. At least 1.

rsa_algorithm: JwsAlgorithm

The algorithm RSA keys sign with, RS256 by default: RS256 (CKM_RSA_PKCS) or PS256 (CKM_RSA_PKCS_PSS).

A PKCS#11 RSA key does not record which padding it is for, and a key signs with one algorithm only, so the store settles it for all RSA keys of the token: the public JWK of every RSA key carries this alg, sign accepts only this algorithm for an RSA key and generate makes RSA keys for it.

algorithms: Option<Vec<JwsAlgorithm>>

The algorithms the store offers, out of those the module signs with; None for all of them.

The store derives what it can sign with from the module’s mechanism list (see Pkcs11KeyStore); this narrows that list, for a module whose CKM_ECDSA cannot take secp256k1 for instance. Algorithms the module does not sign with are left out.

Implementations

impl Pkcs11KeyStoreOptions

pub fn new() -> Self

The defaults: four sessions, RS256 for RSA keys, every algorithm the module signs with.

pub fn sessions(self, sessions: usize) -> Self

Sets sessions.

pub fn rsa_algorithm(self, alg: JwsAlgorithm) -> Self

Sets rsa_algorithm.

pub fn algorithms( self, algorithms: impl IntoIterator<Item = JwsAlgorithm>, ) -> Self

Sets algorithms.

Trait Implementations

impl Clone for Pkcs11KeyStoreOptions

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Pkcs11KeyStoreOptions

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Pkcs11KeyStoreOptions

fn default() -> Self

Returns the “default value” for a type.

impl Eq for Pkcs11KeyStoreOptions

impl PartialEq for Pkcs11KeyStoreOptions

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for Pkcs11KeyStoreOptions