Module public_encryption 

The public-encryption primitive kind: asymmetric encryption. Anyone holding the public key encrypts; only the private-key holder decrypts. The dominant use is key transport — wrapping a symmetric key to a recipient — so the wrap operations sit beside encrypt/decrypt, riding the same provider-held intermediates as the key-wrap kind (see the wrapping interface).

Operations take and return whole byte lists rather than streams — the one kind that does. The plaintext is bounded by the key (for RSA-OAEP, the modulus length minus the padding overhead), so there is no unbounded data to stream; a payload above the bound fails with the named extension condition on encrypt/wrap.

Security:

• Encryption is randomized: encrypting one plaintext twice yields different ciphertexts, and both decrypt.
• decrypt and unwrap fail with one detail-free error (error.authentication-failed): a wrong-length ciphertext, damaged padding, and a mismatched label are indistinguishable, as RFC 8017 requires — a distinguishable verdict is a padding-oracle amplifier.

Structs

DecryptionKey

A private key. decrypt and unwrap are one-shot on the immutable key; the extractability contract in README.md applies.

DecryptionKeyOptions

Mint-time policy for decryption-keys, following the package-wide options contract (see README.md). The two grants separate disclosure from minting: decrypt returns plaintext to the caller, while unwrap mints keys whose material the caller never sees — a key granted only can-unwrap cannot leak what it transports (the derive-bits/derive-key split’s reasoning).

EncryptionKey

A public key: encryption and wrapping, secret-free to hold.

Type Aliases

Error

UnwrapInput

WrapInput