zerodds_security_pki/
lib.rs

1// SPDX-License-Identifier: Apache-2.0
2// Copyright 2026 ZeroDDS Contributors
3
4//! Crate `zerodds-security-pki`. Safety classification: **SAFE** (reiner Wrapper um `rustls-webpki`; kein Raw-Crypto-Code in dieser Crate).
5//!
6//! PKI/X.509-Backend fuer das DDS-Security 1.1 §8.3
7//! `AuthenticationPlugin`-SPI: Identity-Validation, Handshake-Token-
8//! Sign/Verify, OCSP-Stapling-Liveness, CRL-Validation, Delegation-Chains.
9//!
10//! ## Schichten-Position
11//!
12//! Layer 4 — Core Services. Konsumiert `zerodds-security` (SPI).
13//!
14//! ## Public API (Stand 1.0.0-rc.1)
15//!
16//! - [`PkiAuthenticationPlugin`] — `AuthenticationPlugin`-Impl (X.509 + RSA-PSS + ECDSA-P256/P384 + Ed25519).
17//! - [`IdentityConfig`] / [`IdentityHandle`] — Identity-Loading.
18//! - [`HandshakeToken`] / [`HandshakeError`] — Handshake-State-Machine (Challenge/Response).
19//! - [`AuthRequestMessage`] — `auth_request`-Token-Codec (Spec §9.3.2.4).
20//! - [`IdentityStatusToken`] — Identity-Status-Subscription (Spec §8.3.2.13).
21//! - `ocsp`-Modul — OCSP-Stapling-Validation (RFC 6960).
22//! - `crl`-Modul — CRL-Online-Checks + Cache.
23//! - `delegation`-Modul — `DelegationLink` Sign/Verify + `DelegationChain`.
24//! - [`PskAuthenticationPlugin`] — PSK-Variante (Spec §10.7).
25//!
26//! # Architektur-Gedanke
27//!
28//! Alle echten Crypto-Checks delegieren an `rustls-webpki` (der gleiche
29//! Code, der rustls fuer TLS nutzt). Wir adaptieren nur die Eingabe
30//! (PEM → DER) und die Ausgabe (OK/Err) auf den `AuthenticationPlugin`-
31//! Trait. Damit vermeiden wir eigene Crypto-Implementation und profitieren
32//! von rustls' Audit-Historie.
33//!
34//! # Beispiel (Pseudo — echte PEMs fehlen im Doctest)
35//!
36//! ```ignore
37//! use zerodds_security::AuthenticationPlugin;
38//! use zerodds_security_pki::{PkiAuthenticationPlugin, IdentityConfig};
39//!
40//! let mut plugin = PkiAuthenticationPlugin::new();
41//! let cfg = IdentityConfig {
42//!     identity_cert_pem: ALICE_CERT_PEM.into(),
43//!     identity_ca_pem: CA_PEM.into(),
44//! };
45//! let local = plugin.validate_with_config(cfg, [0xAA; 16])?;
46//! ```
47
48#![cfg_attr(not(feature = "std"), no_std)]
49#![forbid(unsafe_code)]
50#![warn(missing_docs)]
51
52extern crate alloc;
53
54pub mod auth_request;
55pub mod crl;
56pub mod delegation;
57pub mod handshake_token;
58mod identity;
59pub mod identity_status;
60pub mod identity_token;
61mod ocsp;
62mod plugin;
63pub mod psk;
64
65pub use auth_request::{
66    AUTH_REQUEST_CLASS_ID, AuthRequestToken, FUTURE_CHALLENGE_KEY, auth_request_properties,
67};
68pub use crl::{CrlParseError, parse_crl_serials, validate_crl};
69pub use delegation::{
70    DELEGATION_MAGIC, DELEGATION_VERSION, DelegationChain, DelegationError, DelegationLink,
71    DelegationResult, MAX_CHAIN_DEPTH_HARD_CAP, MAX_PARTITION_PATTERNS, MAX_PATTERN_LEN,
72    MAX_TOPIC_PATTERNS, SignatureAlgorithm,
73};
74pub use handshake_token::{
75    FinalBuildInput, FinalTokenView, ReplyBuildInput, ReplyTokenView, RequestBuildInput,
76    RequestTokenView, algo, build_final_token, build_reply_token, build_request_token, class_id,
77    compute_hash_c, parse_final_token, parse_reply_token, parse_request_token, prop, signing_bytes,
78};
79pub use identity::{CertKeyAlgo, IdentityConfig, PkiError};
80pub use identity_status::{
81    IDENTITY_STATUS_CLASS_ID, IdentityStatusKind, IdentityStatusToken, KEY_EXPIRY_TIME,
82    KEY_OCSP_RESPONSE, KEY_OCSP_STATUS, identity_status_properties,
83};
84pub use identity_token::{
85    IDENTITY_TOKEN_CLASS_ID, IdentityToken, KEY_CA_ALGO, KEY_CA_SN, KEY_CERT_ALGO, KEY_CERT_SN,
86    build_identity_token_from_pem, subject_match,
87};
88pub use ocsp::{OcspStatus, parse_ocsp_status, require_good_status};
89pub use plugin::PkiAuthenticationPlugin;
90pub use psk::{
91    HKDF_INFO_SHARED_SECRET, PROP_PSK_ID, PROP_PSK_KEY_HEX, PskAuthenticationPlugin,
92    derive_psk_shared_secret,
93};
94
95// Re-Exports aus `zerodds-security` fuer einfacheren Nutzer-Import.
96pub use zerodds_security::authentication::{
97    HandshakeHandle, HandshakeStepOutcome, IdentityHandle, SharedSecretHandle,
98};
99pub use zerodds_security::token::{BinaryProperty, DataHolder, WireProperty};
zerodds_security_pki/lib.rs

zerodds_security_pki/
lib.rs
