crypto_dispatch/
lib.rs

1// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
2//
3// SPDX-License-Identifier: Apache-2.0
4
5//! Algorithm dispatch and structural validation.
6//!
7//! This crate is the runtime seam between an [`Algorithm`](crypto_core::Algorithm)
8//! selector and the concrete primitive that implements it. Given an
9//! algorithm value it routes keygen, sign/verify, key agreement, and KEM
10//! encapsulate/decapsulate to the matching primitive adapter, and it binds public keys to their multicodec/multikey
11//! encodings.
12//!
13//! Two safety properties are enforced here rather than left to callers:
14//! [`verify`] fails closed — an invalid signature is an
15//! [`AlgorithmError::SignatureInvalid`], never `Ok(false)` — and every
16//! secret returned (generated private keys, shared secrets, decapsulated
17//! secrets) is carried in a zeroizing wrapper. Length and key-shape checks are
18//! performed by the selected primitive's typed constructors and are exercised
19//! by dispatch-level negative tests so algorithm routing cannot silently
20//! truncate, pad, or reinterpret caller bytes.
21//!
22//! Constant-time behavior for authentication comparisons is inherited from the
23//! wrapped primitive crates. Dispatch does not reimplement tag, MAC, or
24//! signature comparison logic; it routes to the primitive verifier and maps
25//! the verifier's typed failure into this crate's fail-closed result.
26
27#![doc = include_str!("../README.md")]
28
29// Core modules
30/// Error type returned by dispatch operations.
31pub mod error;
32/// Adapter traits implemented by each algorithm primitive.
33pub mod traits;
34
35// Algorithm adapters
36/// Per-algorithm adapters wiring selectors to concrete primitives.
37pub mod algorithms;
38// Dispatch entry points
39/// Keypair generation with multikey-encoded public keys.
40pub mod keypair;
41/// Multicodec/multikey encoding of public keys.
42pub mod multikey;
43/// Explicit provider selection, custody, lane, and fallback decisions.
44pub mod provider;
45/// Runtime dispatch entry points for sign/verify, key agreement, and KEM.
46pub mod registry;
47/// Structural validation of verification-method multikeys.
48pub mod validation;
49
50// Re-export error type
51pub use error::AlgorithmError;
52// Re-export public dispatch API
53
54pub use registry::{
55    derive_keypair, derive_shared_secret, generate_keypair, kem_decapsulate, kem_encapsulate, sign,
56    verify,
57};
58
59pub use keypair::{generate_multikey_keypair, GeneratedKeypair};
60
61pub use multikey::public_key_to_multikey;
62
63pub use provider::{
64    provider_decision, FallbackPolicy, KeyCopyBoundary, KeyResidency, ProviderDecision,
65    ProviderDisposition, ProviderKind, ProviderLane, ProviderOperation, ProviderOutputPolicy,
66    ProviderPolicyReason,
67};
68
69pub use validation::validate_verification_method_multikey;
crypto_dispatch/lib.rs

crypto_dispatch/
lib.rs
