Module traits 

Provides simplified abstracted APIs over classes of cryptographic primitives, such as Hash, KDF, etc.

Enums

SecurityStrength

A general indicator used across the library for marking the security level of a cryptographic primitive, and for tracking the security level of the algorithms that interacted with a given piece of data. For example, if a KDF at the 128-bit security strength is used to produce a 512-bit key, that key will also be tagged as having a 128-bit security strength.

Traits

AEADCipher

The basic functions of an Authenticated Encryption with Addititional Data cipher.

Algorithm

Metadata about a cryptographic algorithm.

AlgorithmOID

Some algorithms have an assigned OID.

BlockCipher

The basic functions of a block cipher. This trait allows for a block cipher to generate initialization data, such as an Initialization Vector (IV) or Counter (CTR) which is not technically part of the ciphertext, but must be transmitted along with the ciphertext in order for the recipient to perform successful decryption. The length of the initialization data is specified by the implementing struct via the INIT_DATA_LEN constant. In order for these one-shot APIs to be usable securely in all contexts, the init data will be generated securely by the block cipher implementation and returned along with the ciphertext, and there is no API for the user to provide the init data. If you require this functionality, see the documentation for the underlying implementation.

Hash

A hash function is a cryptographic primitive that takes an input of any length and produces a fixed-size output. Formally: H: {0,1}^* -> {0,1}^n. A cryptographic hash function will typically satisfy several security properties, including:

HashAlgParams

Standard parameters for a hash function.

KDF

A Key Derivation Function (KDF) is a function that takes in one or more input key and some unstructured additional input, and uses them to produces a derived key.

KEMDecapsulator

A Key Encapsulation Mechanism (KEM) is defined as a set of three operations: key generation, encapsulation, and decapsulation.

KEMEncapsulator

A Key Encapsulation Mechanism (KEM) is defined as a set of three operations: key generation, encapsulation, and decapsulation.

KEMPrivateKey

A private key for a KEM algorithm, often denoted “sk” (for “secret key”).

KEMPublicKey

A public key for a KEM algorithm, often denoted “pk”.

MAC

A Message Authentication Code algorithm is a keyed hash function that behaves somewhat like a symmetric signature function. A MAC algorithm takes in a key and some data, and produces a MAC (message authentication code) that can be used to verify the integrity of data.

PHSignatureVerifier

Pre-Hashed Signature Verifier is an extension to SignatureVerifier that adds functionality specific to signature primatives that can operate on a pre-hashed message instead of the full message.

PHSigner

Pre-Hashed Signer is an extension to Signer that adds functionality specific to signature primatives that can operate on a pre-hashed message instead of the full message.

RNG

An interface for random number generation. This interface is meant to be simpler and more ergonomic than the interfaces provided by the rng crate, but that one should be used by applications that intend to submit to FIPS certification as it more closely aligns with the requirements of SP 800-90A. Note: this interface produces bytes. If you want a KeyMaterialTrait, then use KeyMaterial::from_rng.

SignaturePrivateKey

A private key for a signature algorithm, often denoted “sk” (for “secret key”).

SignaturePublicKey

A public key for a signature algorithm, often denoted “pk”.

SignatureVerifier

A digital signature algorithm is defined as a set of three operations: key generation, signing, and verification.

Signer

A digital signature algorithm is defined as a set of three operations: key generation, signing, and verification.

StreamCipher

The basic functions of a stream cipher, which differ from those of a block cipher only in that a stream cipher is assumed to have no underlying block size tied to the implementation, and so the caller gets to specify the block size for the streaming APIs.

Suspendable

Allows a stateful object to suspend its operation by serializing its state into a byte array so that it can be resumed later, potentially from a different host.

SuspendableKeyed

Similar to Suspendable in that it allows a stateful object to suspend its operation by serializing its state into a byte array so that it can be resumed later, potentially from a different host.

SymmetricCipher

The basic one-shot encrypt and decrypt that all types of symmetric ciphers must implement. These are meant to be simple, easy to use, secure, and fool-proof APIs, but they may result in ciphertexts that are incompatible with other implementations as ciphers in more complex modes, such as AEADs or stream ciphers may need to stick extra data either at the beginning or end of the ciphertext. See the documentation of the underlying implementation for more details.

XOF

Extensible Output Functions (XOFs) are similar to hash functions, except that they can produce output of arbitrary length. The naming used for the functions of this trait are borrowed from the SHA3-style sponge constructions that split XOF operation into two phases: an absorb phase in which an arbitrary amount of input is provided to the XOF, and then a squeeze phase in which an arbitrary amount of output is extracted. Once squeezing begins, no more input can be absorbed.