tink_ffi_sys/lib.rs
1# via a C shim,
2built against [tink-cc v2.5.0](https://github.com/tink-crypto/tink-cc/releases/tag/v2.5.0).
3
4This crate provides low-level `extern \"C\"` functions that map directly to the
5C shim built on top of tink-cc. **Most users should prefer the safe
6[`tink_ffi`](https://docs.rs/tink-ffi/latest/tink_ffi/) crate**, which wraps these bindings in idiomatic Rust with
7automatic memory management.
8
9# Conventions
10
11- All functions return `c_int` where `0` means success and non-zero means error.
12- On error, a thread-local message is set and can be retrieved with
13 [`tink_error_message`].
14- Pointers returned by these functions are allocated on the C++ side. The caller
15 **must** free them with [`tink_free_bytes`] (for `*mut u8` + length) or
16 [`tink_free_string`] (for `*mut c_char`).
17- Opaque handle types (e.g. [`TinkAead`]) must be freed with their corresponding
18 `_free` function.
19
20# Build
21
22This crate builds tink-cc from source via CMake. You need CMake 3.13+ and a
23C++17 compiler."]
24// Copyright 2026 Adam Winstanley
25//
26// Licensed under the Apache License, Version 2.0 (the "License");
27// you may not use this file except in compliance with the License.
28// You may obtain a copy of the License at
29//
30// http://www.apache.org/licenses/LICENSE-2.0
31//
32// Unless required by applicable law or agreed to in writing, software
33// distributed under the License is distributed on an "AS IS" BASIS,
34// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
35// See the License for the specific language governing permissions and
36// limitations under the License.
37#![allow(non_camel_case_types)]
38
39use std::os::raw::{c_char, c_int};
40
41// ---------------------------------------------------------------------------
42// Opaque handle types
43// ---------------------------------------------------------------------------
44
45/// Opaque handle to a Tink keyset. See [`KeysetHandle`](https://docs.rs/tink-ffi/latest/tink_ffi/struct.KeysetHandle.html) in `tink-ffi` for the safe wrapper.
46#[repr(C)]
47pub struct TinkKeysetHandle {
48 _private: [u8; 0],
49}
50
51/// Opaque handle to a Tink AEAD primitive. See [`Aead`](https://docs.rs/tink-ffi/latest/tink_ffi/trait.Aead.html) in `tink-ffi` for the safe wrapper.
52#[repr(C)]
53pub struct TinkAead {
54 _private: [u8; 0],
55}
56
57/// Opaque handle to a Tink deterministic AEAD primitive. See [`DeterministicAead`](https://docs.rs/tink-ffi/latest/tink_ffi/trait.DeterministicAead.html) in `tink-ffi` for the safe wrapper.
58#[repr(C)]
59pub struct TinkDeterministicAead {
60 _private: [u8; 0],
61}
62
63/// Opaque handle to a Tink MAC primitive. See [`Mac`](https://docs.rs/tink-ffi/latest/tink_ffi/trait.Mac.html) in `tink-ffi` for the safe wrapper.
64#[repr(C)]
65pub struct TinkMac {
66 _private: [u8; 0],
67}
68
69/// Opaque handle to a Tink public-key signer. See [`Signer`](https://docs.rs/tink-ffi/latest/tink_ffi/trait.Signer.html) in `tink-ffi` for the safe wrapper.
70#[repr(C)]
71pub struct TinkSigner {
72 _private: [u8; 0],
73}
74
75/// Opaque handle to a Tink public-key verifier. See [`Verifier`](https://docs.rs/tink-ffi/latest/tink_ffi/trait.Verifier.html) in `tink-ffi` for the safe wrapper.
76#[repr(C)]
77pub struct TinkVerifier {
78 _private: [u8; 0],
79}
80
81/// Opaque handle to a Tink hybrid encryption primitive. See [`HybridEncrypt`](https://docs.rs/tink-ffi/latest/tink_ffi/trait.HybridEncrypt.html) in `tink-ffi` for the safe wrapper.
82#[repr(C)]
83pub struct TinkHybridEncrypt {
84 _private: [u8; 0],
85}
86
87/// Opaque handle to a Tink hybrid decryption primitive. See [`HybridDecrypt`](https://docs.rs/tink-ffi/latest/tink_ffi/trait.HybridDecrypt.html) in `tink-ffi` for the safe wrapper.
88#[repr(C)]
89pub struct TinkHybridDecrypt {
90 _private: [u8; 0],
91}
92
93/// Opaque handle to a Tink streaming AEAD primitive. See [`StreamingAead`](https://docs.rs/tink-ffi/latest/tink_ffi/trait.StreamingAead.html) in `tink-ffi` for the safe wrapper.
94#[repr(C)]
95pub struct TinkStreamingAead {
96 _private: [u8; 0],
97}
98
99/// Opaque handle to an in-progress encrypting stream.
100#[repr(C)]
101pub struct TinkEncryptingStream {
102 _private: [u8; 0],
103}
104
105/// Opaque handle to an in-progress decrypting stream.
106#[repr(C)]
107pub struct TinkDecryptingStream {
108 _private: [u8; 0],
109}
110
111/// Opaque handle to a Tink JWT MAC primitive. See [`JwtMac`](https://docs.rs/tink-ffi/latest/tink_ffi/trait.JwtMac.html) in `tink-ffi` for the safe wrapper.
112#[repr(C)]
113pub struct TinkJwtMac {
114 _private: [u8; 0],
115}
116
117/// Opaque handle to a Tink JWT signer. See [`JwtSign`](https://docs.rs/tink-ffi/latest/tink_ffi/trait.JwtSign.html) in `tink-ffi` for the safe wrapper.
118#[repr(C)]
119pub struct TinkJwtSigner {
120 _private: [u8; 0],
121}
122
123/// Opaque handle to a Tink JWT verifier. See [`JwtVerify`](https://docs.rs/tink-ffi/latest/tink_ffi/trait.JwtVerify.html) in `tink-ffi` for the safe wrapper.
124#[repr(C)]
125pub struct TinkJwtVerifier {
126 _private: [u8; 0],
127}
128
129/// Opaque handle to a Tink PRF set. See [`PrfSet`](https://docs.rs/tink-ffi/latest/tink_ffi/trait.PrfSet.html) in `tink-ffi` for the safe wrapper.
130#[repr(C)]
131pub struct TinkPrfSet {
132 _private: [u8; 0],
133}
134
135/// Opaque handle to a Tink keyset deriver. See [`KeysetDeriver`](https://docs.rs/tink-ffi/latest/tink_ffi/trait.KeysetDeriver.html) in `tink-ffi` for the safe wrapper.
136#[repr(C)]
137pub struct TinkKeysetDeriver {
138 _private: [u8; 0],
139}
140
141extern "C" {
142 // -----------------------------------------------------------------------
143 // Error handling
144 // -----------------------------------------------------------------------
145
146 /// Return the thread-local error message from the last failed operation, or null if none.
147 pub fn tink_error_message() -> *const c_char;
148
149 // -----------------------------------------------------------------------
150 // Memory management
151 // -----------------------------------------------------------------------
152
153 /// Free a byte buffer allocated by the C shim.
154 pub fn tink_free_bytes(ptr: *mut u8, len: usize);
155
156 /// Free a C string allocated by the C shim.
157 pub fn tink_free_string(ptr: *mut c_char);
158
159 // -----------------------------------------------------------------------
160 // Configuration & Registration
161 // -----------------------------------------------------------------------
162
163 /// Register all Tink primitive factories (AEAD, MAC, signatures, hybrid, JWT, PRF, etc.).
164 pub fn tink_register_all() -> c_int;
165
166 // -----------------------------------------------------------------------
167 // KeysetHandle
168 // -----------------------------------------------------------------------
169
170 /// Generate a new keyset for the named key template.
171 pub fn tink_keyset_handle_generate_new(
172 template_name: *const c_char,
173 handle_out: *mut *mut TinkKeysetHandle,
174 ) -> c_int;
175
176 /// Serialize a keyset handle to JSON. Caller must free the string with [`tink_free_string`].
177 pub fn tink_keyset_handle_to_json(
178 handle: *const TinkKeysetHandle,
179 json_out: *mut *mut c_char,
180 ) -> c_int;
181
182 /// Deserialize a keyset handle from a JSON string.
183 pub fn tink_keyset_handle_from_json(
184 json: *const c_char,
185 handle_out: *mut *mut TinkKeysetHandle,
186 ) -> c_int;
187
188 /// Serialize a keyset handle to binary. Caller must free with [`tink_free_bytes`].
