Enum KeyProtection 

#[non_exhaustive]
pub enum KeyProtection {
    AesKeyWrap,
    RsaOaepSha256,
    ProviderDefined,
}

How a data key was protected, in terms a container can record.

A container names the key-encryption algorithm in its own structure, so the caller has to know which one the backend used. Asking the backend is the only way: the protected bytes say nothing about themselves, and what a device does to protect a key is a property of that device rather than of the request.

Every key-protection API in the field takes this as a parameter on the way back: Azure Key Vault’s unwrapKey requires alg, PKCS#11’s C_UnwrapKey requires a mechanism, and AWS KMS Decrypt requires EncryptionAlgorithm for an asymmetric key. A pair of methods without it only works where one implementation is both ends.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

AesKeyWrap

RFC 3394 AES Key Wrap under a symmetric KEK.

What a CMS KEKRecipientInfo names as id-aes128-wrap or id-aes256-wrap, PKCS#11 as CKM_AES_KEY_WRAP, and Azure as A256KW.

RsaOaepSha256

RSAES-OAEP with SHA-256, under a public key.

Azure RSA-OAEP-256, PKCS#11 CKM_RSA_PKCS_OAEP, AWS RSAES_OAEP_SHA_256.

ProviderDefined

The provider’s own envelope, which names no algorithm and follows no published format.

AWS KMS is the case to design for. GenerateDataKey returns a CiphertextBlob of up to 6144 bytes for a 32-byte data key, carrying the key ARN and the encryption context beside the key, and the response names no algorithm at all. Only Decrypt against the same service opens it.

A standard container cannot carry one. A CMS KEKRecipientInfo has to declare a key-encryption algorithm, and declaring id-aes256-wrap over a blob that is not an AES key wrap would produce an artifact whose own structure lies about it, which no reader could open and rite verify would report as checked. A step that assembles a container refuses this by name instead.

Implementations

impl KeyProtection

pub fn is_nameable_in_a_container(self) -> bool

Whether a standard container can record this protection and a standard reader can therefore open the result.

Matched exhaustively on purpose: a protection added without answering this would otherwise default into being written into a container that cannot describe it.

Trait Implementations

impl Clone for KeyProtection

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for KeyProtection

impl Debug for KeyProtection

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for KeyProtection

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Display for KeyProtection

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for KeyProtection

impl PartialEq for KeyProtection

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for KeyProtection

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for KeyProtection