Module personal 

Provider-neutral personal key containers (RFC7292 / RFC5958).

Reading is inspection, never authentication or permission to use a key. process() authenticates the complete original safe before extraction; passwords, cryptographic engines, key selection and trust remain explicit caller contracts. Private-key values are borrowed, not decoded by a backend. No type containing private plaintext implements Debug or allocating Clone.

Modules

protection

Original password-protection parameters; no KDF, password or cipher engine.

Structs

Bag

SafeBag with original identity/attributes and decoded value.

EncryptedData

CMS EncryptedData, RFC5652 §8, used by PKCS#12 password privacy.

Failure

Terminal failure, preserving the exact cause and its coordinate chain. At most two carried wrappers and two decryptions occur in this pipeline; nested SafeContents are walked in place and add no transformation layer.

Fragments

A carried-byte map into its immediate enclosing source. Unlike a standalone document map, its parent can itself be carried or decrypted; the Source / Failure::origins chain identifies that domain explicitly. No method claims that a parent-relative offset is already a physical PFX coordinate.

MacData

Original MacData, including ignored legacy fields in PBMAC1 mode.

Pfx

Original PFX v3. Parsing does not invoke passwords or provider operations.

Plaintext

Accounted plaintext which wipes initialized storage before deallocation. It owns no backend and never implements Debug/Clone. Growth and copies must use the supplied current Reader execution before wrapping the resulting owner.

PrivateKey

RFC5958 OneAsymmetricKey / PKCS#8 PrivateKeyInfo.

ShroudedKey

EncryptedPrivateKeyInfo, with original protection parameters/ciphertext.

Enums

BagValue

A typed original bag value, including open types and nested bags.

Cause

Processing failures are distinct from provider/consumer callback refusal.

Decision

A provider’s explicit acceptance/capability result, not an application verdict.

Integrity

Original PFX integrity mode. Absence of a MAC is not authenticated data.

Origin

One independently retained source transformation, innermost first.

Safe

One protected AuthenticatedSafe member. Unrecognized content stays explicit.

Source

Scoped coordinates for callback views. Joins map to their enclosing source; decrypted bytes have their own coordinate space, never invented physical offsets. A caller can retain/project known locations while the scope is live.

Traits

Backend

A selected backend and extraction visitor. It must fund all backend work, temporary/output capacity and key/password handling through the supplied Reader before work. There is no default implementation or implicit engine.

Functions

legacy_password

Encode a legacy PKCS#12 password as big-endian BMP characters plus a single zero terminator (RFC7292 Appendix B.1). Supplementary Unicode scalars are refused, never encoded as surrogate pairs. PBMAC1 (RFC9879 §6) and PBES2 use the original UTF-8 bytes instead; callers must not apply this conversion merely because a different protection layer in the same PFX uses legacy PBE. https://www.rfc-editor.org/rfc/rfc7292#appendix-B.1

process

Authenticate, then process every original safe and nested bag once.