Trait DecryptionKeyResolver 

pub trait DecryptionKeyResolver {
    // Required method
    fn resolve_key(
        &self,
        provider: &dyn CryptoProvider,
        algorithm: DataEncryptionAlgorithm,
        encrypted_key: Option<&EncryptedKey>,
    ) -> Result<Vec<u8>, XmlEncError>;

    // Provided methods
    fn resolve_encapsulation_content_keys_with_policy(
        &self,
        _provider: &dyn CryptoProvider,
        _algorithm: DataEncryptionAlgorithm,
        _descriptor: &EncapsulationMechanism,
        _policy: &DecryptionPolicy,
        _budget: &mut KeyCandidateBudget,
    ) -> Result<Vec<RecoveredContentKey>, XmlEncError> { ... }
    fn resolve_key_encryption_keys_with_policy(
        &self,
        _provider: &dyn CryptoProvider,
        _algorithm: KeyWrapAlgorithm,
        _source: KeyEncryptionKeySource<'_>,
        _policy: &DecryptionPolicy,
        _budget: &mut KeyCandidateBudget,
    ) -> Result<Vec<RecoveredContentKey>, XmlEncError> { ... }
    fn resolve_agreement_content_keys_with_policy(
        &self,
        _provider: &dyn CryptoProvider,
        _algorithm: DataEncryptionAlgorithm,
        _descriptor: &AgreementMethod,
        _policy: &DecryptionPolicy,
        _budget: &mut KeyCandidateBudget,
    ) -> Result<Vec<RecoveredContentKey>, XmlEncError> { ... }
    fn resolve_derived_content_keys_with_policy(
        &self,
        _provider: &dyn CryptoProvider,
        _algorithm: DataEncryptionAlgorithm,
        _descriptor: &DerivedKey,
        _policy: &DecryptionPolicy,
        _budget: &mut KeyCandidateBudget,
    ) -> Result<Vec<RecoveredContentKey>, XmlEncError> { ... }
    fn resolve_content_keys_with_policy(
        &self,
        provider: &dyn CryptoProvider,
        algorithm: DataEncryptionAlgorithm,
        encrypted_key: Option<&EncryptedKey>,
        policy: &DecryptionPolicy,
        budget: &mut KeyCandidateBudget,
    ) -> Result<Vec<RecoveredContentKey>, XmlEncError> { ... }
    fn resolve_key_candidates_with_policy(
        &self,
        provider: &dyn CryptoProvider,
        algorithm: DataEncryptionAlgorithm,
        encrypted_key: Option<&EncryptedKey>,
        policy: &DecryptionPolicy,
        budget: &mut KeyCandidateBudget,
    ) -> Result<Vec<Vec<u8>>, XmlEncError> { ... }
    fn resolve_key_candidates(
        &self,
        provider: &dyn CryptoProvider,
        algorithm: DataEncryptionAlgorithm,
        encrypted_key: Option<&EncryptedKey>,
        budget: &mut KeyCandidateBudget,
    ) -> Result<Vec<Vec<u8>>, XmlEncError> { ... }
}

Supplies keys for an XMLEnc operation under its immutable policy snapshot.

Required Methods

fn resolve_key( &self, provider: &dyn CryptoProvider, algorithm: DataEncryptionAlgorithm, encrypted_key: Option<&EncryptedKey>, ) -> Result<Vec<u8>, XmlEncError>

Resolve the symmetric key for algorithm, optionally unwrapping encrypted_key.

