Trait KeyTransportBackend 

pub trait KeyTransportBackend: Backend {
    // Required methods
    fn wrap(
        &mut self,
        key_id: &KeyId,
        wrapping_key_id: &KeyId,
        scheme: WrapScheme,
    ) -> Result<WrappedKey, BackendError>;
    fn unwrap(
        &mut self,
        wrapped: &WrappedKey,
        unwrapping_key_id: &KeyId,
        label: &str,
        policy: KeyPolicy,
        expected: Option<KeyAlgorithm>,
    ) -> Result<KeyMetadata, BackendError>;

    // Provided method
    fn wrap_to_public(
        &mut self,
        key_id: &KeyId,
        recipient_pub_key: &PublicKeyDer,
        scheme: WrapScheme,
    ) -> Result<WrappedKey, BackendError> { ... }
}

Key transport (wrapping) operations.

Every method returns a WrappedKey carrying the scheme it was asked for and a WrapDescription of what it did, so the caller records an observation rather than a request.

Required Methods

fn wrap( &mut self, key_id: &KeyId, wrapping_key_id: &KeyId, scheme: WrapScheme, ) -> Result<WrappedKey, BackendError>

Wrap key_id using wrapping_key_id under scheme.

fn unwrap( &mut self, wrapped: &WrappedKey, unwrapping_key_id: &KeyId, label: &str, policy: KeyPolicy, expected: Option<KeyAlgorithm>, ) -> Result<KeyMetadata, BackendError>

Unwrap wrapped using unwrapping_key_id, importing the result with label under policy.

The policy is the receiving ceremony’s, not the origin’s: nothing travels with a wrapped key that says what it may do, so the step that imports it declares that, exactly as the step that generated it did.

expected is that same declaration one level down, because nothing travels with a wrapped key saying what it is either. Recovered bytes are a private key or a bare secret depending on what was wrapped, and the two are told apart by what the receiving ceremony says it is restoring rather than by what the bytes happen to parse as. None is a ceremony that declared nothing, which an implementation may serve only where the recovered form is unambiguous. A declaration that disagrees with what came out is a failure, not something to reconcile.

Provided Methods

fn wrap_to_public( &mut self, key_id: &KeyId, recipient_pub_key: &PublicKeyDer, scheme: WrapScheme, ) -> Result<WrappedKey, BackendError>

Wrap key_id to an external recipient’s public key.

Default implementation returns UnsupportedOperation.

Dyn Compatibility

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors