Struct KekDecryptor 

pub struct KekDecryptor<'a> { /* private fields */ }

Resolver backed by a pre-shared, algorithm-family-bound key-encryption key. Owned material is zeroized on drop; borrowed material remains caller-owned.

Implementations

impl KekDecryptor<'static>

pub fn new(kek: impl Into<Vec<u8>>) -> Self

Create a resolver for RFC 3394 AES key-wrap EncryptedKey elements.

pub fn with_kind(kek: impl Into<Vec<u8>>, kind: SymmetricKeyKind) -> Self

Bind owned key material to its trusted family, independently of input XML.

impl<'a> KekDecryptor<'a>

pub fn borrowed(kek: &'a [u8]) -> Self

Borrow a KEK for operation-scoped recovery without copying secret material.

pub fn borrowed_with_kind(kek: &'a [u8], kind: SymmetricKeyKind) -> Self

Borrow key material while retaining its caller-declared algorithm family.

Trait Implementations

impl<'a> Clone for KekDecryptor<'a>

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for KekDecryptor<'_>

fn fmt(&self, formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl DecryptionKeyResolver for KekDecryptor<'_>

fn resolve_key_encryption_keys_with_policy( &self, provider: &dyn CryptoProvider, algorithm: KeyWrapAlgorithm, source: KeyEncryptionKeySource<'_>, policy: &DecryptionPolicy, budget: &mut KeyCandidateBudget, ) -> Result<Vec<RecoveredContentKey>, XmlEncError>

Resolve an actual KEK purpose; default refusal prevents incorrectly adapting a content algorithm merely because its key width happens to fit.

fn resolve_content_keys_with_policy( &self, provider: &dyn CryptoProvider, algorithm: DataEncryptionAlgorithm, encrypted_key: Option<&EncryptedKey>, policy: &DecryptionPolicy, budget: &mut KeyCandidateBudget, ) -> Result<Vec<RecoveredContentKey>, XmlEncError>

Resolve operation candidates without dropping implicit-rejection state. Wrappers around recipient resolvers must forward this method; converting recovered candidates to raw bytes loses the final content acceptance gate.

fn resolve_key_candidates_with_policy( &self, provider: &dyn CryptoProvider, algorithm: DataEncryptionAlgorithm, encrypted_key: Option<&EncryptedKey>, policy: &DecryptionPolicy, budget: &mut KeyCandidateBudget, ) -> Result<Vec<Vec<u8>>, XmlEncError>

Resolve under the operation’s immutable snapshot. RSA resolvers enforce rsa_keys before provider recovery; wrappers must forward this snapshot.

fn resolve_key( &self, provider: &dyn CryptoProvider, algorithm: DataEncryptionAlgorithm, encrypted_key: Option<&EncryptedKey>, ) -> Result<Vec<u8>, XmlEncError>

Resolve the symmetric key for algorithm, optionally unwrapping encrypted_key.

fn resolve_encapsulation_content_keys_with_policy( &self, _provider: &dyn CryptoProvider, _algorithm: DataEncryptionAlgorithm, _descriptor: &EncapsulationMechanism, _policy: &DecryptionPolicy, _budget: &mut KeyCandidateBudget, ) -> Result<Vec<RecoveredContentKey>, XmlEncError>

Resolve an experimental KEM source under the operation snapshot. Raw content-key resolvers refuse by default rather than bypassing the KEM.

fn resolve_agreement_content_keys_with_policy( &self, _provider: &dyn CryptoProvider, _algorithm: DataEncryptionAlgorithm, _descriptor: &AgreementMethod, _policy: &DecryptionPolicy, _budget: &mut KeyCandidateBudget, ) -> Result<Vec<RecoveredContentKey>, XmlEncError>

Resolve an agreement under the operation snapshot and shared allowance. Default refusal prevents a raw content key from bypassing AgreementMethod.

fn resolve_derived_content_keys_with_policy( &self, _provider: &dyn CryptoProvider, _algorithm: DataEncryptionAlgorithm, _descriptor: &DerivedKey, _policy: &DecryptionPolicy, _budget: &mut KeyCandidateBudget, ) -> Result<Vec<RecoveredContentKey>, XmlEncError>

Resolve a transported derivation descriptor using the same immutable operation policy and cumulative candidate/KDF allowance. The default refuses it; a raw content-key resolver must not bypass derivation.

fn resolve_key_candidates( &self, provider: &dyn CryptoProvider, algorithm: DataEncryptionAlgorithm, encrypted_key: Option<&EncryptedKey>, budget: &mut KeyCandidateBudget, ) -> Result<Vec<Vec<u8>>, XmlEncError>

Resolve ordered candidate keys for one prepared decryption operation.

impl Drop for KekDecryptor<'_>

fn drop(&mut self)

Executes the destructor for this type.

fn pin_drop(self: Pin<&mut Self>)

🔬This is a nightly-only experimental API. (pin_ergonomics)

Execute the destructor for this type, but different to Drop::drop, it requires self to be pinned.

impl Zeroize for KekDecryptor<'_>

fn zeroize(&mut self)

Zero out this object from memory using Rust intrinsics which ensure the zeroization operation is not “optimized away” by the compiler.

impl ZeroizeOnDrop for KekDecryptor<'_>