189 pub fn tink_keyset_handle_to_binary(
190 handle: *const TinkKeysetHandle,
191 data_out: *mut *mut u8,
192 data_len_out: *mut usize,
193 ) -> c_int;
194
195 /// Deserialize a keyset handle from binary.
196 pub fn tink_keyset_handle_from_binary(
197 data: *const u8,
198 data_len: usize,
199 handle_out: *mut *mut TinkKeysetHandle,
200 ) -> c_int;
201
202 /// Extract the public key portion of an asymmetric keyset.
203 pub fn tink_keyset_handle_public(
204 handle: *const TinkKeysetHandle,
205 public_out: *mut *mut TinkKeysetHandle,
206 ) -> c_int;
207
208 /// Return keyset metadata as a JSON string. Caller must free with [`tink_free_string`].
209 pub fn tink_keyset_handle_info(
210 handle: *const TinkKeysetHandle,
211 info_out: *mut *mut c_char,
212 ) -> c_int;
213
214 /// Serialize a named key template to its protobuf bytes. Caller must free with [`tink_free_bytes`].
215 pub fn tink_key_template_serialize(
216 template_name: *const c_char,
217 bytes_out: *mut *mut u8,
218 len_out: *mut usize,
219 ) -> c_int;
220
221 /// Generate a new keyset from raw serialized key-template bytes.
222 pub fn tink_keyset_handle_generate_from_template_bytes(
223 template_bytes: *const u8,
224 template_len: usize,
225 handle_out: *mut *mut TinkKeysetHandle,
226 ) -> c_int;
227
228 /// Decrypt and deserialize an encrypted keyset. The master keyset provides the AEAD key used for decryption.
229 pub fn tink_keyset_handle_read_encrypted(
230 encrypted: *const u8,
231 encrypted_len: usize,
232 master_keyset: *const u8,
233 master_len: usize,
234 associated_data: *const u8,
235 ad_len: usize,
236 handle_out: *mut *mut TinkKeysetHandle,
237 ) -> c_int;
238
239 /// Serialize and encrypt a keyset. Caller must free the output with [`tink_free_bytes`].
240 pub fn tink_keyset_handle_write_encrypted(
241 handle: *const TinkKeysetHandle,
242 master_keyset: *const u8,
243 master_len: usize,
244 associated_data: *const u8,
245 ad_len: usize,
246 out: *mut *mut u8,
247 out_len: *mut usize,
248 ) -> c_int;
249
250 /// Free a keyset handle.
251 pub fn tink_keyset_handle_free(handle: *mut TinkKeysetHandle);
252
253 // -----------------------------------------------------------------------
254 // AEAD
255 // -----------------------------------------------------------------------
256
257 /// Create a new AEAD primitive from a keyset handle.
258 pub fn tink_aead_new(handle: *const TinkKeysetHandle, aead_out: *mut *mut TinkAead) -> c_int;
259
260 /// Encrypt plaintext with associated data. Caller must free ciphertext with [`tink_free_bytes`].
261 pub fn tink_aead_encrypt(
262 aead: *const TinkAead,
263 plaintext: *const u8,
264 plaintext_len: usize,
265 aad: *const u8,
266 aad_len: usize,
267 ciphertext_out: *mut *mut u8,
268 ciphertext_len_out: *mut usize,
269 ) -> c_int;
270
271 /// Decrypt ciphertext with associated data. Caller must free plaintext with [`tink_free_bytes`].
272 pub fn tink_aead_decrypt(
273 aead: *const TinkAead,
274 ciphertext: *const u8,
275 ciphertext_len: usize,
276 aad: *const u8,
277 aad_len: usize,
278 plaintext_out: *mut *mut u8,
279 plaintext_len_out: *mut usize,
280 ) -> c_int;
281
282 /// Free an AEAD handle.
283 pub fn tink_aead_free(aead: *mut TinkAead);
284
285 // -----------------------------------------------------------------------
286 // Deterministic AEAD
287 // -----------------------------------------------------------------------
288
289 /// Create a new deterministic AEAD primitive from a keyset handle.
290 pub fn tink_deterministic_aead_new(
291 handle: *const TinkKeysetHandle,
292 daead_out: *mut *mut TinkDeterministicAead,
293 ) -> c_int;
294
295 /// Deterministically encrypt plaintext with associated data. Caller must free ciphertext with [`tink_free_bytes`].
