Struct DeriveInput 

pub struct DeriveInput(/* private fields */);

A derivation.derive-input: a fully parameterized derivation — base secret plus every parameter, minted by the prepare functions (hkdf_sha2::prepare, pbkdf2_sha2::prepare, …) and by AgreementSecretKey::agree.

Consume it through derive_bits or hand it to a target interface’s derive_key (e.g. hmac_sha2::derive_key, aes_gcm::derive_key); both may run any number of times. While an input is live it may hold derivation state of its own (for HKDF, the PRK), so a base secret’s sensitivity extends to the inputs built on it.

Implementations

impl DeriveInput

pub fn from_raw(raw: DeriveInput) -> Self

Wrap a raw derive-input resource.

pub fn as_raw(&self) -> &DeriveInput

Borrow the raw derive-input resource.

pub fn into_raw(self) -> DeriveInput

Unwrap into the raw derive-input resource.

impl DeriveInput

pub async fn derive_bits(&self, length: Option<u32>) -> Result<Vec<u8>, Error>

The derived bits.

length is in bits — WebCrypto’s denomination for this parameter — and must be a multiple of 8 (none of the package’s implementations serve sub-byte outputs). None means the source’s natural output length: an agreement’s full shared secret (32 bytes for X25519). KDF sources have none — their output length is a caller choice — so None fails Error::Other there, matching the platform’s own null-length behavior.

Fails Error::NotPermitted without the derive_bits grant.

pub fn can_derive_bits(&self) -> bool

Whether derive_bits (and minting extractable keys) is permitted — the grant copied from the base secret. A refused operation fails Error::NotPermitted.

pub fn can_derive_key(&self) -> bool

Whether the target interfaces’ derive_key is permitted. See can_derive_bits.

Trait Implementations

impl Debug for DeriveInput

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl From<DeriveInput> for DeriveInput

fn from(raw: DeriveInput) -> Self

Converts to this type from the input type.