rite_sdk/lib.rs
1//! Rite SDK: backend abstractions for cryptographic ceremony execution.
2//!
3//! `rite-sdk` is the stable interface layer between the ceremony runtime and
4//! backend implementations. It defines the trait hierarchy, data types, and
5//! error taxonomy that all backends must implement.
6//!
7//! # Implementing a backend
8//!
9//! Implement [`Backend`] and any combination of capability traits matching
10//! your hardware or software capabilities. Use the [`backend_capabilities!`]
11//! macro to reduce boilerplate for the upcasting methods.
12//!
13//! # Trait composition
14//!
15//! Backends implement only the traits matching their capabilities:
16//!
17//! | Backend type | Typical capabilities |
18//! |-------------------|-----------------------------------------------|
19//! | Software | `KeyStore + Sign + KeyTransport` |
20//! | YubiKey PIV | `KeyStore + Sign + Piv + Yubikey` |
21//! | PKCS#11 HSM | `KeyStore + Sign + KeyTransport + Pkcs11` |
22//! | TPM 2.0 | `KeyStore + Sign + Tpm` |
23//! | Mock (testing) | All traits |
24
25#![warn(missing_docs)]
26
27mod backend;
28pub mod cms;
29mod der;
30mod key_material;
31mod types;
32
33pub use key_material::{CertificateDer, PublicKeyDer};
34
35pub use backend::{
36 AttestationBackend, Backend, BackendError, CertStoreBackend, KeyStoreBackend,
37 KeyTransportBackend, PivBackend, Pkcs11AdminBackend, Pkcs11Backend, RandomBackend,
38 Retriability, SignBackend, TpmBackend, VerifyBackend, YubikeyBackend,
39};
40
41pub use types::{
42 Attestation, AttestationKind, BackendConfig, CertRef, DataKey, DeviceInfo, EncryptedData,
43 IncoherentContainer, KeyAlgorithm, KeyCheckValue, KeyId, KeyMetadata, KeyPolicy, KeyProtection,
44 KeySecurityAttributes, KeySpec, KeyUsages, Oid, ParseError, PcrValue, PivDeviceInfo,
45 PivKeyOrigin, PivPinPolicy, PivSlot, PivSlotInfo, PivTouchPolicy, Pkcs11Mechanism,
46 Pkcs11TokenFlags, Pkcs11TokenInfo, RecipientInfoKind, SignAlgorithm, TpmInfo, WrapDescription,
47 WrapScheme, WrappedKey, YubikeySlotMetadata, oid,
48};