296 pub fn tink_deterministic_aead_encrypt(
297 daead: *const TinkDeterministicAead,
298 plaintext: *const u8,
299 plaintext_len: usize,
300 aad: *const u8,
301 aad_len: usize,
302 ciphertext_out: *mut *mut u8,
303 ciphertext_len_out: *mut usize,
304 ) -> c_int;
305
306 /// Decrypt deterministically-encrypted ciphertext. Caller must free plaintext with [`tink_free_bytes`].
307 pub fn tink_deterministic_aead_decrypt(
308 daead: *const TinkDeterministicAead,
309 ciphertext: *const u8,
310 ciphertext_len: usize,
311 aad: *const u8,
312 aad_len: usize,
313 plaintext_out: *mut *mut u8,
314 plaintext_len_out: *mut usize,
315 ) -> c_int;
316
317 /// Free a deterministic AEAD handle.
318 pub fn tink_deterministic_aead_free(daead: *mut TinkDeterministicAead);
319
320 // -----------------------------------------------------------------------
321 // MAC
322 // -----------------------------------------------------------------------
323
324 /// Create a new MAC primitive from a keyset handle.
325 pub fn tink_mac_new(handle: *const TinkKeysetHandle, mac_out: *mut *mut TinkMac) -> c_int;
326
327 /// Compute a MAC tag over data. Caller must free the tag with [`tink_free_bytes`].
328 pub fn tink_mac_compute(
329 mac: *const TinkMac,
330 data: *const u8,
331 data_len: usize,
332 mac_out: *mut *mut u8,
333 mac_len_out: *mut usize,
334 ) -> c_int;
335
336 /// Verify a MAC tag against data.
337 pub fn tink_mac_verify(
338 mac: *const TinkMac,
339 mac_value: *const u8,
340 mac_value_len: usize,
341 data: *const u8,
342 data_len: usize,
343 ) -> c_int;
344
345 /// Free a MAC handle.
346 pub fn tink_mac_free(mac: *mut TinkMac);
347
348 // -----------------------------------------------------------------------
349 // Digital Signatures
350 // -----------------------------------------------------------------------
351
352 /// Create a new public-key signer from a keyset handle containing a private key.
353 pub fn tink_signer_new(
354 handle: *const TinkKeysetHandle,
355 signer_out: *mut *mut TinkSigner,
356 ) -> c_int;
357
358 /// Sign data. Caller must free the signature with [`tink_free_bytes`].
359 pub fn tink_signer_sign(
360 signer: *const TinkSigner,
361 data: *const u8,
362 data_len: usize,
363 signature_out: *mut *mut u8,
364 signature_len_out: *mut usize,
365 ) -> c_int;
366
367 /// Free a signer handle.
368 pub fn tink_signer_free(signer: *mut TinkSigner);
369
370 /// Create a new public-key verifier from a keyset handle containing a public key.
371 pub fn tink_verifier_new(
372 handle: *const TinkKeysetHandle,
373 verifier_out: *mut *mut TinkVerifier,
374 ) -> c_int;
375
376 /// Verify a signature over data.
377 pub fn tink_verifier_verify(
378 verifier: *const TinkVerifier,
379 signature: *const u8,
380 signature_len: usize,
381 data: *const u8,
382 data_len: usize,
383 ) -> c_int;
384
385 /// Free a verifier handle.
386 pub fn tink_verifier_free(verifier: *mut TinkVerifier);
387
388 // -----------------------------------------------------------------------
389 // Hybrid Encryption
390 // -----------------------------------------------------------------------
391
392 /// Create a new hybrid encryption primitive from a keyset handle containing a public key.
393 pub fn tink_hybrid_encrypt_new(
394 handle: *const TinkKeysetHandle,
395 enc_out: *mut *mut TinkHybridEncrypt,
396 ) -> c_int;
397
398 /// Hybrid-encrypt plaintext with context info. Caller must free ciphertext with [`tink_free_bytes`].
399 pub fn tink_hybrid_encrypt(
400 enc: *const TinkHybridEncrypt,
401 plaintext: *const u8,
402 plaintext_len: usize,
403 context_info: *const u8,
404 context_info_len: usize,
405 ciphertext_out: *mut *mut u8,
406 ciphertext_len_out: *mut usize,
407 ) -> c_int;
408
409 /// Free a hybrid encrypt handle.
410 pub fn tink_hybrid_encrypt_free(enc: *mut TinkHybridEncrypt);
411
412 /// Create a new hybrid decryption primitive from a keyset handle containing a private key.
413 pub fn tink_hybrid_decrypt_new(
414 handle: *const TinkKeysetHandle,
415 dec_out: *mut *mut TinkHybridDecrypt,
416 ) -> c_int;
417
418 /// Hybrid-decrypt ciphertext with context info. Caller must free plaintext with [`tink_free_bytes`].
419 pub fn tink_hybrid_decrypt(
420 dec: *const TinkHybridDecrypt,
421 ciphertext: *const u8,
422 ciphertext_len: usize,
423 context_info: *const u8,
424 context_info_len: usize,
425 plaintext_out: *mut *mut u8,
426 plaintext_len_out: *mut usize,
427 ) -> c_int;
428
429 /// Free a hybrid decrypt handle.
430 pub fn tink_hybrid_decrypt_free(dec: *mut TinkHybridDecrypt);
431
432 // -----------------------------------------------------------------------
433 // Streaming AEAD
434 // -----------------------------------------------------------------------
435
436 /// Create a new streaming AEAD primitive from a keyset handle.
437 pub fn tink_streaming_aead_new(
438 handle: *const TinkKeysetHandle,
439 saead_out: *mut *mut TinkStreamingAead,
440 ) -> c_int;
441
442 /// Begin a streaming encryption with the given associated data.
443 pub fn tink_streaming_aead_encrypt_start(
444 saead: *const TinkStreamingAead,
445 aad: *const u8,
446 aad_len: usize,
447 stream_out: *mut *mut TinkEncryptingStream,
448 ) -> c_int;
449
450 /// Write plaintext data to an encrypting stream. Returns bytes written.
451 pub fn tink_encrypting_stream_write(
452 stream: *mut TinkEncryptingStream,
453 data: *const u8,
454 data_len: usize,
455 written_out: *mut usize,
456 ) -> c_int;
457
458 /// Finalize an encrypting stream and retrieve the full ciphertext. Caller must free with [`tink_free_bytes`].
459 pub fn tink_encrypting_stream_finalize(
460 stream: *mut TinkEncryptingStream,
461 ciphertext_out: *mut *mut u8,
462 ciphertext_len_out: *mut usize,
463 ) -> c_int;
464
465 /// Free an encrypting stream handle.
466 pub fn tink_encrypting_stream_free(stream: *mut TinkEncryptingStream);
467
468 /// Begin a streaming decryption of the given ciphertext with associated data.
469 pub fn tink_streaming_aead_decrypt_start(
470 saead: *const TinkStreamingAead,
471 ciphertext: *const u8,
472 ciphertext_len: usize,
473 aad: *const u8,
474 aad_len: usize,
475 stream_out: *mut *mut TinkDecryptingStream,
476 ) -> c_int;
477
478 /// Read decrypted plaintext from a decrypting stream into a buffer. Returns bytes read.
479 pub fn tink_decrypting_stream_read(
480 stream: *mut TinkDecryptingStream,
481 buf: *mut u8,
482 buf_len: usize,
483 read_out: *mut usize,
484 ) -> c_int;
485
486 /// Free a decrypting stream handle.
487 pub fn tink_decrypting_stream_free(stream: *mut TinkDecryptingStream);
488
489 /// Free a streaming AEAD handle.
490 pub fn tink_streaming_aead_free(saead: *mut TinkStreamingAead);
491
492 // -----------------------------------------------------------------------
493 // JWT MAC
494 // -----------------------------------------------------------------------
495
496 /// Create a new JWT MAC primitive from a keyset handle.
497 pub fn tink_jwt_mac_new(
498 handle: *const TinkKeysetHandle,
499 jwt_mac_out: *mut *mut TinkJwtMac,
500 ) -> c_int;
501
502 /// Compute and encode a JWT MAC. Caller must free the compact token with [`tink_free_string`].
503 pub fn tink_jwt_mac_compute_and_encode(
504 jwt_mac: *const TinkJwtMac,
505 raw_jwt_json: *const c_char,
506 compact_out: *mut *mut c_char,
507 ) -> c_int;
508
509 /// Verify and decode a compact JWT token. Caller must free the claims JSON with [`tink_free_string`].
510 pub fn tink_jwt_mac_verify_and_decode(
511 jwt_mac: *const TinkJwtMac,
512 compact: *const c_char,
513 validator_json: *const c_char,
514 claims_json_out: *mut *mut c_char,
515 ) -> c_int;
516
517 /// Free a JWT MAC handle.
