Struct EncryptionKey 

pub struct EncryptionKey(/* private fields */);

A public-encryption.encryption-key: the public half of asymmetric encryption — encryption and wrapping, secret-free to hold.

Operations take and return whole byte buffers rather than DataSources: the plaintext is bounded by the key (for RSA-OAEP, the modulus length minus the padding overhead), so there is nothing unbounded to stream. Encryption is randomized — encrypting one plaintext twice yields different ciphertexts, and both decrypt.

Implementations

impl EncryptionKey

pub fn from_raw(raw: EncryptionKey) -> Self

Wrap a raw encryption-key resource.

pub fn as_raw(&self) -> &EncryptionKey

Borrow the raw encryption-key resource.

pub fn into_raw(self) -> EncryptionKey

Unwrap into the raw encryption-key resource.

impl EncryptionKey

pub async fn encrypt( &self, label: Option<&[u8]>, plaintext: impl Into<Vec<u8>>, ) -> Result<Vec<u8>, Error>

Encrypt a plaintext bounded by the key. label is optional context bound into the padding: decryption succeeds only under the same label (WebCrypto’s RsaOaepParams.label). A plaintext above the key’s bound fails Error::Extension (origin "polymorph:webcrypto", name "message-too-long") — the signal to switch to hybrid wrapping: encrypt a symmetric key, wrap the payload under it.

pub async fn wrap( &self, label: Option<&[u8]>, input: WrapInput, ) -> Result<Vec<u8>, Error>

Wrap key material serialized as a WrapInput: the material transits neither caller. The serialized form must fit the key’s bound — symmetric-key JWKs do, private-key serializations generally do not — else the same "message-too-long" extension condition as encrypt. Consumes the WrapInput.

pub fn algorithm_name(&self) -> String

The registry name of the key’s algorithm family, e.g. "RSA-OAEP" — WebCrypto’s KeyAlgorithm.name.

pub fn algorithm_hash(&self) -> Option<String>

The registry name of the digest bound at mint, e.g. "SHA-256".

pub fn algorithm_length(&self) -> Option<u32>

The key’s length in bits for algorithms parameterized by one — the RSA modulus length (WebCrypto’s RsaKeyAlgorithm.modulusLength).

pub fn algorithm_public_exponent(&self) -> Option<Vec<u8>>

The public exponent’s big-endian bytes (WebCrypto’s RsaKeyAlgorithm.publicExponent; [1, 0, 1] for 65537).

pub async fn export_key_raw(&self) -> Result<Vec<u8>, Error>

The public key material, in the minting interface’s documented public format. Algorithms without a raw public form (the RSA family) fail Error::Unsupported.

There is no extractability gate on public material, so this never fails Error::NotExtractable — but it can fail Error::Other: a provider may hold the key as a handle it can use but not read (see VerifyingKey::export_key_raw).

pub async fn export_key_spki(&self) -> Result<Vec<u8>, Error>

The public key as an X.509 SubjectPublicKeyInfo (DER), with the same handle-not-bytes fallibility as export_key_raw.

pub async fn export_key_jwk(&self) -> Result<String, Error>

The public key as a JWK (JSON text), with the same fallibility as export_key_raw.

Trait Implementations

impl Debug for EncryptionKey

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl From<EncryptionKey> for EncryptionKey

fn from(raw: EncryptionKey) -> Self

Converts to this type from the input type.