Struct KeyPolicy 

pub struct KeyPolicy {
    pub persistent: bool,
    pub sensitive: bool,
    pub extractable: bool,
    pub wrap_with_trusted_only: bool,
    pub usages: KeyUsages,
}

Security and usage policy for a generated or imported key.

Backends that cannot honour a requested policy MUST return BackendError::OperationNotPermitted rather than silently ignoring it. For example, a PIV backend receiving extractable: true must reject it because PIV keys are always non-extractable by hardware design.

Fields

persistent: bool

Key persists after session ends. Always true for PIV. CKA_TOKEN in PKCS#11.

sensitive: bool

Key material never revealed in plaintext. Always true for PIV. CKA_SENSITIVE.

extractable: bool

Key can be wrapped and exported. Always false for PIV. CKA_EXTRACTABLE.

wrap_with_trusted_only: bool

Key can only be wrapped by a CKA_TRUSTED wrapping key. PKCS#11 CKA_WRAP_WITH_TRUSTED.

usages: KeyUsages

What operations this key is permitted to perform.

Trait Implementations

impl Clone for KeyPolicy

fn clone(&self) -> KeyPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for KeyPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for KeyPolicy

fn default() -> Self

Most secure configuration for ceremony signing keys: persistent=true, sensitive=true, extractable=false, sign+verify only.

impl<'de> Deserialize<'de> for KeyPolicy

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for KeyPolicy

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.