Skip to main content

SignatureProvider

structured_cms::provider

Trait SignatureProvider 

Source 
pub trait SignatureProvider<'a>: AsnDigest<'a> + Sized {
    type SignatureIdentity;
    type RawState;

    // Required methods
    fn resolve_signature(
        &'a self,
        identifier: AlgorithmIdentifier<'a>,
        digest: &Self::Identity,
        key: WorkingKey<'a>,
        encoding: Encoding,
        parent: &Reader<'a>,
    ) -> Result<Resolution<SignatureMode<Self::SignatureIdentity>>, Self::Error>;
    fn compare_signature<W: Work>(
        &self,
        left: &Self::SignatureIdentity,
        right: &Self::SignatureIdentity,
        execution: &W,
    ) -> Result<Ordering, Self::Error>;
    fn start_raw<W: Work>(
        &'a self,
        identity: &Self::SignatureIdentity,
        key: WorkingKey<'a>,
        signature: &'a Octets<'a>,
        execution: &W,
    ) -> Result<Self::RawState, Self::Error>;
    fn update_raw<W: Work>(
        &self,
        state: &mut Self::RawState,
        bytes: &[u8],
        execution: &W,
    ) -> Result<(), Self::Error>;
    fn finish_raw<W: Work>(
        &self,
        state: Self::RawState,
        execution: &W,
    ) -> Result<SignatureAnswer, Self::Error>;
    fn verify_prehashed<W: Work>(
        &'a self,
        identity: &Self::SignatureIdentity,
        key: WorkingKey<'a>,
        signature: &Octets<'a>,
        digest: Prehash<'_, '_, Self, Self::Identity>,
        execution: &W,
    ) -> Result<SignatureAnswer, Self::Error>;

    // Provided method
    fn resolve_signature_digest(
        &'a self,
        identifier: AlgorithmIdentifier<'a>,
        _key: WorkingKey<'a>,
        parent: &Reader<'a>,
    ) -> Result<Resolution<Self::Identity>, SignatureDigestError<Self::Error>> { ... }
}
Expand description

Signature operations that stay bound to the same selected provider and key.

Digest execution and identities come from the provider’s structured_asn1::digest::Digest and AsnDigest implementations; CMS payload message-digest, ESS certificate hashes and TSP imprints all run through them with their distinct original covered inputs.

The effective key retains its original SPKI and inherited parameters. Resolution validates key/algorithm compatibility before raw initialization or payload I/O. A contiguous-only backend may explicitly buffer with full admission in its adapter, or report unsupported; it cannot downgrade raw.

Common processing borrows a stable nonzero-sized selection owner. Ordinary adapters containing engine/context references already satisfy this. Wrap a zero-sized stateless adapter in ProviderSession before using common processing; otherwise it returns a processing ProviderMismatch before dispatch. Distinct ZST addresses cannot supply instance provenance.

Required Associated Types§

Source

type SignatureIdentity

Fully resolved signature identity, including algorithm-specific defaults.

Source

type RawState

Raw verification state, initialized with original signature/key first.

Required Methods§

Source

fn resolve_signature( &'a self, identifier: AlgorithmIdentifier<'a>, digest: &Self::Identity, key: WorkingKey<'a>, encoding: Encoding, parent: &Reader<'a>, ) -> Result<Resolution<SignatureMode<Self::SignatureIdentity>>, Self::Error>

Chooses raw versus prehashed only after complete algorithm/key resolution.

Source

fn compare_signature<W: Work>( &self, left: &Self::SignatureIdentity, right: &Self::SignatureIdentity, execution: &W, ) -> Result<Ordering, Self::Error>

Semantic signature/default comparison for protected versus outer identifiers.

Source

fn start_raw<W: Work>( &'a self, identity: &Self::SignatureIdentity, key: WorkingKey<'a>, signature: &'a Octets<'a>, execution: &W, ) -> Result<Self::RawState, Self::Error>

Starts the raw challenge with the original signature and effective key.

Source

fn update_raw<W: Work>( &self, state: &mut Self::RawState, bytes: &[u8], execution: &W, ) -> Result<(), Self::Error>

Admits and processes original raw message chunks, never digest bytes.

Source

fn finish_raw<W: Work>( &self, state: Self::RawState, execution: &W, ) -> Result<SignatureAnswer, Self::Error>

Completes a raw signature only after successful complete source EOF.

Source

fn verify_prehashed<W: Work>( &'a self, identity: &Self::SignatureIdentity, key: WorkingKey<'a>, signature: &Octets<'a>, digest: Prehash<'_, '_, Self, Self::Identity>, execution: &W, ) -> Result<SignatureAnswer, Self::Error>

Verifies one borrowed finalized digest with its full identity; no rehash.

Provided Methods§

Source

fn resolve_signature_digest( &'a self, identifier: AlgorithmIdentifier<'a>, _key: WorkingKey<'a>, parent: &Reader<'a>, ) -> Result<Resolution<Self::Identity>, SignatureDigestError<Self::Error>>

Resolves the original digest against this signature’s effective key.

Key-dependent hashes, such as GOST with the signing key’s actual DKE, must return that complete immutable identity before digest execution. Both outer and protected declarations use the same hook and key. Different identities may share this provider and one content fan-out pass. The default preserves key-independent ASN digest resolution; it does not select any key-dependent parameter or substitute an unknown DKE.

Dyn Compatibility§

This trait is not dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors§