Struct RustCryptoProvider 

pub struct RustCryptoProvider;

Pure-Rust provider backed by RustCrypto crates.

Trait Implementations

impl Clone for RustCryptoProvider

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for RustCryptoProvider

impl CryptoProvider for RustCryptoProvider

fn verify_with_key_receipt( &self, key: &dyn VerifyingKey, input: SignatureVerificationInput<'_>, observer: &mut dyn FnMut(KeyVerificationEvent<'_>) -> Result<(), DsigError>, ) -> Result<bool, DsigError>

Verify once while reporting the actual successful leaf. Providers that cannot identify it retain ordinary verification and report no receipt.

fn associate_verification_key( &self, actual: &[u8], expected: WorkingKey<'_>, charge: &dyn Fn(u64) -> Result<(), MemoryError>, ) -> Result<KeyAssociation, DsigError>

Compare the successful public receipt with original effective PKIX key state. Unknown semantics are Unproven, never a second provider fallback.

fn encapsulate_key( &self, key: &dyn KeyEncapsulationKey, ) -> Result<EncapsulatedKey, ProviderError>

Encapsulate through this engine; unsupported engines never delegate to RustCrypto.

fn decapsulate_key( &self, key: &dyn KeyDecapsulationKey, ciphertext: &[u8], ) -> Result<Zeroizing<[u8; 32]>, ProviderError>

Decapsulate without revealing implicit-rejection validity.

fn name(&self) -> &'static str

Stable provider name for diagnostics and capability reporting.

fn import_recovery_key( &self, pkcs8: &[u8], ) -> Result<Arc<dyn KeyRecoveryKey>, ProviderError>

Import original PKCS#8 input into a provider-owned RSA recovery handle.

fn import_signing_key( &self, algorithm: SignatureAlgorithm, der: &[u8], ) -> Result<Box<dyn SigningKey>, SigningKeyError>

Import original PKCS#8 input into this engine without exporting another provider’s private handle. Policy and input budgets are enforced by the caller.

fn supports(&self, capability: ProviderCapability<'_>) -> bool

Return whether this build can dispatch the requested capability.

fn fill_random(&self, output: &mut [u8]) -> Result<(), ProviderError>

Fill caller-owned output with cryptographically secure random bytes.

fn derive_key( &self, parameters: &KdfParameters<'_>, secret: &[u8], ) -> Result<Vec<u8>, ProviderError>

Derive key bytes from caller-owned secret material.

fn digest( &self, algorithm: DigestAlgorithm, data: &[u8], ) -> Result<Vec<u8>, ProviderError>

Compute a message digest.

fn sign( &self, key: &dyn SigningKey, algorithm: SignatureAlgorithm, data: &[u8], ) -> Result<Vec<u8>, SigningKeyError>

Sign bytes with an opaque key handle.

fn sign_with_context( &self, key: &dyn SigningKey, algorithm: SignatureAlgorithm, context: &SignatureContext, data: &[u8], ) -> Result<Vec<u8>, SigningKeyError>

Sign with explicit domain separation; unsupported contexts must not be discarded.

fn verify_with_context( &self, key: &dyn VerifyingKey, algorithm: SignatureAlgorithm, context: &SignatureContext, data: &[u8], signature: &[u8], ) -> Result<bool, DsigError>

Verify with explicit domain separation; unsupported contexts fail closed.

fn verify( &self, key: &dyn VerifyingKey, algorithm: SignatureAlgorithm, data: &[u8], signature: &[u8], ) -> Result<bool, DsigError>

Verify bytes with an opaque key handle.

fn verify_x509_signature( &self, algorithm: X509SignatureAlgorithm, signed_data: &[u8], signature: &[u8], issuer_spki_der: &[u8], ) -> Result<bool, ProviderError>

Verify an X.509 certificate or CRL signature under its issuer SPKI.

fn encrypt_data( &self, algorithm: DataEncryptionAlgorithm, key: &[u8], plaintext: &[u8], ) -> Result<Vec<u8>, ProviderError>

Encrypt XMLEnc content bytes, including standard framing.

