Expand description
Rite SDK: backend abstractions for cryptographic ceremony execution.
rite-sdk is the stable interface layer between the ceremony runtime and
backend implementations. It defines the trait hierarchy, data types, and
error taxonomy that all backends must implement.
§Implementing a backend
Implement Backend and any combination of capability traits matching
your hardware or software capabilities. Use the backend_capabilities!
macro to reduce boilerplate for the upcasting methods.
§Trait composition
Backends implement only the traits matching their capabilities:
| Backend type | Typical capabilities |
|---|---|
| Software | KeyStore + Sign + KeyTransport |
| YubiKey PIV | KeyStore + Sign + Piv + Yubikey |
| PKCS#11 HSM | KeyStore + Sign + KeyTransport + Pkcs11 |
| TPM 2.0 | KeyStore + Sign + Tpm |
| Mock (testing) | All traits |
Macros§
- backend_
capabilities - Implement the
as_*_mutupcasting helpers on a backend struct.
Structs§
- Attestation
- Structured attestation evidence with a discriminant kind.
- Backend
Config - Backend configuration entry from a ceremony file.
- Certificate
Der - An X.509 certificate in DER form.
- Device
Info - Device information for platform attestation.
- KeyId
- Opaque key identifier (backend-specific).
- KeyMetadata
- Metadata returned after key generation or import.
- KeyPolicy
- Security and usage policy for a generated or imported key.
- KeySecurity
Attributes - PKCS#11 key security attributes read from an HSM after key generation.
- KeySpec
- Full specification for key generation or import.
- KeyUsages
- Key usage flags. Maps to PKCS#11
CKA_SIGN,CKA_VERIFY, etc. - Parse
Error - Error returned when parsing an SDK algorithm identifier from a string fails.
- PcrValue
- PCR (Platform Configuration Register) value.
- PivDevice
Info - Device identity information for a PIV-compatible smart card.
- PivSlot
Info - Metadata about a populated PIV slot.
- Pkcs11
Mechanism - Opaque PKCS#11 mechanism identifier.
- Pkcs11
Token Flags - PKCS#11 token capability flags. Maps to the
CKF_*constants in the PKCS#11 standard. - Pkcs11
Token Info - PKCS#11 token information.
- Public
KeyDer - A public key in
SubjectPublicKeyInfo(SPKI) DER form. - TpmInfo
- TPM (Trusted Platform Module) information.
- Wrapped
Key - A wrapped (encrypted) key with its algorithm and metadata.
- Yubikey
Slot Metadata YubiKey-specific slot metadata (vendor extension, not NIST PIV).
Enums§
- Attestation
Kind - The kind of attestation evidence a backend can produce.
- Backend
Error - Backend-specific errors.
- CertRef
- Unified certificate addressing across backend types.
- KeyAlgorithm
- Key algorithm.
- PivKey
Origin - Origin of a key in a PIV slot.
- PivPin
Policy - PIN access policy for PIV private key operations.
- PivSlot
- PIV key slot identifiers.
- PivTouch
Policy - Physical touch policy for private key operations.
- Retriability
- Whether an error may be re-executed by retrying the step.
- Sign
Algorithm - Signature algorithm.
- Wrap
Algorithm - Wrapping algorithm. Determines both the cryptographic method and the output format.
- Wrapped
KeyFormat - Output format family, derived from
WrapAlgorithm.
Traits§
- Attestation
Backend - Hardware attestation operations.
- Backend
- Core trait that all backends must implement.
- Cert
Store Backend - Certificate storage operations.
- KeyStore
Backend - Key generation and storage operations.
- KeyTransport
Backend - Key transport (wrapping) operations.
- PivBackend
- Personal Identity Verification (PIV) smart card operations.
- Pkcs11
Admin Backend - PKCS#11 Security Officer (SO) role operations.
- Pkcs11
Backend - PKCS#11 token operations.
- Random
Backend - Hardware or software random number generation.
- Sign
Backend - Signing operations.
- TpmBackend
- TPM 2.0 operations.
- Verify
Backend - Signature verification operations.
- Yubikey
Backend YubiKey-specific extensions to the PIV interface.