Crate zerodds_security_crypto 

Crate zerodds-security-crypto. Safety classification: SAFE (Wrapper um ring; kein eigener Primitive-Code).

AES-GCM + HMAC CryptographicPlugin-Implementation fuer DDS-Security 1.1 §8.5 (Spec formal/2018-04-01).

Schichten-Position

Layer 4 — Core Services. Implementiert die SPI aus zerodds-security::crypto::CryptographicPlugin.

Public API (Stand 1.0.0-rc.1)

• AesGcmCryptoPlugin — AES-GCM-128/256 + HMAC-SHA256 Plugin-Impl.
• PskCryptoPlugin — Pre-Shared-Key-Plugin fuer Out-of-Band-Setups.
• Suite — Suite-Diskriminator (AES-128-GCM / AES-256-GCM).
• crypto_transform-Modul — CryptoHeader/CryptoFooter Wire-Codec plus CryptoTransformKind + CryptoTransformIdentifier.
• session_key-Modul — derive_session_key + derive_session_hmac_key
  • compute_aad + Tag-Konstanten (Spec §10.5.2 Tab.74).
• aes_gcm_hw-Modul — HW-Capabilities-Detection (Arch, HwCapabilities).
• metrics (Feature metrics) — Hook-Points fuer zerodds-monitor §2.5.

Suite-Coverage

Suite	Wire-Kind	Use-Case
AES-128-GCM	0x01	Default-Production
AES-256-GCM	0x02	High-Assurance
HMAC-SHA256 (Auth-only)	0x03	Governance metadata_protection_kind=SIGN

12-byte-Nonce = 4 byte Session-ID + 8 byte Counter (Spec §9.5.3.3.4.4). Wire-Token: [kind_id(1) | session_id(4) | master_key(16|32)].

Nonce-Wrap-around-Protection: bei 2^63 Encrypts pro Session lehnt der Plugin neue Encrypt-Calls mit “key-refresh required” ab — Caller muss ein neues register_local_*-Roundtrip ausloesen.

Re-exports

pub use aes_gcm_hw::Arch;

pub use aes_gcm_hw::HwCapabilities;

pub use crypto_transform::BUILTIN_CRYPTO_PLUGIN;

pub use crypto_transform::CryptoFooter;

pub use crypto_transform::CryptoHeader;

pub use crypto_transform::CryptoTransformIdentifier;

pub use crypto_transform::CryptoTransformKind;

pub use crypto_transform::negotiate_transform;

pub use psk_plugin::CLASS_ID_PSK_CRYPTO;

pub use psk_plugin::HKDF_INFO_PSK_MASTER_KEY;

pub use psk_plugin::PskCryptoPlugin;

pub use session_key::AAD_HEADER_LEN;

pub use session_key::SESSION_KEY_TAG;

pub use session_key::SESSION_RECEIVER_KEY_TAG;

pub use session_key::compute_aad;

pub use session_key::derive_session_hmac_key;

pub use session_key::derive_session_key;

pub use suite::Suite;

Modules

aes_gcm_hw

HW-Crypto-Capability-Detection — CPU-Features + AES-GCM-Backend-Label.

crypto_transform

CryptoTransformIdentifier und Builtin-Crypto-Plugin-IDs — DDS-Security 1.2 §7.3.20 + §10.5.2-3 + §10.3.2.1.

metrics

Hot-Path-Hook-Points fuer zerodds-monitor (zerodds-monitor-1.0 §2.5).

psk_plugin

Builtin Pre-Shared-Key Cryptographic-Plugin (Spec §10.9).

session_key

DDS-Security 1.2 §10.5.2 — Session-Key-Derivation + AAD-Format (C3.7).

suite

Crypto-Suite-Auswahl (AES-GCM 128 / 256).

Structs

AesGcmCryptoPlugin

AES-GCM Crypto-Plugin. Keys werden in einem internen Slab gehalten; Lookup per CryptoHandle. Welche Suite lokal erzeugte Keys haben, bestimmt local_suite — Remote-Keys kommen mit ihrer eigenen Suite-ID via Token.