Crate zerodds_security_crypto 

Crate zerodds-security-crypto. Safety classification: SAFE (a wrapper around ring; no own primitive code).

AES-GCM + HMAC CryptographicPlugin implementation for DDS-Security 1.1 §8.5 (spec formal/2018-04-01).

Layer position

Layer 4 — Core Services. Implements the SPI from zerodds-security::crypto::CryptographicPlugin.

Public API (as of 1.0.0-rc.1)

• AesGcmCryptoPlugin — AES-GCM-128/256 + HMAC-SHA256 plugin impl.
• PskCryptoPlugin — pre-shared-key plugin for out-of-band setups.
• Suite — suite discriminator (AES-128-GCM / AES-256-GCM).
• crypto_transform module — CryptoHeader/CryptoFooter wire codec plus CryptoTransformKind + CryptoTransformIdentifier.
• session_key module — derive_session_key + derive_session_hmac_key
  • compute_aad + tag constants (spec §10.5.2 Tab.74).
• aes_gcm_hw module — HW capabilities detection (Arch, HwCapabilities).
• metrics (feature metrics) — hook points for zerodds-monitor §2.5.

Suite coverage

Suite	Wire kind	Use case
AES-128-GCM	0x01	Default production
AES-256-GCM	0x02	High assurance
HMAC-SHA256 (auth-only)	0x03	Governance metadata_protection_kind=SIGN

12-byte nonce = 4-byte session ID + 8-byte counter (spec §9.5.3.3.4.4). Wire token: [kind_id(1) | session_id(4) | master_key(16|32)].

Nonce wrap-around protection: at 2^63 encrypts per session the plugin rejects new encrypt calls with “key-refresh required” — the caller must trigger a new register_local_* roundtrip.

Re-exports

pub use aes_gcm_hw::Arch;

pub use aes_gcm_hw::HwCapabilities;

pub use crypto_transform::BUILTIN_CRYPTO_PLUGIN;

pub use crypto_transform::CryptoFooter;

pub use crypto_transform::CryptoHeader;

pub use crypto_transform::CryptoTransformIdentifier;

pub use crypto_transform::CryptoTransformKind;

pub use crypto_transform::negotiate_transform;

pub use psk_plugin::CLASS_ID_PSK_CRYPTO;

pub use psk_plugin::HKDF_INFO_PSK_MASTER_KEY;

pub use psk_plugin::PskCryptoPlugin;

pub use session_key::AAD_HEADER_LEN;

pub use session_key::SESSION_KEY_TAG;

pub use session_key::SESSION_RECEIVER_KEY_TAG;

pub use session_key::compute_aad;

pub use session_key::derive_session_hmac_key;

pub use session_key::derive_session_key;

pub use suite::Suite;

Modules

aes_gcm_hw

HW crypto capability detection — CPU features + AES-GCM backend label.

crypto_transform

CryptoTransformIdentifier and built-in crypto plugin IDs — DDS-Security 1.2 §7.3.20 + §10.5.2-3 + §10.3.2.1.

metrics

Hot-path hook points for zerodds-monitor (zerodds-monitor-1.1 §2.5).

psk_plugin

Built-in pre-shared-key cryptographic plugin (spec §10.9).

session_key

DDS-Security 1.2 §10.5.2 — session-key derivation + AAD format (C3.7).

suite

Crypto suite selection (AES-GCM 128 / 256).

Structs

AesGcmCryptoPlugin

AES-GCM crypto plugin. Keys are held in an internal slab; lookup by CryptoHandle. Which suite locally created keys have is determined by local_suite — remote keys come with their own suite ID via token.