pub struct KeyDerivationMethod { /* private fields */ }Expand description
Parsed XML key-derivation parameters, without private key material.
Parsing does not grant permission to derive a key. The enclosing operation must validate its compiled policy, reserve work and gate provider execution.
Implementations§
Source§impl KeyDerivationMethod
impl KeyDerivationMethod
Sourcepub fn to_xml(&self, resources: &ResourcePolicy) -> Result<String, XmlEncError>
pub fn to_xml(&self, resources: &ResourcePolicy) -> Result<String, XmlEncError>
Serialize public KDF parameters without secret key material. The exact escaped output length is checked before allocating the output buffer. Field boundaries and significant ConcatKDF bits survive transport.
Sourcepub fn derive_key(
&self,
output_len: usize,
provider: &dyn CryptoProvider,
secret: &[u8],
budget: &mut KeyEstablishmentBudget<'_>,
) -> Result<Zeroizing<Vec<u8>>, XmlEncError>
pub fn derive_key( &self, output_len: usize, provider: &dyn CryptoProvider, secret: &[u8], budget: &mut KeyEstablishmentBudget<'_>, ) -> Result<Zeroizing<Vec<u8>>, XmlEncError>
Execute parsed parameters under the enclosing operation’s shared allowance. Explicit XML KeyLength must match the consuming cipher.
Sourcepub fn concat_field_bits(
&self,
field: ConcatKdfField,
) -> Option<impl Iterator<Item = bool> + '_>
pub fn concat_field_bits( &self, field: ConcatKdfField, ) -> Option<impl Iterator<Item = bool> + '_>
Borrow one original ConcatKDF field as significant bits, without copying its bytes. None distinguishes omission from an explicitly empty field.
XMLEnc 1.1 section 5.4.1 requires application-specific validation of the algorithm and party identities. Combining OtherInfo must not erase the boundaries needed for that check.
Sourcepub fn parameters(
&self,
output_len: usize,
) -> Result<KdfParameters<'_>, XmlEncError>
pub fn parameters( &self, output_len: usize, ) -> Result<KdfParameters<'_>, XmlEncError>
Bind the requested key width supplied by EncryptionMethod. An explicit XML KeyLength must agree; it is not an override of the consuming cipher.