Skip to main content

CryptoProvider

xml_sec::provider

Trait CryptoProvider 

Source 
pub trait CryptoProvider: Send + Sync {
    // Required methods
    fn name(&self) -> &'static str;
    fn supports(&self, capability: ProviderCapability<'_>) -> bool;
    fn fill_random(&self, output: &mut [u8]) -> Result<(), ProviderError>;
    fn digest(
        &self,
        algorithm: DigestAlgorithm,
        data: &[u8],
    ) -> Result<Vec<u8>, ProviderError>;
    fn sign(
        &self,
        key: &dyn SigningKey,
        algorithm: SignatureAlgorithm,
        data: &[u8],
    ) -> Result<Vec<u8>, SigningKeyError>;
    fn verify(
        &self,
        key: &dyn VerifyingKey,
        algorithm: SignatureAlgorithm,
        data: &[u8],
        signature: &[u8],
    ) -> Result<bool, DsigError>;
    fn derive_key(
        &self,
        parameters: &KdfParameters<'_>,
        secret: &[u8],
    ) -> Result<Vec<u8>, ProviderError>;

    // Provided methods
    fn verify_x509_signature(
        &self,
        algorithm: X509SignatureAlgorithm,
        signed_data: &[u8],
        signature: &[u8],
        issuer_spki_der: &[u8],
    ) -> Result<bool, ProviderError> { ... }
    fn agree_key(
        &self,
        key: &dyn KeyAgreementKey,
        parameters: &KeyAgreementParameters<'_>,
    ) -> Result<Vec<u8>, ProviderError> { ... }
    fn require_capability(
        &self,
        capability: ProviderCapability<'_>,
    ) -> Result<(), ProviderError> { ... }
}
Expand description

Stateless provider operations used by the XML Security pipelines.

Required Methods§

Source

fn name(&self) -> &'static str

Stable provider name for diagnostics and capability reporting.

Source

fn supports(&self, capability: ProviderCapability<'_>) -> bool

Return whether this build supports the requested operation and parameters.

Source

fn fill_random(&self, output: &mut [u8]) -> Result<(), ProviderError>

Fill caller-owned output with cryptographically secure random bytes.

Source

fn digest( &self, algorithm: DigestAlgorithm, data: &[u8], ) -> Result<Vec<u8>, ProviderError>

Compute a message digest.

Source

fn sign( &self, key: &dyn SigningKey, algorithm: SignatureAlgorithm, data: &[u8], ) -> Result<Vec<u8>, SigningKeyError>

Sign bytes with an opaque key handle.

Providers that delegate primitive signing to the supplied key must call crate::xmldsig::SigningKey::sign_with_provider so randomized primitives consume this provider’s randomness.

Source

fn verify( &self, key: &dyn VerifyingKey, algorithm: SignatureAlgorithm, data: &[u8], signature: &[u8], ) -> Result<bool, DsigError>

Verify bytes with an opaque key handle.

The XMLDSig facade validates algorithm- and key-specific signature framing before this provider boundary.

Source

fn derive_key( &self, parameters: &KdfParameters<'_>, secret: &[u8], ) -> Result<Vec<u8>, ProviderError>

Derive key bytes from caller-owned secret material.

Implementations that advertise ProviderCapability::Kdf must perform the advertised derivation here. This method is required so capability discovery cannot silently inherit a contradictory unsupported default.

Provided Methods§

Source

fn verify_x509_signature( &self, algorithm: X509SignatureAlgorithm, signed_data: &[u8], signature: &[u8], issuer_spki_der: &[u8], ) -> Result<bool, ProviderError>

Verify an X.509 certificate or CRL signature under its issuer SPKI.

Source

fn agree_key( &self, key: &dyn KeyAgreementKey, parameters: &KeyAgreementParameters<'_>, ) -> Result<Vec<u8>, ProviderError>

Perform key agreement with an opaque provider-owned private key.

Source

fn require_capability( &self, capability: ProviderCapability<'_>, ) -> Result<(), ProviderError>

Reject an unavailable exact capability without falling back.

Dyn Compatibility§

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors§