Struct CipherKey 

pub struct CipherKey { /* private fields */ }

An unauthenticated-cipher key: an unforgeable capability, bound to one algorithm at creation. The streaming, extractability, and getter contracts in README.md apply, and so do this interface’s Security notes — nothing this key does authenticates.

Implementations

impl CipherKey

pub async fn encrypt( &self, iv: Vec<u8>, counter_length: Option<u8>, plaintext: StreamReader<u8>, ) -> Result<StreamReader<u8>, Error>

Encrypt plaintext under iv. The returned stream carries exactly the ciphertext (the crypto.subtle.encrypt wire format; for padded modes that includes the final padding block).

iv must be the algorithm’s block-sized IV (the iv-size getter), else error.invalid-nonce. counter-length is the counter width in bits for counter-mode algorithms (AES-CTR: required, 1 to 128); algorithms without a counter reject a supplied value, and counter-mode algorithms reject none — both error.invalid-nonce. Callers of non-counter algorithms pass none and never match on algorithm-name.

Security:

• The caller owns the IV discipline (see the interface doc and the minting interface). Getting it wrong loses confidentiality, not just integrity.

impl CipherKey

pub async fn decrypt( &self, iv: Vec<u8>, counter_length: Option<u8>, ciphertext: StreamReader<u8>, ) -> Result<StreamReader<u8>, Error>

Decrypt ciphertext under iv. See encrypt for the iv and counter-length contracts.

Security:

• The plaintext is unauthenticated: treat it as attacker-influenced data even when decryption succeeds.
• Malformed input fails error.other, deliberately uniform across conditions (see the interface doc).

impl CipherKey

pub async fn wrap( &self, iv: Vec<u8>, counter_length: Option<u8>, input: WrapInput, ) -> Result<Vec<u8>, Error>

Encrypt serialized key material under iv, exactly as encrypt encrypts a message: for raw-format material the result is byte-identical to encrypting the exported bytes (the W3C Web Cryptography API’s wrapKey under an encryption algorithm). See encrypt for the iv and counter-length contracts; see the wrapping interface for the model.

Security:

• Nothing here authenticates, and the caller owns the IV discipline, as on encrypt. Prefer an aead or kw-key wrapping key; use this one only where an existing format fixes the mode.
• wrap and encrypt draw on the same key’s IV space: the algorithm’s uniqueness obligations (per-key uniqueness of CTR counter blocks above all) span both operations.

input is consumed. Requires can-wrap, else error.not-permitted.

impl CipherKey

pub async fn unwrap( &self, iv: Vec<u8>, counter_length: Option<u8>, wrapped: Vec<u8>, ) -> Result<UnwrapInput, Error>

Decrypt wrapped key material, as produced by wrap (or by encrypt over the same serialization) under iv. See encrypt for the iv and counter-length contracts. The result awaits an unwrap mint (see unwrap-input); the material never reaches the caller.

Security:

• The result is unauthenticated: a success is no evidence the wrapped material is untampered, and the typed mint’s parse is not authentication. Malformed input fails error.other, deliberately uniform across conditions (see the interface doc) — here, or at the consuming mint when decryption is deferred (see unwrap-input).

Requires can-unwrap, else error.not-permitted.

impl CipherKey

pub fn algorithm_name(&self) -> String

The registry name of the algorithm family this key is bound to, e.g. "AES-CBC" (WebCrypto’s KeyAlgorithm.name). Parameters are separate getters, as for mac-key.algorithm-name.

impl CipherKey

pub fn algorithm_length(&self) -> u32

The key length in bits, e.g. 256 (WebCrypto’s AesKeyAlgorithm.length).

impl CipherKey

pub fn iv_size(&self) -> u32

The algorithm’s IV size in bytes, e.g. 16 for the AES modes (the CBC IV, or the CTR initial counter block). encrypt and decrypt accept exactly this length.

impl CipherKey

pub fn extractable(&self) -> bool

Whether the key material may be exported.

impl CipherKey

pub fn can_encrypt(&self) -> bool

Whether this key permits encrypt. A refused operation fails error.not-permitted.

impl CipherKey

pub fn can_decrypt(&self) -> bool

Whether this key permits decrypt. See can-encrypt.

impl CipherKey

pub fn can_wrap(&self) -> bool

Whether this key permits wrap. A refused operation fails error.not-permitted.

impl CipherKey

pub fn can_unwrap(&self) -> bool

Whether this key permits unwrap. See can-wrap.

impl CipherKey

pub async fn export_key_raw(&self) -> Result<Vec<u8>, Error>

The raw key material. Fails with error.not-extractable unless the key was created with extractable true.

impl CipherKey

pub async fn export_key_jwk(&self) -> Result<String, Error>

The key as an RFC 7517 JSON Web Key, behind the same extractability gate as export-key-raw. See README.md, “JWK contract”.

impl CipherKey

pub async fn to_wrap_input_raw(&self) -> Result<WrapInput, Error>

This key’s raw material as a wrap-input, for wrapping under another key (see the wrapping interface). Behind the same extractability gate as export-key-raw; the material itself never reaches the caller.

impl CipherKey

pub async fn to_wrap_input_jwk(&self) -> Result<WrapInput, Error>

The JWK serialization as a wrap-input, behind the same gate. See README.md, “JWK contract”.

Trait Implementations

impl Debug for CipherKey

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl From<CipherKey> for CipherKey

fn from(raw: CipherKey) -> Self

Converts to this type from the input type.