Struct RsaKeyUnwrapper 

pub struct RsaKeyUnwrapper { /* private fields */ }

RSA-OAEP key unwrapper for decrypting Column Encryption Keys.

Implementations

impl RsaKeyUnwrapper

pub fn from_pem(pem: &str) -> Result<Self, EncryptionError>

Create a new unwrapper from a PEM-encoded RSA private key.

Supports both PKCS#1 and PKCS#8 formats.

Arguments

• pem - PEM-encoded RSA private key

Errors

Returns an error if the key cannot be parsed.

pub fn from_der(der: &[u8]) -> Result<Self, EncryptionError>

Create a new unwrapper from DER-encoded RSA private key bytes.

Arguments

• der - DER-encoded RSA private key (PKCS#8 format)

Errors

Returns an error if the key cannot be parsed.

pub fn from_key(private_key: RsaPrivateKey) -> Self

Create a new unwrapper from an existing RSA private key.

pub fn decrypt_cek( &self, encrypted_cek: &[u8], ) -> Result<Vec<u8>, EncryptionError>

Decrypt a Column Encryption Key (CEK) using RSA-OAEP.

Parses the canonical envelope, verifies its signature against this CMK’s public key, and unwraps the CEK.

Arguments

• encrypted_cek - The encrypted CEK envelope

Returns

The decrypted CEK (32 bytes for AES-256).

Errors

Returns an error if:

• The encrypted CEK envelope is invalid
• The ciphertext or signature length does not match the RSA key size
• Signature verification fails
• RSA decryption fails

pub fn decrypt_raw(&self, ciphertext: &[u8]) -> Result<Vec<u8>, EncryptionError>

Decrypt raw RSA-OAEP ciphertext (without SQL Server header).

Use this when you have just the RSA ciphertext without the SQL Server envelope.

pub fn key_bits(&self) -> usize

Get the RSA key size in bits.