Skip to main content

HsmSigner

kipuka_hsm::sign

Trait HsmSigner 

Source 
pub trait HsmSigner {
    // Required methods
    fn sign(&self, key: &HsmKeyPair, digest: &[u8]) -> HsmResult<Vec<u8>>;
    fn sign_with_mechanism(
        &self,
        key: &HsmKeyPair,
        digest: &[u8],
        mechanism: &Mechanism<'_>,
    ) -> HsmResult<Vec<u8>>;
    fn wrap_key_aes(
        &self,
        session: &Session,
        wrapping_key: ObjectHandle,
        key_to_wrap: ObjectHandle,
    ) -> HsmResult<Vec<u8>>;
    fn wrap_key_rsa_oaep(
        &self,
        session: &Session,
        wrapping_key: ObjectHandle,
        key_to_wrap: ObjectHandle,
    ) -> HsmResult<Vec<u8>>;
    fn ml_kem_encapsulate(
        &self,
        session: &Session,
        public_key: ObjectHandle,
    ) -> HsmResult<(Vec<u8>, Vec<u8>)>;
    fn ml_kem_decapsulate(
        &self,
        session: &Session,
        private_key: ObjectHandle,
        ciphertext: &[u8],
    ) -> HsmResult<Vec<u8>>;
}
Expand description

HSM signer trait.

Required Methods§

Source

fn sign(&self, key: &HsmKeyPair, digest: &[u8]) -> HsmResult<Vec<u8>>

Sign a message digest.

§Arguments
  • key - Key pair to sign with
  • digest - Pre-computed message digest
§Returns

The signature bytes.

Source

fn sign_with_mechanism( &self, key: &HsmKeyPair, digest: &[u8], mechanism: &Mechanism<'_>, ) -> HsmResult<Vec<u8>>

Sign a message digest with a specific mechanism.

Source

fn wrap_key_aes( &self, session: &Session, wrapping_key: ObjectHandle, key_to_wrap: ObjectHandle, ) -> HsmResult<Vec<u8>>

Wrap a key using AES Key Wrap (RFC 3394).

Used for wrapping ML-KEM private keys during /serverkeygen.

Source

fn wrap_key_rsa_oaep( &self, session: &Session, wrapping_key: ObjectHandle, key_to_wrap: ObjectHandle, ) -> HsmResult<Vec<u8>>

Wrap a key using RSAES-OAEP with SHA-256.

Source

fn ml_kem_encapsulate( &self, session: &Session, public_key: ObjectHandle, ) -> HsmResult<(Vec<u8>, Vec<u8>)>

ML-KEM encapsulate operation via PKCS#11 v3.2 C_EncapsulateKey.

§Arguments
  • session - PKCS#11 session
  • public_key - ML-KEM public key
§Returns

(ciphertext, shared_secret_handle) — the shared secret is returned as a CKK_GENERIC_SECRET object handle inside the token. The caller must extract or use it via PKCS#11 operations.

Source

fn ml_kem_decapsulate( &self, session: &Session, private_key: ObjectHandle, ciphertext: &[u8], ) -> HsmResult<Vec<u8>>

ML-KEM decapsulate operation via PKCS#11 v3.2 C_DecapsulateKey.

§Arguments
  • session - PKCS#11 session
  • private_key - ML-KEM private key
  • ciphertext - Ciphertext from encapsulate
§Returns

The shared secret bytes (extracted from the derived key object).

Implementors§