Skip to main content

VerifyBackend

rite_sdk

Trait VerifyBackend 

Source 
pub trait VerifyBackend: Backend {
    // Required method
    fn verify_public_key(
        &mut self,
        key: &PublicKeyDer,
        message: &[u8],
        signature: &[u8],
        algorithm: SignAlgorithm,
    ) -> Result<bool, BackendError>;
}
Expand description

Signature verification operations.

Separate from SignBackend because the two need different things. Signing needs a secret, so only the device holding it can do the work; verification needs a public key, so anything can. A card that signs and never verifies implements one trait, and a verification-only backend (a notary, an enclave) implements the other without having to refuse sign.

Most ceremonies verify in software and name no backend. Naming one is for a deployment that requires the check inside a validated boundary, or a verifier that is not local.

Required Methods§

Source

fn verify_public_key( &mut self, key: &PublicKeyDer, message: &[u8], signature: &[u8], algorithm: SignAlgorithm, ) -> Result<bool, BackendError>

Verify signature over message under key.

Takes the key rather than a reference to one the backend holds, because the evidence a ceremony checks usually comes from outside it: a CSR from another party, a signature made on a card that is no longer present. There is no handle to name for those.

&mut self because a verifier may need a session to work in. PKCS#11 creates a public key object, verifies against it, and destroys it.

Dyn Compatibility§

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors§