Skip to main content

HostSecretKeyWithStore

polymorph_webcrypto_wasmtime::bindings::webcrypto::key_agreement

Trait HostSecretKeyWithStore 

Source 
pub trait HostSecretKeyWithStore<T>: HasData + Send {
    // Required methods
    fn drop(
        accessor: &Accessor<T, Self>,
        rep: Resource<SecretKey>,
    ) -> impl Future<Output = Result<()>> + Send
       where Self: Sized;
    fn agree(
        accessor: &Accessor<T, Self>,
        self_: Resource<SecretKey>,
        peer: Resource<PublicKey>,
    ) -> impl Future<Output = Result<Result<Resource<DeriveInput>, Error>>> + Send;
    fn export_key_jwk(
        accessor: &Accessor<T, Self>,
        self_: Resource<SecretKey>,
    ) -> impl Future<Output = Result<Result<String, Error>>> + Send;
    fn export_key_pkcs8(
        accessor: &Accessor<T, Self>,
        self_: Resource<SecretKey>,
    ) -> impl Future<Output = Result<Result<Vec<u8>, Error>>> + Send;
    fn to_wrap_input_jwk(
        accessor: &Accessor<T, Self>,
        self_: Resource<SecretKey>,
    ) -> impl Future<Output = Result<Result<Resource<WrapInput>, Error>>> + Send;
    fn to_wrap_input_pkcs8(
        accessor: &Accessor<T, Self>,
        self_: Resource<SecretKey>,
    ) -> impl Future<Output = Result<Result<Resource<WrapInput>, Error>>> + Send;
}

Required Methods§

Source

fn drop( accessor: &Accessor<T, Self>, rep: Resource<SecretKey>, ) -> impl Future<Output = Result<()>> + Send
where Self: Sized,

Source

fn agree( accessor: &Accessor<T, Self>, self_: Resource<SecretKey>, peer: Resource<PublicKey>, ) -> impl Future<Output = Result<Result<Resource<DeriveInput>, Error>>> + Send

The shared secret with peer, as a derive-input whose grants are copied from this key’s mint options (the Web Cryptography API’s model: derive usages live on the secret key).

The returned input has a natural output length — the agreement’s full shared secret (32 bytes for X25519; the curve’s field size for ECDH) — so derive-bits(none) returns the whole secret and hkdf-sha2.prepare-from accepts it as IKM.

Security:

  • Fails error.invalid-key if the shared secret is the all-zero value (a small-order peer), checked in constant time — the W3C Web Cryptography API’s mandatory contributory check, at the operation that computes the secret. Whether a degenerate peer can reach this check is the minting interface’s import contract: X25519’s deliberately permissive import admits one, and it surfaces here; ECDH’s strict import rejects it at the mint.
  • Fails error.invalid-key if peer is bound to a different algorithm than this key.
Source

fn export_key_jwk( accessor: &Accessor<T, Self>, self_: Resource<SecretKey>, ) -> impl Future<Output = Result<Result<String, Error>>> + Send

The secret key as an RFC 8037 OKP private JWK. Fails error.not-extractable unless the key was minted extractable; fallible beyond the gate like every export (README.md, “Extractability”).

Source

fn export_key_pkcs8( accessor: &Accessor<T, Self>, self_: Resource<SecretKey>, ) -> impl Future<Output = Result<Result<Vec<u8>, Error>>> + Send

The secret key as a PKCS#8 PrivateKeyInfo (DER), behind the same extractability gate as export-key-jwk.

Source

fn to_wrap_input_jwk( accessor: &Accessor<T, Self>, self_: Resource<SecretKey>, ) -> impl Future<Output = Result<Result<Resource<WrapInput>, Error>>> + Send

The private-key JWK serialization as a wrap-input, for wrapping under another key (see the wrapping interface). Behind the same extractability gate as export-key-jwk, and fallible beyond it like every export; the material itself never reaches the caller.

Source

fn to_wrap_input_pkcs8( accessor: &Accessor<T, Self>, self_: Resource<SecretKey>, ) -> impl Future<Output = Result<Result<Resource<WrapInput>, Error>>> + Send

The PKCS#8 serialization as a wrap-input, behind the same gate.

Dyn Compatibility§

This trait is not dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety", so this trait is not object safe.

Implementors§