Function with_algorithm 

pub fn with_algorithm<'a, W: Work, R>(
    identifier: AlgorithmIdentifier<'a>,
    execution: &W,
    visitor: impl for<'parameters> FnOnce(Option<Algorithm<'a, 'parameters>>) -> R,
) -> Result<R>

Visits a retained signature structure under original and current work.

RSA SHA-224/256/384/512 accepts absent or primitive NULL on reception (RFC4055 §5). Recognized RSA SHA-1, SHA-512/224, SHA-512/256 and SHA3 require NULL (RFC3279 §2.2.1, RFC8017 A.2.4, RFC9688 §3.1). DSA SHA-1/224/256, ECDSA SHA-1/SHA-2/SHA3 and pure Ed25519/Ed448 require absent parameters (RFC3279 §2.2, RFC5758 §3, RFC9688 §3.2, RFC8410 §6). BER NULL spellings are validated by the original reader; bytes are never compared to fabricated DER. ML-DSA-44/65/87 also require absent parameters (RFC9881 §2); the PKIX provider must use pure mode and an empty context (RFC9881 §3).

PSS signature parameters must be present (RFC4055 §3.1), unlike optional key restrictions. The existing strict PSS kernel preserves independent message/MGF hashes, wide salt/trailer fields and original ranges/depth; DER written DEFAULTs remain errors. Use pss::inspect for readable PSS diagnostics. Backend support, PSS compatibility, key strength, policy and signature math remain separate. A known structure does not promise that its provider implements it or accepts its parameters.

Visits None for identifiers outside the module’s documented recognized set. Both original parser and current operation ceilings apply before any OID scan; a fresh account cannot reset source limits. Fixed cases allocate nothing and need no cursor. PSS fields are borrowed only for the visit, keeping the enum small without allocating a wrapper. The returned R may borrow original document bytes, or explicitly copy PSS fields, but cannot keep a reference to the temporary PSS descriptor. The visitor’s result, including a caller-specific Result, is returned unchanged inside the outer processing result. The visitor is not called on a processing error.

Errors

Located missing/invalid parameters or strict PSS errors; terminal resource errors remain distinct from unknown algorithms and malformed parameters.

Examples

use std::sync::Arc;
use structured_asn1::{Parser, memory::{Memory, MemoryAccount}};
use structured_pkix::algorithm::{self, digest, signature};
let source = Parser::der(Memory::new(Arc::new(MemoryAccount::new(4096, 4096))));
// ecdsa-with-SHA256, with parameters absent.
let bytes = b"\x30\x0a\x06\x08\x2a\x86\x48\xce\x3d\x04\x03\x02";
let mut reader = source.read(bytes, 400).unwrap();
let element = reader.next_element().unwrap().unwrap();
let identifier = algorithm::read(&reader, &element, "signatureAlgorithm")?;
let current = Memory::new(Arc::new(MemoryAccount::new(0, 4096)));
let recognized = signature::with_algorithm(identifier, &current, |algorithm|
    matches!(algorithm, Some(signature::Algorithm::Ecdsa(digest::Algorithm::Sha256))))?;
assert!(recognized);

A reference to the temporary PSS descriptor cannot escape:

use structured_pkix::algorithm::{AlgorithmIdentifier, pss, signature};
use structured_asn1::memory::Memory;
fn escape<'a>(id: AlgorithmIdentifier<'a>, work: &Memory)
    -> structured_pkix::Result<&'a pss::Parameters<'a>> {
    signature::with_algorithm(id, work, |algorithm| match algorithm {
        Some(signature::Algorithm::RsaPss(parameters)) => parameters,
        _ => panic!("PSS expected"),
    })
}