Provided Methods

fn resolve_encapsulation_content_keys_with_policy( &self, _provider: &dyn CryptoProvider, _algorithm: DataEncryptionAlgorithm, _descriptor: &EncapsulationMechanism, _policy: &DecryptionPolicy, _budget: &mut KeyCandidateBudget, ) -> Result<Vec<RecoveredContentKey>, XmlEncError>

Resolve an experimental KEM source under the operation snapshot. Raw content-key resolvers refuse by default rather than bypassing the KEM.

fn resolve_key_encryption_keys_with_policy( &self, _provider: &dyn CryptoProvider, _algorithm: KeyWrapAlgorithm, _source: KeyEncryptionKeySource<'_>, _policy: &DecryptionPolicy, _budget: &mut KeyCandidateBudget, ) -> Result<Vec<RecoveredContentKey>, XmlEncError>

Resolve an actual KEK purpose; default refusal prevents incorrectly adapting a content algorithm merely because its key width happens to fit.

fn resolve_agreement_content_keys_with_policy( &self, _provider: &dyn CryptoProvider, _algorithm: DataEncryptionAlgorithm, _descriptor: &AgreementMethod, _policy: &DecryptionPolicy, _budget: &mut KeyCandidateBudget, ) -> Result<Vec<RecoveredContentKey>, XmlEncError>

Resolve an agreement under the operation snapshot and shared allowance. Default refusal prevents a raw content key from bypassing AgreementMethod.

fn resolve_derived_content_keys_with_policy( &self, _provider: &dyn CryptoProvider, _algorithm: DataEncryptionAlgorithm, _descriptor: &DerivedKey, _policy: &DecryptionPolicy, _budget: &mut KeyCandidateBudget, ) -> Result<Vec<RecoveredContentKey>, XmlEncError>

Resolve a transported derivation descriptor using the same immutable operation policy and cumulative candidate/KDF allowance. The default refuses it; a raw content-key resolver must not bypass derivation.

fn resolve_content_keys_with_policy( &self, provider: &dyn CryptoProvider, algorithm: DataEncryptionAlgorithm, encrypted_key: Option<&EncryptedKey>, policy: &DecryptionPolicy, budget: &mut KeyCandidateBudget, ) -> Result<Vec<RecoveredContentKey>, XmlEncError>

Resolve operation candidates without dropping implicit-rejection state. Wrappers around recipient resolvers must forward this method; converting recovered candidates to raw bytes loses the final content acceptance gate.

fn resolve_key_candidates_with_policy( &self, provider: &dyn CryptoProvider, algorithm: DataEncryptionAlgorithm, encrypted_key: Option<&EncryptedKey>, policy: &DecryptionPolicy, budget: &mut KeyCandidateBudget, ) -> Result<Vec<Vec<u8>>, XmlEncError>

Resolve under the operation’s immutable snapshot. RSA resolvers enforce rsa_keys before provider recovery; wrappers must forward this snapshot.

The default supports direct content keys only and returns XmlEncError::KeyNotFound for recipients without invoking legacy resolution. Recipient resolvers must override this method: recovered symmetric bytes cannot prove the original key met the operation policy.

fn resolve_key_candidates( &self, provider: &dyn CryptoProvider, algorithm: DataEncryptionAlgorithm, encrypted_key: Option<&EncryptedKey>, budget: &mut KeyCandidateBudget, ) -> Result<Vec<Vec<u8>>, XmlEncError>

Resolve ordered candidate keys for one prepared decryption operation.

The default preserves single-key resolver behavior. Key rings override this method so parsing, policy validation, and ciphertext decoding occur once while only authenticated primitive decryption is retried. Overrides must consume the shared budget before every lookup or unwrap attempt. The context also accounts for any returned candidates an implementation did not explicitly charge. Returning XmlEncError::Policy rejects the complete operation and never advances to another key source; use a candidate-local error such as XmlEncError::KeyNotFound when later ordered sources are still eligible.

Dyn Compatibility

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors

impl DecryptionKeyResolver for AgreementDecryptor<'_>

impl DecryptionKeyResolver for DerivedKeyDecryptor<'_>

impl DecryptionKeyResolver for EncapsulationDecryptor<'_>

impl DecryptionKeyResolver for KekDecryptor<'_>

impl DecryptionKeyResolver for OpaqueContentKeyResolver

impl DecryptionKeyResolver for OpaqueKekDecryptor

impl DecryptionKeyResolver for PrivateKeyDecryptor

impl DecryptionKeyResolver for SymmetricKeyDecryptor