Struct PubSecKariConfig 

pub struct PubSecKariConfig {
    pub p: i32,
    pub encrypt_metadata: bool,
    pub recipients: Vec<KariRecipient>,
    pub ukm: Option<Vec<u8>>,
    pub seed: [u8; 20],
    pub cek: [u8; 32],
    pub envelope_iv: [u8; 16],
    pub aes_iv: [u8; 16],
}

Configuration for a writer-side KARI public-key envelope. AES-256 content + AES-256-WRAP (the round-15 baseline; AES-128 / AES-192 wrap variants are reachable through super::kari::wrap_cek_for_recipient directly if a caller needs them).

Each recipient gets its own KARI in the RecipientInfos SET — that’s the only way to mix curves cleanly because a single KARI’s keyEncryptionAlgorithm binds one (curve, KDF) pair (RFC 5652 §6.2.2 + RFC 5753 §3.1). All KARIs wrap the same CEK so any matching recipient recovers the same AES-256 file content.

Fields

p: i32

32-bit signed permissions value (§7.6.3.2 Table 22).

encrypt_metadata: bool

Whether the document metadata stream is encrypted. Plumbed into both the /EncryptMetadata dict entry and the 0xFFFFFFFF opt-in tail of the SHA-256 file-key derivation when false.

recipients: Vec<KariRecipient>

One KariRecipient per recipient certificate.

ukm: Option<Vec<u8>>

Optional UKM (UserKeyingMaterial) mixed into the X9.63 KDF on both sides. Same UKM is used for every recipient’s wrap (RFC 5753 §7.2 — the UKM is per-KARI). None for “absent”.

seed: [u8; 20]

20-byte seed prefixed to the envelope plaintext. Tests pin for determinism.

cek: [u8; 32]

32-byte content-encryption key. AES-256.

envelope_iv: [u8; 16]

AES-256-CBC envelope IV.

aes_iv: [u8; 16]

Per-object AES IV.

Implementations

impl PubSecKariConfig

pub fn aes256(recipients: Vec<KariRecipient>) -> Self

Default config for AES-256 KARI with deterministic test constants. Production callers should override seed, cek, envelope_iv, aes_iv, and each recipient’s ephemeral_scalar with fresh random bytes.

Trait Implementations

impl Clone for PubSecKariConfig

fn clone(&self) -> PubSecKariConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for PubSecKariConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.