Enum opcua_server::prelude::security_policy::SecurityPolicy

source · [−]

pub enum SecurityPolicy {
    Unknown,
    None,
    Aes128Sha256RsaOaep,
    Basic256Sha256,
    Aes256Sha256RsaPss,
    Basic128Rsa15,
    Basic256,
}

Expand description

SecurityPolicy implies what encryption and signing algorithms and their relevant key strengths are used during an encrypted session.

Variants

`Unknown`

`None`

`Aes128Sha256RsaOaep`

`Basic256Sha256`

`Aes256Sha256RsaPss`

`Basic128Rsa15`

`Basic256`

Implementations

source

impl SecurityPolicy

source

pub fn to_uri(&self) -> &'static str

source

pub fn is_supported(&self) -> bool

Returns true if the security policy is supported. It might be recognized but be unsupported by the implementation

source

pub fn is_deprecated(&self) -> bool

Returns true if the security policy has been deprecated by the OPC UA specification

source

pub fn derived_signature_key_size(&self) -> usize

Returns the derived signature key (not the signature) size in bytes

source

pub fn min_max_asymmetric_keylength(&self) -> (usize, usize )

Returns the min and max (inclusive) key length in bits

source

pub fn is_valid_keylength(&self, keylength: usize) -> bool

Tests if the supplied key length is valid for this policy

source

pub fn random_nonce(&self) -> ByteString

Creates a random nonce in a bytestring with a length appropriate for the policy

source

pub fn secure_channel_nonce_length(&self) -> usize

source

pub fn from_uri(uri: &str) -> SecurityPolicy

source

pub fn make_secure_channel_keys(
 &self,
 secret: &[u8 ],
 seed: &[u8 ]
) -> (Vec<u8, Global>, AesKey, Vec<u8, Global>)

Part 6 6.7.5 Deriving keys Once the SecureChannel is established the Messages are signed and encrypted with keys derived from the Nonces exchanged in the OpenSecureChannel call. These keys are derived by passing the Nonces to a pseudo-random function which produces a sequence of bytes from a set of inputs. A pseudo-random function is represented by the following function declaration:

Byte[] PRF( Byte[] secret,  Byte[] seed,  i32 length,  i32 offset)

Where length is the number of bytes to return and offset is a number of bytes from the beginning of the sequence.

The lengths of the keys that need to be generated depend on the SecurityPolicy used for the channel. The following information is specified by the SecurityPolicy:

a) SigningKeyLength (from the DerivedSignatureKeyLength); b) EncryptingKeyLength (implied by the SymmetricEncryptionAlgorithm); c) EncryptingBlockSize (implied by the SymmetricEncryptionAlgorithm).

The parameters passed to the pseudo random function are specified in Table 33.

Table 33 – Cryptography key generation parameters

The Client keys are used to secure Messages sent by the Client. The Server keys are used to secure Messages sent by the Server.

source

pub fn asymmetric_sign(
 &self,
 signing_key: &PKey<Private>,
 data: &[u8 ],
 signature: &mut [u8 ]
) -> Result<usize, StatusCode>

Produce a signature of the data using an asymmetric key. Stores the signature in the supplied signature buffer. Returns the size of the signature within that buffer.

source

pub fn asymmetric_verify_signature(
 &self,
 verification_key: &PKey<Public>,
 data: &[u8 ],
 signature: &[u8 ],
 their_private_key: Option<PKey<Private>>
) -> Result<(), StatusCode>

Verifies a signature of the data using an asymmetric key. In a debugging scenario, the signing key can also be supplied so that the supplied signature can be compared to a freshly generated signature.

source

pub fn asymmetric_encryption_padding(&self) -> RsaPadding

Returns the padding algorithm used for this security policy for asymettric encryption and decryption.

source

pub fn asymmetric_encrypt(
 &self,
 encryption_key: &PKey<Public>,
 src: &[u8 ],
 dst: &mut [u8 ]
) -> Result<usize, StatusCode>

Encrypts a message using the supplied encryption key, returns the encrypted size. Destination buffer must be large enough to hold encrypted bytes including any padding.

source

pub fn asymmetric_decrypt(
 &self,
 decryption_key: &PKey<Private>,
 src: &[u8 ],
 dst: &mut [u8 ]
) -> Result<usize, StatusCode>

Decrypts a message whose thumbprint matches the x509 cert and private key pair.

Returns the number of decrypted bytes

source

pub fn symmetric_sign(
 &self,
 key: &[u8 ],
 data: &[u8 ],
 signature: &mut [u8 ]
) -> Result<(), StatusCode>

Produce a signature of some data using the supplied symmetric key. Signing algorithm is determined by the security policy. Signature is stored in the supplied signature argument.

source