Trait CryptoProvider 

pub trait CryptoProvider: Send + Sync {
    // Required methods
    fn name(&self) -> &'static str;
    fn supports(&self, capability: ProviderCapability<'_>) -> bool;
    fn fill_random(&self, output: &mut [u8]) -> Result<(), ProviderError>;
    fn digest(
        &self,
        algorithm: DigestAlgorithm,
        data: &[u8],
    ) -> Result<Vec<u8>, ProviderError>;
    fn sign(
        &self,
        key: &dyn SigningKey,
        algorithm: SignatureAlgorithm,
        data: &[u8],
    ) -> Result<Vec<u8>, SigningKeyError>;
    fn verify(
        &self,
        key: &dyn VerifyingKey,
        algorithm: SignatureAlgorithm,
        data: &[u8],
        signature: &[u8],
    ) -> Result<bool, DsigError>;
    fn encrypt_data(
        &self,
        algorithm: DataEncryptionAlgorithm,
        key: &[u8],
        plaintext: &[u8],
    ) -> Result<Vec<u8>, ProviderError>;
    fn decrypt_data(
        &self,
        algorithm: DataEncryptionAlgorithm,
        key: &[u8],
        ciphertext: &[u8],
    ) -> Result<Vec<u8>, ProviderError>;
    fn wrap_key(
        &self,
        algorithm: KeyWrapAlgorithm,
        kek: &[u8],
        key: &[u8],
    ) -> Result<Vec<u8>, ProviderError>;
    fn unwrap_key(
        &self,
        algorithm: KeyWrapAlgorithm,
        kek: &[u8],
        wrapped: &[u8],
    ) -> Result<Vec<u8>, ProviderError>;
    fn transport_key(
        &self,
        key: &dyn KeyTransportKey,
        parameters: &RsaOaepParameters,
        plaintext: &[u8],
    ) -> Result<Vec<u8>, ProviderError>;
    fn recover_key(
        &self,
        key: &dyn KeyRecoveryKey,
        parameters: &RsaOaepParameters,
        ciphertext: &[u8],
    ) -> Result<Vec<u8>, ProviderError>;
    fn derive_key(
        &self,
        parameters: &KdfParameters<'_>,
        secret: &[u8],
    ) -> Result<Vec<u8>, ProviderError>;

    // Provided methods
    fn binding(&self) -> Option<&ProviderBinding> { ... }
    fn recover_content_key(
        &self,
        key: &dyn KeyRecoveryKey,
        parameters: &RsaOaepParameters,
        _content_algorithm: DataEncryptionAlgorithm,
        ciphertext: &[u8],
    ) -> Result<RecoveredContentKey, ProviderError> { ... }
    fn unwrap_content_key(
        &self,
        _key: &dyn KeyUnwrappingKey,
        algorithm: KeyWrapAlgorithm,
        _content_algorithm: DataEncryptionAlgorithm,
        _wrapped: &[u8],
    ) -> Result<RecoveredContentKey, ProviderError> { ... }
    fn decrypt_content_key(
        &self,
        algorithm: DataEncryptionAlgorithm,
        _key: &dyn ContentDecryptionKey,
        _ciphertext: &[u8],
    ) -> Result<Vec<u8>, ProviderError> { ... }
    fn import_signing_key(
        &self,
        algorithm: SignatureAlgorithm,
        _pkcs8: &[u8],
    ) -> Result<Box<dyn SigningKey>, SigningKeyError> { ... }
    fn import_recovery_key(
        &self,
        _pkcs8: &[u8],
    ) -> Result<Arc<dyn KeyRecoveryKey>, ProviderError> { ... }
    fn import_encapsulation_key(
        &self,
        algorithm: KeyEncapsulationAlgorithm,
        _spki: &[u8],
    ) -> Result<Arc<dyn KeyEncapsulationKey>, ProviderError> { ... }
    fn import_decapsulation_key(
        &self,
        algorithm: KeyEncapsulationAlgorithm,
        _pkcs8: &[u8],
    ) -> Result<Arc<dyn KeyDecapsulationKey>, ProviderError> { ... }
    fn encapsulate_key(
        &self,
        key: &dyn KeyEncapsulationKey,
    ) -> Result<EncapsulatedKey, ProviderError> { ... }
    fn decapsulate_key(
        &self,
        key: &dyn KeyDecapsulationKey,
        ciphertext: &[u8],
    ) -> Result<Zeroizing<[u8; 32]>, ProviderError> { ... }
    fn sign_with_context(
        &self,
        key: &dyn SigningKey,
        algorithm: SignatureAlgorithm,
        context: &SignatureContext,
        data: &[u8],
    ) -> Result<Vec<u8>, SigningKeyError> { ... }
    fn verify_with_context(
        &self,
        key: &dyn VerifyingKey,
        algorithm: SignatureAlgorithm,
        context: &SignatureContext,
        data: &[u8],
        signature: &[u8],
    ) -> Result<bool, DsigError> { ... }
    fn verify_with_key_receipt(
        &self,
        key: &dyn VerifyingKey,
        input: SignatureVerificationInput<'_>,
        _observer: &mut dyn FnMut(KeyVerificationEvent<'_>) -> Result<(), DsigError>,
    ) -> Result<bool, DsigError> { ... }
    fn associate_verification_key(
        &self,
        _actual: &[u8],
        _expected: WorkingKey<'_>,
        _charge: &dyn Fn(u64) -> Result<(), MemoryError>,
    ) -> Result<KeyAssociation, DsigError> { ... }
    fn verify_x509_signature(
        &self,
        algorithm: X509SignatureAlgorithm,
        signed_data: &[u8],
        signature: &[u8],
        issuer_spki_der: &[u8],
    ) -> Result<bool, ProviderError> { ... }
    fn encrypt_data_with_parameters(
        &self,
        algorithm: DataEncryptionAlgorithm,
        key: &[u8],
        plaintext: &[u8],
        parameters: Option<ChaChaParametersRef<'_>>,
    ) -> Result<Vec<u8>, ProviderError> { ... }
    fn decrypt_data_with_parameters(
        &self,
        algorithm: DataEncryptionAlgorithm,
        key: &[u8],
        ciphertext: &[u8],
        parameters: Option<ChaChaParametersRef<'_>>,
    ) -> Result<Vec<u8>, ProviderError> { ... }
    fn agree_key(
        &self,
        key: &dyn KeyAgreementKey,
        parameters: &KeyAgreementParameters<'_>,
    ) -> Result<Vec<u8>, ProviderError> { ... }
    fn require_capability(
        &self,
        capability: ProviderCapability<'_>,
    ) -> Result<(), ProviderError> { ... }
}