518 pub fn tink_jwt_mac_free(jwt_mac: *mut TinkJwtMac);
519
520 // -----------------------------------------------------------------------
521 // JWT Public Key Sign / Verify
522 // -----------------------------------------------------------------------
523
524 /// Create a new JWT signer from a keyset handle containing a private key.
525 pub fn tink_jwt_signer_new(
526 handle: *const TinkKeysetHandle,
527 signer_out: *mut *mut TinkJwtSigner,
528 ) -> c_int;
529
530 /// Sign and encode a JWT. Caller must free the compact token with [`tink_free_string`].
531 pub fn tink_jwt_signer_sign_and_encode(
532 signer: *const TinkJwtSigner,
533 raw_jwt_json: *const c_char,
534 compact_out: *mut *mut c_char,
535 ) -> c_int;
536
537 /// Free a JWT signer handle.
538 pub fn tink_jwt_signer_free(signer: *mut TinkJwtSigner);
539
540 /// Create a new JWT verifier from a keyset handle containing a public key.
541 pub fn tink_jwt_verifier_new(
542 handle: *const TinkKeysetHandle,
543 verifier_out: *mut *mut TinkJwtVerifier,
544 ) -> c_int;
545
546 /// Verify and decode a compact JWT token. Caller must free the claims JSON with [`tink_free_string`].
547 pub fn tink_jwt_verifier_verify_and_decode(
548 verifier: *const TinkJwtVerifier,
549 compact: *const c_char,
550 validator_json: *const c_char,
551 claims_json_out: *mut *mut c_char,
552 ) -> c_int;
553
554 /// Free a JWT verifier handle.
555 pub fn tink_jwt_verifier_free(verifier: *mut TinkJwtVerifier);
556
557 // -----------------------------------------------------------------------
558 // PRF Set
559 // -----------------------------------------------------------------------
560
561 /// Create a new PRF set from a keyset handle.
562 pub fn tink_prf_set_new(
563 handle: *const TinkKeysetHandle,
564 prf_set_out: *mut *mut TinkPrfSet,
565 ) -> c_int;
566
567 /// Get the key ID of the primary PRF in the set.
568 pub fn tink_prf_set_primary_id(prf_set: *const TinkPrfSet, id_out: *mut u32) -> c_int;
569
570 /// Compute the primary PRF over input. Caller must free output with [`tink_free_bytes`].
571 pub fn tink_prf_set_compute_primary(
572 prf_set: *const TinkPrfSet,
573 input: *const u8,
574 input_len: usize,
575 output_len: usize,
576 output_out: *mut *mut u8,
577 output_len_out: *mut usize,
578 ) -> c_int;
579
580 /// Get the key IDs of all PRFs in the set. Caller must free with [`tink_free_bytes`].
581 pub fn tink_prf_set_key_ids(
582 prf_set: *const TinkPrfSet,
583 key_ids_out: *mut *mut u32,
584 num_keys_out: *mut usize,
585 ) -> c_int;
586
587 /// Compute a specific PRF by key ID over input. Caller must free output with [`tink_free_bytes`].
588 pub fn tink_prf_set_compute(
589 prf_set: *const TinkPrfSet,
590 key_id: u32,
591 input: *const u8,
592 input_len: usize,
593 output_len: usize,
594 output_out: *mut *mut u8,
595 output_len_out: *mut usize,
596 ) -> c_int;
597
598 /// Free a PRF set handle.
599 pub fn tink_prf_set_free(prf_set: *mut TinkPrfSet);
600
601 // -----------------------------------------------------------------------
602 // Keyset Derivation
603 // -----------------------------------------------------------------------
604
605 /// Create a new keyset deriver from a keyset handle.
606 pub fn tink_keyset_deriver_new(
607 handle: *const TinkKeysetHandle,
608 deriver_out: *mut *mut TinkKeysetDeriver,
609 ) -> c_int;
610
611 /// Derive a new keyset handle from a salt. The caller owns the returned handle.
612 pub fn tink_keyset_deriver_derive(
613 deriver: *const TinkKeysetDeriver,
614 salt: *const u8,
615 salt_len: usize,
616 derived_handle_out: *mut *mut TinkKeysetHandle,
617 ) -> c_int;
618
619 /// Free a keyset deriver handle.
620 pub fn tink_keyset_deriver_free(deriver: *mut TinkKeysetDeriver);
621}