Module crypto 

Signing keys, verification keys and hash functions.

Implements the signature algorithms used by DKIM (RFC 6376 Section 3.3), ARC (RFC 8617) and DKIM2 (draft-ietf-dkim-dkim2-spec): rsa-sha256, rsa-sha1 (verification only; deprecated by RFC 8301), ed25519-sha256 (RFC 8463, built on the EdDSA scheme of RFC 8032) and, for DKIM2 only, the post-quantum mldsa44 (“pure” ML-DSA-44, FIPS 204).

The backend is chosen at compile time: aws-lc-rs, or rust-crypto (the pure Rust rsa, ed25519-dalek, ml-dsa, sha1 and sha2 crates) when aws-lc-rs is not enabled. RsaKey, Ed25519Key and MlDsa44Key have the same interface on every backend.

Structs

Ed25519Key

An Ed25519 private key for ed25519-sha256 signing (RFC 8463).

MlDsa44Key

An ML-DSA-44 private key for mldsa44 signing (DKIM2 only, draft-ietf-dkim-dkim2-spec Section 3.4).

RsaKey

An RSA private key for rsa-sha256 signing (RFC 6376 Section 3.3.2).

Sha1

The SHA-1 hash function, used by the rsa-sha1 algorithm (RFC 6376 Section 3.3.1). Deprecated by RFC 8301; kept for verifying legacy signatures.

Sha256

The SHA-256 hash function, used by rsa-sha256 and ed25519-sha256.

Sha512

The SHA-512 hash function, used by DKIM2 sha512 message hashes.

Enums

Algorithm

A signature algorithm, as named in the a= tag of DKIM (RFC 6376 Section 3.5) and ARC signatures and in the s= tag of DKIM2 signatures.

CryptoError

A failure reported by the cryptography layer, carried by Error::Crypto.

DkimKey

A concrete DKIM signing key, holding an RSA, an Ed25519 or an ML-DSA-44 key.

HashAlgorithm

A hash algorithm selected at run time, as named in DKIM tags (the hash part of a=, and the h= tag of DKIM key records) and in the h= tag of DKIM2 Message-Instance header fields.

HashOutput

A hash digest produced by the active cryptography backend.

Traits

HashContext

An incremental hash computation. Data is fed through Writer.

HashImpl

A hash function, selected at the type level.

SigningKey

A private key that can produce DKIM, ARC and DKIM2 signatures.

VerifyingKey

A public key that can verify signatures, parsed from the p= tag of a DKIM key record (RFC 6376 Section 3.6.1).