Module keys 

Key stores: private keys behind an opaque id, with signing as a remote operation.

The module is shaped by remote signers, an HSM or a cloud KMS being the design target:

• A key is named by an opaque KeyId (a label, a PKCS#11 object name, a cloud key ARN).
• Private material never leaves the backend. KeyStore::sign is async, and callers keep the public Jwk they get from KeyStore::public_jwk rather than asking for it on every use; KeySigner does exactly that and implements Signer.
• Every key has one algorithm. A backend declares what it signs with, and whether it can generate and delete keys, in KeyStoreCapabilities; the declaration must be truthful and testsuite (feature test-vectors) checks it.
• Signatures are returned in their JWS form: 64 bytes for EdDSA, raw r || s for ECDSA.

Three backends ship with the crate. InMemoryKeyStore (feature in-memory) and SoftwareKeyStore (feature software), a private JWK set file, are for development and tests: both sign EdDSA, ES256 and, with the secp256k1 feature, ES256K, and neither signs with RSA, which stays outside the software backends per docs/adr/0001-rsa-verification-only.md. Pkcs11KeyStore (feature pkcs11) signs in a PKCS#11 module, an HSM or a software token, with whatever the module offers, RSA included. Vendor-specific backends live in their own crates and implement KeyStore; docs/key-stores.md is the contract they follow.

Cargo features

• in-memory: InMemoryKeyStore.
• software (default): SoftwareKeyStore.
• pkcs11: Pkcs11KeyStore.
• test-vectors: testsuite.

Re-exports

pub use crate::jose::KeyType;

Modules

testsuitetest-vectors

The behavioural suite every KeyStore must pass.

Structs

InMemoryKeyStorein-memory

A KeyStore holding its keys in memory.

KeyId

The opaque id of a key in a KeyStore.

KeySigner

A Signer over one key of a KeyStore.

KeySpec

What to generate: a key type, the one algorithm the key will sign with, and an optional label.

KeyStoreCapabilities

What a KeyStore can do.

Pkcs11KeyStorepkcs11

A KeyStore over a token of a PKCS#11 module: an HSM, a smart card or a software token such as SoftHSM2.

Pkcs11KeyStoreOptionspkcs11

How a Pkcs11KeyStore uses its token.

SoftwareKeyStoresoftware

A KeyStore over a file holding a JWK set of private keys.

SoftwareKeyStoreOptionssoftware

How to open a SoftwareKeyStore.

Enums

KeyStoreError

Why a KeyStore operation failed.

Pkcs11Errorpkcs11

What went wrong with the PKCS#11 module, carried as KeyStoreError::Backend.

Pkcs11Tokenpkcs11

Which token of a PKCS#11 module a Pkcs11KeyStore uses.

Constants

STAGING_LABEL_PREFIXpkcs11

The label a key pair carries between its generation and its thumbprint being known.

Traits

KeyStore

A backend holding private keys.