Module policy 

Immutable security policy snapshots shared by XML Security operations.

Policy contains trusted, reusable decisions. Caller-owned keys, selected document targets, tenant identity, and external resource bytes remain in operation request contexts and are deliberately not stored here.

Structs

DecryptionPolicy

Immutable policy snapshot for XMLEnc decryption.

DsaKeyPolicy

DSA strength requirements for legacy signature verification.

EncryptionPolicy

Immutable policy snapshot for XMLEnc encryption.

HmacPolicy

HMAC key-strength and truncation requirements shared by signing and verification.

KeyEstablishmentPolicy

Immutable permission and limits shared by encryption and decryption.

KeySourcePolicy

KeyInfo sources an XMLDSig verification operation is permitted to trust.

KeyTrustPolicy

X.509 and key-resolution decisions for verification.

ResourcePolicy

Resource ceilings shared by parsing, transforms, and cryptographic output.

RsaKeyPolicy

RSA strength and structural requirements for cryptographic operations.

SigningPolicy

Immutable policy snapshot for XMLDSig signing.

TransformPolicy

XMLDSig transform and canonicalization decisions shared by signing and verification.

UriPolicy

URI-class decisions shared by XMLDSig reference and key retrieval processing.

VerificationPolicy

Immutable policy snapshot for XMLDSig verification.

XmlInputPolicy

XML parsing decisions shared by all operation policies.

Enums

CertificateSignatureAlgorithms

Explicit certificate/CRL permissions, independent of XML signature methods.

EcdsaSignatureValueEncoding

Wire representation used for ECDSA SignatureValue bytes.

ExtendedKeyPurpose

An RFC 5280 extended-key-purpose identifier accepted for XML signing.

KemContentAuthentication

Authentication boundary for content encrypted directly with a KEM secret.

KeyAgreementAlgorithm

Agreement mechanisms identified by their XML algorithm URI.

KeyDerivationAlgorithm

KDF mechanisms accepted by the shared policy domain.

ManifestProcessing

Whether an XMLDSig operation evaluates direct <Object>/<Manifest> references.

OpcRelationshipEdition

Trusted edition of relationship selection and normalization. This is not an OPC package-conformance profile: signature placement and package-wide part identity constraints require a package validator.

PolicyViolation

A typed rejection produced by an operation policy.

RsaPssPermission

Permission for the unbounded parameterized RSA-PSS family. Exact permissions continue to use the signature algorithm allowlist.

SameDocumentIdSemantics

XMLDSig transform and canonicalization decisions shared by signing and verification.

VerificationTrustMode

Whether verification must establish signer authorization in addition to mathematics.