Struct KekEnvelope 

pub struct KekEnvelope {
    pub key_identifier: Vec<u8>,
    pub wrapped_cek: Vec<u8>,
    pub nonce: Vec<u8>,
    pub ciphertext: Vec<u8>,
    pub tag: Vec<u8>,
}

The parts of an AuthEnvelopedData addressed to one symmetric key.

Carried as a struct rather than assembled in place because the same fields are written on the way out and read on the way back, and a field the two sides disagree about is the defect this shape makes impossible.

The crypto is the caller’s: this module puts bytes in a structure and takes them out again, and never holds a key.

use rite_sdk::cms::{self, KekEnvelope};

// Values a backend produces: the CEK wrapped under the KEK, and the
// content under that CEK.
let envelope = KekEnvelope {
    key_identifier: vec![0x76, 0x3c, 0xbc],
    wrapped_cek: vec![0x11; 40],
    nonce: vec![0x22; 12],
    ciphertext: vec![0x33; 64],
    tag: vec![0x44; cms::GCM_ICV_LEN],
};

let der = cms::write_kek_enveloped(&envelope)?;
assert_eq!(cms::read_kek_enveloped(&der)?, envelope);

// And the same bytes describe the wrap that produced them.
let facts = cms::describe(&der)?;
assert_eq!(
    facts.recipient_key_identifier.as_deref(),
    Some(&[0x76, 0x3c, 0xbc][..])
);

Fields

key_identifier: Vec<u8>

What names the key-encryption key, going in kekid.keyIdentifier.

wrapped_cek: Vec<u8>

The content-encryption key, wrapped under the KEK with AES-KW.

nonce: Vec<u8>

The 12-byte AES-GCM nonce.

ciphertext: Vec<u8>

The content under AES-256-GCM.

tag: Vec<u8>

The AES-GCM authentication tag. Its length is what GCMParameters.aes-ICVlen names, so the two cannot disagree.

Trait Implementations

impl Clone for KekEnvelope

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for KekEnvelope

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for KekEnvelope

impl PartialEq for KekEnvelope

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for KekEnvelope