fn decrypt_data( &self, algorithm: DataEncryptionAlgorithm, key: &[u8], ciphertext: &[u8], ) -> Result<Vec<u8>, ProviderError>

Decrypt XMLEnc content bytes, including framing validation.

fn wrap_key( &self, algorithm: KeyWrapAlgorithm, kek: &[u8], key: &[u8], ) -> Result<Vec<u8>, ProviderError>

Wrap a content key with RFC 3394 AES Key Wrap.

fn encrypt_data_with_parameters( &self, algorithm: DataEncryptionAlgorithm, key: &[u8], plaintext: &[u8], parameters: Option<ChaChaParametersRef<'_>>, ) -> Result<Vec<u8>, ProviderError>

Encrypt while preserving XML-carried cipher parameters. Providers must implement the profile explicitly, never discard it or fall back.

fn decrypt_data_with_parameters( &self, algorithm: DataEncryptionAlgorithm, key: &[u8], ciphertext: &[u8], parameters: Option<ChaChaParametersRef<'_>>, ) -> Result<Vec<u8>, ProviderError>

Decrypt with the same explicit parameter contract as encryption.

fn unwrap_key( &self, algorithm: KeyWrapAlgorithm, kek: &[u8], wrapped: &[u8], ) -> Result<Vec<u8>, ProviderError>

Unwrap a content key with RFC 3394 AES Key Wrap.

fn transport_key( &self, key: &dyn KeyTransportKey, parameters: &RsaOaepParameters, plaintext: &[u8], ) -> Result<Vec<u8>, ProviderError>

Wrap key bytes using an opaque RSA public-key operation.

fn recover_key( &self, key: &dyn KeyRecoveryKey, parameters: &RsaOaepParameters, ciphertext: &[u8], ) -> Result<Vec<u8>, ProviderError>

Recover key bytes using an opaque RSA private-key operation.

fn binding(&self) -> Option<&ProviderBinding>

External execution domain. Different instances of one engine are not interchangeable.

fn recover_content_key( &self, key: &dyn KeyRecoveryKey, parameters: &RsaOaepParameters, _content_algorithm: DataEncryptionAlgorithm, ciphertext: &[u8], ) -> Result<RecoveredContentKey, ProviderError>

Recover a candidate without requiring its symmetric value to leave the provider.

fn unwrap_content_key( &self, _key: &dyn KeyUnwrappingKey, algorithm: KeyWrapAlgorithm, _content_algorithm: DataEncryptionAlgorithm, _wrapped: &[u8], ) -> Result<RecoveredContentKey, ProviderError>

Unwrap into an opaque content key. Providers must opt in explicitly.

fn decrypt_content_key( &self, algorithm: DataEncryptionAlgorithm, _key: &dyn ContentDecryptionKey, _ciphertext: &[u8], ) -> Result<Vec<u8>, ProviderError>

Decrypt with an opaque key; capability remains distinct from policy permission.

fn import_encapsulation_key( &self, algorithm: KeyEncapsulationAlgorithm, _spki: &[u8], ) -> Result<Arc<dyn KeyEncapsulationKey>, ProviderError>

Import a recipient SPKI into the selected engine. The caller reserves import work and grants permission; unavailable engines never fall back.

fn import_decapsulation_key( &self, algorithm: KeyEncapsulationAlgorithm, _pkcs8: &[u8], ) -> Result<Arc<dyn KeyDecapsulationKey>, ProviderError>

Import a recipient PKCS#8 into this engine without exporting another provider’s private handle. The encoded parameter set must match the request.

fn agree_key( &self, key: &dyn KeyAgreementKey, parameters: &KeyAgreementParameters<'_>, ) -> Result<Vec<u8>, ProviderError>

Perform key agreement with an opaque provider-owned private key.

fn require_capability( &self, capability: ProviderCapability<'_>, ) -> Result<(), ProviderError>

Reject an unavailable exact capability without falling back.

impl Debug for RustCryptoProvider

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for RustCryptoProvider

fn default() -> Self

Returns the “default value” for a type.