Module encrypted 

RFC5755 §7.1 targeted encrypted attributes and ciphertext-stealing defense.

The authenticated original AC contains ContentInfo values with independent EnvelopedData. Its selected provider decrypts; the common core then checks DER ACClearAttrs, issuer/serial and the original AA-control intersection. Plaintext is a new logical coordinate space, never a physical ciphertext offset or invertible source map. No encryption engine or key store is here. https://www.rfc-editor.org/rfc/rfc5755#section-7.1

Structs

Bound

Temporarily bound plaintext. Its type cannot escape the callback, and a readable-but-unbound ACClearAttrs cannot be passed in its place.

ClearAttrs

DER plaintext inspection, not an authenticated/bound credential by itself.

Encrypted

Complete catalogue of independent original targeted envelopes. Reading all values precedes the first provider call, so malformed later metadata cannot leave a successful decrypted prefix. It authenticates no AC on its own.

PlaintextSource

Logical plaintext context retained independently of temporary decrypted bytes. envelope is in the enclosing AC’s source coordinates. Any error produced by the plaintext reader uses zero-based plaintext coordinates, not that source.

Enums

Attempt

One independent decryption result from the explicitly selected provider. Capability/recipient/cryptographic rejection are completed answers, while original processing/resource/backend errors use Result::Err.

DecryptError

Terminal refusal, preserving the callback cause and its honest source space.

Outcome

One original envelope’s complete result, preserving unavailable versus false.

Rejection

Completed negative plaintext binding. No attribute-use receipt exists.

Constants

CONTENT_TYPE

id-ct-attrCertEncAttrs, identifying the exact decrypted content syntax.

IDENTIFIER

id-aca-encAttrs, RFC5755 Appendix A.