Struct WasiWebcrypto 

pub struct WasiWebcrypto;

The type for which this crate implements the polymorph:webcrypto interfaces. Used as the [HasData] marker for the generated bindings.

Trait Implementations

impl HasData for WasiWebcrypto

type Data<'a> = WasiWebcryptoCtxView<'a>

The data associated with this trait implementation, chiefly used as a generic associated type to allow plumbing the 'a lifetime into the definition here.

impl<T: Send> HostAeadKeyOptionsWithStore<T> for WasiWebcrypto

async fn drop( accessor: &Accessor<T, Self>, rep: Resource<AeadKeyOptions>, ) -> Result<()>

impl<T: Send> HostAeadKeyWithStore<T> for WasiWebcrypto

async fn seal( accessor: &Accessor<T, Self>, self_: Resource<AeadKey>, nonce: Vec<u8>, aad: Vec<u8>, tag_size: Option<u8>, plaintext: StreamReader<u8>, ) -> Result<Result<StreamReader<u8>, Error>>

Encrypt and authenticate plaintext under nonce with the associated data aad. The returned stream carries the ciphertext followed by the authentication tag (the crypto.subtle.encrypt wire format).

async fn open( accessor: &Accessor<T, Self>, self_: Resource<AeadKey>, nonce: Vec<u8>, aad: Vec<u8>, tag_size: Option<u8>, ciphertext: StreamReader<u8>, ) -> Result<Result<StreamReader<u8>, Error>>

Decrypt and verify ciphertext (ciphertext followed by a tag-size-byte tag, as produced by seal) under nonce and aad. See seal for the nonce and tag-size contracts.

async fn export_key_raw( accessor: &Accessor<T, Self>, self_: Resource<AeadKey>, ) -> Result<Result<Vec<u8>, Error>>

The raw key material. Fails with error.not-extractable unless the key was created with extractable true.

async fn export_key_jwk( accessor: &Accessor<T, Self>, self_: Resource<AeadKey>, ) -> Result<Result<String, Error>>

The key as an RFC 7517 JSON Web Key, behind the same extractability gate as export-key-raw. See README.md, “JWK contract”. Algorithms with no registered JWK form fail error.unsupported.

async fn wrap( accessor: &Accessor<T, Self>, self_: Resource<AeadKey>, nonce: Vec<u8>, aad: Vec<u8>, tag_size: Option<u8>, input: Resource<WrapInput>, ) -> Result<Result<Vec<u8>, Error>>

Encrypt and authenticate serialized key material under nonce with the associated data aad, exactly as seal encrypts a message: the result is ciphertext followed by tag — for raw-format material, byte-identical to sealing the exported bytes (the W3C Web Cryptography API’s wrapKey). See seal for the nonce and tag-size contracts; see the wrapping interface for the model.

async fn unwrap( accessor: &Accessor<T, Self>, self_: Resource<AeadKey>, nonce: Vec<u8>, aad: Vec<u8>, tag_size: Option<u8>, wrapped: Vec<u8>, ) -> Result<Result<Resource<UnwrapInput>, Error>>

Decrypt and verify wrapped key material, as produced by wrap (or by seal over the same serialization) under nonce and aad. See seal for the nonce and tag-size contracts. The result awaits an unwrap mint (see unwrap-input, including the verification-timing latitude); the material never reaches the caller.

async fn to_wrap_input_raw( accessor: &Accessor<T, Self>, self_: Resource<AeadKey>, ) -> Result<Result<Resource<WrapInput>, Error>>

This key’s raw material as a wrap-input, for wrapping under another key (see the wrapping interface). Behind the same extractability gate as export-key-raw; the material itself never reaches the caller.

async fn to_wrap_input_jwk( accessor: &Accessor<T, Self>, self_: Resource<AeadKey>, ) -> Result<Result<Resource<WrapInput>, Error>>

The JWK serialization as a wrap-input, behind the same gate; algorithms with no registered JWK form fail error.unsupported, as on export-key-jwk.

