Skip to main content

SignatureProvider

structured_cms::provider

Trait SignatureProvider 

Source 
pub trait SignatureProvider<'a>: AsnDigest<'a> + Sized {
    type SignatureIdentity;
    type RawState;

    // Required methods
    fn resolve_signature(
        &'a self,
        identifier: AlgorithmIdentifier<'a>,
        digest: &Self::Identity,
        key: WorkingKey<'a>,
        encoding: Encoding,
        parent: &Reader<'a>,
    ) -> Result<Resolution<SignatureMode<Self::SignatureIdentity>>, Self::Error>;
    fn compare_signature<W: Work>(
        &self,
        left: &Self::SignatureIdentity,
        right: &Self::SignatureIdentity,
        execution: &W,
    ) -> Result<Ordering, Self::Error>;
    fn start_raw<W: Work>(
        &'a self,
        identity: &Self::SignatureIdentity,
        key: WorkingKey<'a>,
        signature: &'a Octets<'a>,
        execution: &W,
    ) -> Result<Self::RawState, Self::Error>;
    fn update_raw<W: Work>(
        &self,
        state: &mut Self::RawState,
        bytes: &[u8],
        execution: &W,
    ) -> Result<(), Self::Error>;
    fn finish_raw<W: Work>(
        &self,
        state: Self::RawState,
        execution: &W,
    ) -> Result<SignatureAnswer, Self::Error>;
    fn verify_prehashed<W: Work>(
        &'a self,
        identity: &Self::SignatureIdentity,
        key: WorkingKey<'a>,
        signature: &Octets<'a>,
        digest: Prehash<'_, '_, Self, Self::Identity>,
        execution: &W,
    ) -> Result<SignatureAnswer, Self::Error>;
}
Expand description

Signature operations that stay bound to the same selected provider and key.

Digest execution and identities come from the provider’s structured_asn1::digest::Digest and AsnDigest implementations; CMS payload message-digest, ESS certificate hashes and TSP imprints all run through them with their distinct original covered inputs.

The effective key retains its original SPKI and inherited parameters. Resolution validates key/algorithm compatibility before raw initialization or payload I/O. A contiguous-only backend may explicitly buffer with full admission in its adapter, or report unsupported; it cannot downgrade raw.

Common processing borrows a stable nonzero-sized selection owner. Ordinary adapters containing engine/context references already satisfy this. Wrap a zero-sized stateless adapter in ProviderSession before using common processing; otherwise it returns a processing ProviderMismatch before dispatch. Distinct ZST addresses cannot supply instance provenance.

Required Associated Types§

Source

type SignatureIdentity

Fully resolved signature identity, including algorithm-specific defaults.

Source

type RawState

Raw verification state, initialized with original signature/key first.

Required Methods§

Source

fn resolve_signature( &'a self, identifier: AlgorithmIdentifier<'a>, digest: &Self::Identity, key: WorkingKey<'a>, encoding: Encoding, parent: &Reader<'a>, ) -> Result<Resolution<SignatureMode<Self::SignatureIdentity>>, Self::Error>

Chooses raw versus prehashed only after complete algorithm/key resolution.

Source

fn compare_signature<W: Work>( &self, left: &Self::SignatureIdentity, right: &Self::SignatureIdentity, execution: &W, ) -> Result<Ordering, Self::Error>

Semantic signature/default comparison for protected versus outer identifiers.

Source

fn start_raw<W: Work>( &'a self, identity: &Self::SignatureIdentity, key: WorkingKey<'a>, signature: &'a Octets<'a>, execution: &W, ) -> Result<Self::RawState, Self::Error>

Starts the raw challenge with the original signature and effective key.

Source

fn update_raw<W: Work>( &self, state: &mut Self::RawState, bytes: &[u8], execution: &W, ) -> Result<(), Self::Error>

Admits and processes original raw message chunks, never digest bytes.

Source

fn finish_raw<W: Work>( &self, state: Self::RawState, execution: &W, ) -> Result<SignatureAnswer, Self::Error>

Completes a raw signature only after successful complete source EOF.

Source

fn verify_prehashed<W: Work>( &'a self, identity: &Self::SignatureIdentity, key: WorkingKey<'a>, signature: &Octets<'a>, digest: Prehash<'_, '_, Self, Self::Identity>, execution: &W, ) -> Result<SignatureAnswer, Self::Error>

Verifies one borrowed finalized digest with its full identity; no rehash.

Dyn Compatibility§

This trait is not dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors§