Crate tink_ffi_sys 

Raw FFI bindings to Google Tink via a C shim, built against tink-cc v2.5.0.

This crate provides low-level extern "C" functions that map directly to the C shim built on top of tink-cc. Most users should prefer the safe tink_ffi crate, which wraps these bindings in idiomatic Rust with automatic memory management.

Conventions

• All functions return c_int where 0 means success and non-zero means error.
• On error, a thread-local message is set and can be retrieved with tink_error_message.
• Pointers returned by these functions are allocated on the C++ side. The caller must free them with tink_free_bytes (for *mut u8 + length) or tink_free_string (for *mut c_char).
• Opaque handle types (e.g. TinkAead) must be freed with their corresponding _free function.

Build

This crate builds tink-cc from source via CMake. You need CMake 3.13+ and a C++17 compiler.

Structs

TinkAead

Opaque handle to a Tink AEAD primitive. See Aead in tink-ffi for the safe wrapper.

TinkDecryptingStream

Opaque handle to an in-progress decrypting stream.

TinkDeterministicAead

Opaque handle to a Tink deterministic AEAD primitive. See DeterministicAead in tink-ffi for the safe wrapper.

TinkEncryptingStream

Opaque handle to an in-progress encrypting stream.

TinkHybridDecrypt

Opaque handle to a Tink hybrid decryption primitive. See HybridDecrypt in tink-ffi for the safe wrapper.

TinkHybridEncrypt

Opaque handle to a Tink hybrid encryption primitive. See HybridEncrypt in tink-ffi for the safe wrapper.

TinkJwtMac

Opaque handle to a Tink JWT MAC primitive. See JwtMac in tink-ffi for the safe wrapper.

TinkJwtSigner

Opaque handle to a Tink JWT signer. See JwtSign in tink-ffi for the safe wrapper.

TinkJwtVerifier

Opaque handle to a Tink JWT verifier. See JwtVerify in tink-ffi for the safe wrapper.

TinkKeysetDeriver

Opaque handle to a Tink keyset deriver. See KeysetDeriver in tink-ffi for the safe wrapper.

TinkKeysetHandle

Opaque handle to a Tink keyset. See KeysetHandle in tink-ffi for the safe wrapper.

TinkMac

Opaque handle to a Tink MAC primitive. See Mac in tink-ffi for the safe wrapper.

TinkPrfSet

Opaque handle to a Tink PRF set. See PrfSet in tink-ffi for the safe wrapper.

TinkSigner

Opaque handle to a Tink public-key signer. See Signer in tink-ffi for the safe wrapper.

TinkStreamingAead

Opaque handle to a Tink streaming AEAD primitive. See StreamingAead in tink-ffi for the safe wrapper.

TinkVerifier

Opaque handle to a Tink public-key verifier. See Verifier in tink-ffi for the safe wrapper.

Functions

tink_aead_decrypt^⚠

Decrypt ciphertext with associated data. Caller must free plaintext with tink_free_bytes.

tink_aead_encrypt^⚠

Encrypt plaintext with associated data. Caller must free ciphertext with tink_free_bytes.

tink_aead_free^⚠

Free an AEAD handle.

tink_aead_new^⚠

Create a new AEAD primitive from a keyset handle.

tink_decrypting_stream_free^⚠

Free a decrypting stream handle.

tink_decrypting_stream_read^⚠

Read decrypted plaintext from a decrypting stream into a buffer. Returns bytes read.

tink_deterministic_aead_decrypt^⚠

Decrypt deterministically-encrypted ciphertext. Caller must free plaintext with tink_free_bytes.

tink_deterministic_aead_encrypt^⚠

Deterministically encrypt plaintext with associated data. Caller must free ciphertext with tink_free_bytes.

tink_deterministic_aead_free^⚠

Free a deterministic AEAD handle.

tink_deterministic_aead_new^⚠

Create a new deterministic AEAD primitive from a keyset handle.

tink_encrypting_stream_finalize^⚠

Finalize an encrypting stream and retrieve the full ciphertext. Caller must free with tink_free_bytes.

tink_encrypting_stream_free^⚠

Free an encrypting stream handle.

tink_encrypting_stream_write^⚠

Write plaintext data to an encrypting stream. Returns bytes written.

tink_error_message^⚠

Return the thread-local error message from the last failed operation, or null if none.

tink_free_bytes^⚠

Free a byte buffer allocated by the C shim.

tink_free_string^⚠

Free a C string allocated by the C shim.

tink_hybrid_decrypt^⚠

Hybrid-decrypt ciphertext with context info. Caller must free plaintext with tink_free_bytes.

tink_hybrid_decrypt_free^⚠

Free a hybrid decrypt handle.

tink_hybrid_decrypt_new^⚠

Create a new hybrid decryption primitive from a keyset handle containing a private key.

