Module cms 

Read a CMS artifact back into a description of the wrap that produced it.

The wrapping algorithms are not derivable from the wrapping key: the KEK size follows the content cipher, and the ECDH KDF digest is a library default. So the evidence has to come from the DER itself, which is also what an independent verifier has. This module walks that DER far enough to name the algorithm identifiers and the recipient, and no further; it never decrypts and never touches key material.

Rite writes one recipient per wrap, so a RecipientInfo set is described by its first member. A foreign blob addressed to several recipients is described by the first of them, and the others are not reported.

Structs

CmsFacts

What a CMS artifact says about the wrap that produced it.

CmsReadError

A CMS artifact could not be read as a wrap.

KekEnvelope

The parts of an AuthEnvelopedData addressed to one symmetric key.

Constants

GCM_ICV_LEN

The tag length Rite writes.

Functions

describe

Read a CMS ContentInfo DER into the facts of its wrap.

read_kek_enveloped

Read back what write_kek_enveloped wrote.

write_kek_enveloped

Write an AuthEnvelopedData addressed to one symmetric key.