Provider operations used by the XML Security pipelines.

Required Methods

fn name(&self) -> &'static str

Stable provider name for diagnostics and capability reporting.

fn supports(&self, capability: ProviderCapability<'_>) -> bool

Return whether this build can dispatch the requested capability.

ProviderCapability::Sign and ProviderCapability::Verify describe provider dispatch only: the supplied opaque key performs the executable algorithm-support check when the operation runs.

fn fill_random(&self, output: &mut [u8]) -> Result<(), ProviderError>

Fill caller-owned output with cryptographically secure random bytes.

fn digest( &self, algorithm: DigestAlgorithm, data: &[u8], ) -> Result<Vec<u8>, ProviderError>

Compute a message digest.

fn sign( &self, key: &dyn SigningKey, algorithm: SignatureAlgorithm, data: &[u8], ) -> Result<Vec<u8>, SigningKeyError>

Sign bytes with an opaque key handle.

Providers that delegate primitive signing to the supplied key must call crate::xmldsig::SigningKey::sign_with_provider so randomized primitives consume this provider’s randomness.

fn verify( &self, key: &dyn VerifyingKey, algorithm: SignatureAlgorithm, data: &[u8], signature: &[u8], ) -> Result<bool, DsigError>

Verify bytes with an opaque key handle.

The XMLDSig facade validates algorithm- and key-specific signature framing before this provider boundary.

fn encrypt_data( &self, algorithm: DataEncryptionAlgorithm, key: &[u8], plaintext: &[u8], ) -> Result<Vec<u8>, ProviderError>

Encrypt XMLEnc content bytes, including standard framing.

fn decrypt_data( &self, algorithm: DataEncryptionAlgorithm, key: &[u8], ciphertext: &[u8], ) -> Result<Vec<u8>, ProviderError>

Decrypt XMLEnc content bytes, including framing validation.

fn wrap_key( &self, algorithm: KeyWrapAlgorithm, kek: &[u8], key: &[u8], ) -> Result<Vec<u8>, ProviderError>

Wrap a content key with RFC 3394 AES Key Wrap.

Successful output contains the complete RFC 3394 value and is exactly eight bytes longer than key. The XMLEnc facade validates that framing before serializing provider output.

fn unwrap_key( &self, algorithm: KeyWrapAlgorithm, kek: &[u8], wrapped: &[u8], ) -> Result<Vec<u8>, ProviderError>

Unwrap a content key with RFC 3394 AES Key Wrap.

fn transport_key( &self, key: &dyn KeyTransportKey, parameters: &RsaOaepParameters, plaintext: &[u8], ) -> Result<Vec<u8>, ProviderError>

Wrap key bytes using an opaque RSA public-key operation.

fn recover_key( &self, key: &dyn KeyRecoveryKey, parameters: &RsaOaepParameters, ciphertext: &[u8], ) -> Result<Vec<u8>, ProviderError>

Recover key bytes using an opaque RSA private-key operation.

fn derive_key( &self, parameters: &KdfParameters<'_>, secret: &[u8], ) -> Result<Vec<u8>, ProviderError>

Derive key bytes from caller-owned secret material.

Implementations that advertise ProviderCapability::Kdf must perform the advertised derivation here. This method is required so capability discovery cannot silently inherit a contradictory unsupported default.

Provided Methods

fn binding(&self) -> Option<&ProviderBinding>

External execution domain. Different instances of one engine are not interchangeable.

fn recover_content_key( &self, key: &dyn KeyRecoveryKey, parameters: &RsaOaepParameters, _content_algorithm: DataEncryptionAlgorithm, ciphertext: &[u8], ) -> Result<RecoveredContentKey, ProviderError>

Recover a candidate without requiring its symmetric value to leave the provider.

fn unwrap_content_key( &self, _key: &dyn KeyUnwrappingKey, algorithm: KeyWrapAlgorithm, _content_algorithm: DataEncryptionAlgorithm, _wrapped: &[u8], ) -> Result<RecoveredContentKey, ProviderError>

Unwrap into an opaque content key. Providers must opt in explicitly.

fn decrypt_content_key( &self, algorithm: DataEncryptionAlgorithm, _key: &dyn ContentDecryptionKey, _ciphertext: &[u8], ) -> Result<Vec<u8>, ProviderError>

Decrypt with an opaque key; capability remains distinct from policy permission.

fn import_signing_key( &self, algorithm: SignatureAlgorithm, _pkcs8: &[u8], ) -> Result<Box<dyn SigningKey>, SigningKeyError>

Import original PKCS#8 input into this engine without exporting another provider’s private handle. Policy and input budgets are enforced by the caller.

fn import_recovery_key( &self, _pkcs8: &[u8], ) -> Result<Arc<dyn KeyRecoveryKey>, ProviderError>

Import original PKCS#8 input into a provider-owned RSA recovery handle.

fn import_encapsulation_key( &self, algorithm: KeyEncapsulationAlgorithm, _spki: &[u8], ) -> Result<Arc<dyn KeyEncapsulationKey>, ProviderError>

Import a recipient SPKI into the selected engine. The caller reserves import work and grants permission; unavailable engines never fall back.

fn import_decapsulation_key( &self, algorithm: KeyEncapsulationAlgorithm, _pkcs8: &[u8], ) -> Result<Arc<dyn KeyDecapsulationKey>, ProviderError>

Import a recipient PKCS#8 into this engine without exporting another provider’s private handle. The encoded parameter set must match the request.

fn encapsulate_key( &self, key: &dyn KeyEncapsulationKey, ) -> Result<EncapsulatedKey, ProviderError>

Encapsulate through this engine; unsupported engines never delegate to RustCrypto.

fn decapsulate_key( &self, key: &dyn KeyDecapsulationKey, ciphertext: &[u8], ) -> Result<Zeroizing<[u8; 32]>, ProviderError>

Decapsulate without revealing implicit-rejection validity.

fn sign_with_context( &self, key: &dyn SigningKey, algorithm: SignatureAlgorithm, context: &SignatureContext, data: &[u8], ) -> Result<Vec<u8>, SigningKeyError>

Sign with explicit domain separation; unsupported contexts must not be discarded.

fn verify_with_context( &self, key: &dyn VerifyingKey, algorithm: SignatureAlgorithm, context: &SignatureContext, data: &[u8], signature: &[u8], ) -> Result<bool, DsigError>

Verify with explicit domain separation; unsupported contexts fail closed.

fn verify_with_key_receipt( &self, key: &dyn VerifyingKey, input: SignatureVerificationInput<'_>, _observer: &mut dyn FnMut(KeyVerificationEvent<'_>) -> Result<(), DsigError>, ) -> Result<bool, DsigError>

Verify once while reporting the actual successful leaf. Providers that cannot identify it retain ordinary verification and report no receipt.

fn associate_verification_key( &self, _actual: &[u8], _expected: WorkingKey<'_>, _charge: &dyn Fn(u64) -> Result<(), MemoryError>, ) -> Result<KeyAssociation, DsigError>

Compare the successful public receipt with original effective PKIX key state. Unknown semantics are Unproven, never a second provider fallback.

fn verify_x509_signature( &self, algorithm: X509SignatureAlgorithm, signed_data: &[u8], signature: &[u8], issuer_spki_der: &[u8], ) -> Result<bool, ProviderError>

Verify an X.509 certificate or CRL signature under its issuer SPKI.

fn encrypt_data_with_parameters( &self, algorithm: DataEncryptionAlgorithm, key: &[u8], plaintext: &[u8], parameters: Option<ChaChaParametersRef<'_>>, ) -> Result<Vec<u8>, ProviderError>

Encrypt while preserving XML-carried cipher parameters. Providers must implement the profile explicitly, never discard it or fall back.

fn decrypt_data_with_parameters( &self, algorithm: DataEncryptionAlgorithm, key: &[u8], ciphertext: &[u8], parameters: Option<ChaChaParametersRef<'_>>, ) -> Result<Vec<u8>, ProviderError>

Decrypt with the same explicit parameter contract as encryption.

fn agree_key( &self, key: &dyn KeyAgreementKey, parameters: &KeyAgreementParameters<'_>, ) -> Result<Vec<u8>, ProviderError>

Perform key agreement with an opaque provider-owned private key.

fn require_capability( &self, capability: ProviderCapability<'_>, ) -> Result<(), ProviderError>

Reject an unavailable exact capability without falling back.

Dyn Compatibility

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors

impl CryptoProvider for RustCryptoProvider