tink_hybrid_encrypt^⚠

Hybrid-encrypt plaintext with context info. Caller must free ciphertext with tink_free_bytes.

tink_hybrid_encrypt_free^⚠

Free a hybrid encrypt handle.

tink_hybrid_encrypt_new^⚠

Create a new hybrid encryption primitive from a keyset handle containing a public key.

tink_jwt_mac_compute_and_encode^⚠

Compute and encode a JWT MAC. Caller must free the compact token with tink_free_string.

tink_jwt_mac_free^⚠

Free a JWT MAC handle.

tink_jwt_mac_new^⚠

Create a new JWT MAC primitive from a keyset handle.

tink_jwt_mac_verify_and_decode^⚠

Verify and decode a compact JWT token. Caller must free the claims JSON with tink_free_string.

tink_jwt_signer_free^⚠

Free a JWT signer handle.

tink_jwt_signer_new^⚠

Create a new JWT signer from a keyset handle containing a private key.

tink_jwt_signer_sign_and_encode^⚠

Sign and encode a JWT. Caller must free the compact token with tink_free_string.

tink_jwt_verifier_free^⚠

Free a JWT verifier handle.

tink_jwt_verifier_new^⚠

Create a new JWT verifier from a keyset handle containing a public key.

tink_jwt_verifier_verify_and_decode^⚠

Verify and decode a compact JWT token. Caller must free the claims JSON with tink_free_string.

tink_key_template_serialize^⚠

Serialize a named key template to its protobuf bytes. Caller must free with tink_free_bytes.

tink_keyset_deriver_derive^⚠

Derive a new keyset handle from a salt. The caller owns the returned handle.

tink_keyset_deriver_free^⚠

Free a keyset deriver handle.

tink_keyset_deriver_new^⚠

Create a new keyset deriver from a keyset handle.

tink_keyset_handle_free^⚠

Free a keyset handle.

tink_keyset_handle_from_binary^⚠

Deserialize a keyset handle from binary.

tink_keyset_handle_from_json^⚠

Deserialize a keyset handle from a JSON string.

tink_keyset_handle_generate_from_template_bytes^⚠

Generate a new keyset from raw serialized key-template bytes.

tink_keyset_handle_generate_new^⚠

Generate a new keyset for the named key template.

tink_keyset_handle_info^⚠

Return keyset metadata as a JSON string. Caller must free with tink_free_string.

tink_keyset_handle_public^⚠

Extract the public key portion of an asymmetric keyset.

tink_keyset_handle_read_encrypted^⚠

Decrypt and deserialize an encrypted keyset. The master keyset provides the AEAD key used for decryption.

tink_keyset_handle_to_binary^⚠

Serialize a keyset handle to binary. Caller must free with tink_free_bytes.

tink_keyset_handle_to_json^⚠

Serialize a keyset handle to JSON. Caller must free the string with tink_free_string.

tink_keyset_handle_write_encrypted^⚠

Serialize and encrypt a keyset. Caller must free the output with tink_free_bytes.

tink_mac_compute^⚠

Compute a MAC tag over data. Caller must free the tag with tink_free_bytes.

tink_mac_free^⚠

Free a MAC handle.

tink_mac_new^⚠

Create a new MAC primitive from a keyset handle.

tink_mac_verify^⚠

Verify a MAC tag against data.

tink_prf_set_compute^⚠

Compute a specific PRF by key ID over input. Caller must free output with tink_free_bytes.

tink_prf_set_compute_primary^⚠

Compute the primary PRF over input. Caller must free output with tink_free_bytes.

tink_prf_set_free^⚠

Free a PRF set handle.

tink_prf_set_key_ids^⚠

Get the key IDs of all PRFs in the set. Caller must free with tink_free_bytes.

tink_prf_set_new^⚠

Create a new PRF set from a keyset handle.

tink_prf_set_primary_id^⚠

Get the key ID of the primary PRF in the set.

tink_register_all^⚠

Register all Tink primitive factories (AEAD, MAC, signatures, hybrid, JWT, PRF, etc.).

tink_signer_free^⚠

Free a signer handle.

tink_signer_new^⚠

Create a new public-key signer from a keyset handle containing a private key.

tink_signer_sign^⚠

Sign data. Caller must free the signature with tink_free_bytes.

tink_streaming_aead_decrypt_start^⚠

Begin a streaming decryption of the given ciphertext with associated data.

tink_streaming_aead_encrypt_start^⚠

Begin a streaming encryption with the given associated data.

tink_streaming_aead_free^⚠

Free a streaming AEAD handle.

tink_streaming_aead_new^⚠

Create a new streaming AEAD primitive from a keyset handle.

tink_verifier_free^⚠

Free a verifier handle.

tink_verifier_new^⚠

Create a new public-key verifier from a keyset handle containing a public key.

tink_verifier_verify^⚠

Verify a signature over data.