Struct WrapDescription 

#[non_exhaustive]
pub struct WrapDescription {
    pub recipient_info: Option<RecipientInfoKind>,
    pub key_encryption_oid: Oid,
    pub kdf_oid: Option<Oid>,
    pub kek_wrap_oid: Option<Oid>,
    pub content_encryption_oid: Option<Oid>,
}

What a wrap actually did.

The scheme a step requests names a family. The algorithms inside it move independently: the recipient’s key type selects the encapsulation, the content cipher selects the KEK size, and the KDF digest is a library default rather than a property of any key.

Where the scheme is self-describing this is an observation, re-derivable from the blob alone, which is what makes it evidence. Where it is not, it is what the backend invoked. WrapScheme::is_self_describing is the difference, and rite verify reports the two differently.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

recipient_info: Option<RecipientInfoKind>

How the CEK reaches the recipient, for a scheme built on CMS.

Absent for a raw mechanism, whose output carries no RecipientInfo and no other ASN.1 structure.

key_encryption_oid: Oid

The key-encryption algorithm: key transport for ktri, the key-agreement scheme for kari.

kdf_oid: Option<Oid>

The KDF, where the encapsulation derives a KEK.

kek_wrap_oid: Option<Oid>

The algorithm wrapping the CEK under the derived KEK.

content_encryption_oid: Option<Oid>

The content cipher, for schemes that encrypt the key as CMS content.

Implementations

impl WrapDescription

pub fn new(recipient_info: RecipientInfoKind, key_encryption_oid: Oid) -> Self

Describe a CMS wrap by its recipient info and key-encryption algorithm.

pub fn raw(key_encryption_oid: Oid) -> Self

Describe a raw mechanism, which has no CMS structure around it.

pub fn with_kdf(self, oid: Oid) -> Self

Record the KDF the encapsulation ran.

pub fn with_kek_wrap(self, oid: Oid) -> Self

Record the algorithm that wrapped the CEK under the derived KEK.

pub fn with_content_encryption(self, oid: Oid) -> Self

Record the content cipher.

pub fn content_is_authenticated(&self) -> bool

Whether the CMS content was encrypted under an authenticated cipher.

True only for AES-256-GCM, the one authenticated cipher Rite writes, so a foreign blob under another AEAD reads as unauthenticated here. It asks about a CMS content cipher and nothing else, so it is false for every raw mechanism, including ones that authenticate by other means.

Trait Implementations

impl Clone for WrapDescription

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for WrapDescription

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for WrapDescription

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for WrapDescription

impl PartialEq for WrapDescription

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for WrapDescription

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for WrapDescription