async fn drop( accessor: &Accessor<T, Self>, rep: Resource<AeadKey>, ) -> Result<()>

impl<T: Send> HostAgreementKeyOptionsWithStore<T> for WasiWebcrypto

async fn drop( accessor: &Accessor<T, Self>, rep: Resource<AgreementKeyOptions>, ) -> Result<()>

impl<T: Send> HostCipherKeyOptionsWithStore<T> for WasiWebcrypto

async fn drop( accessor: &Accessor<T, Self>, rep: Resource<CipherKeyOptions>, ) -> Result<()>

impl<T: Send> HostCipherKeyWithStore<T> for WasiWebcrypto

async fn encrypt( accessor: &Accessor<T, Self>, self_: Resource<CipherKey>, iv: Vec<u8>, counter_length: Option<u8>, plaintext: StreamReader<u8>, ) -> Result<Result<StreamReader<u8>, Error>>

Encrypt plaintext under iv. The returned stream carries exactly the ciphertext (the crypto.subtle.encrypt wire format; for padded modes that includes the final padding block).

async fn decrypt( accessor: &Accessor<T, Self>, self_: Resource<CipherKey>, iv: Vec<u8>, counter_length: Option<u8>, ciphertext: StreamReader<u8>, ) -> Result<Result<StreamReader<u8>, Error>>

Decrypt ciphertext under iv. See encrypt for the iv and counter-length contracts.

async fn export_key_raw( accessor: &Accessor<T, Self>, self_: Resource<CipherKey>, ) -> Result<Result<Vec<u8>, Error>>

The raw key material. Fails with error.not-extractable unless the key was created with extractable true.

async fn export_key_jwk( accessor: &Accessor<T, Self>, self_: Resource<CipherKey>, ) -> Result<Result<String, Error>>

The key as an RFC 7517 JSON Web Key, behind the same extractability gate as export-key-raw. See README.md, “JWK contract”.

async fn wrap( accessor: &Accessor<T, Self>, self_: Resource<CipherKey>, iv: Vec<u8>, counter_length: Option<u8>, input: Resource<WrapInput>, ) -> Result<Result<Vec<u8>, Error>>

Encrypt serialized key material under iv, exactly as encrypt encrypts a message: for raw-format material the result is byte-identical to encrypting the exported bytes (the W3C Web Cryptography API’s wrapKey under an encryption algorithm). See encrypt for the iv and counter-length contracts; see the wrapping interface for the model.

async fn unwrap( accessor: &Accessor<T, Self>, self_: Resource<CipherKey>, iv: Vec<u8>, counter_length: Option<u8>, wrapped: Vec<u8>, ) -> Result<Result<Resource<UnwrapInput>, Error>>

Decrypt wrapped key material, as produced by wrap (or by encrypt over the same serialization) under iv. See encrypt for the iv and counter-length contracts. The result awaits an unwrap mint (see unwrap-input); the material never reaches the caller.

async fn to_wrap_input_raw( accessor: &Accessor<T, Self>, self_: Resource<CipherKey>, ) -> Result<Result<Resource<WrapInput>, Error>>

This key’s raw material as a wrap-input, for wrapping under another key (see the wrapping interface). Behind the same extractability gate as export-key-raw; the material itself never reaches the caller.

async fn to_wrap_input_jwk( accessor: &Accessor<T, Self>, self_: Resource<CipherKey>, ) -> Result<Result<Resource<WrapInput>, Error>>

The JWK serialization as a wrap-input, behind the same gate. See README.md, “JWK contract”.

async fn drop( accessor: &Accessor<T, Self>, rep: Resource<CipherKey>, ) -> Result<()>

impl<T: Send> HostDecryptionKeyOptionsWithStore<T> for WasiWebcrypto

async fn drop( accessor: &Accessor<T, Self>, rep: Resource<DecryptionKeyOptions>, ) -> Result<()>

impl<T: Send> HostDecryptionKeyWithStore<T> for WasiWebcrypto

async fn decrypt( accessor: &Accessor<T, Self>, self_: Resource<DecryptionKey>, label: Option<Vec<u8>>, ciphertext: Vec<u8>, ) -> Result<Result<Vec<u8>, Error>>

Decrypt a ciphertext produced by the matching public key under the same label. Fails error.not-permitted without the can-decrypt grant; every decryption failure is the one detail-free error.authentication-failed (see the interface doc).

async fn unwrap( accessor: &Accessor<T, Self>, self_: Resource<DecryptionKey>, label: Option<Vec<u8>>, ciphertext: Vec<u8>, ) -> Result<Result<Resource<UnwrapInput>, Error>>

Decrypt a wrapped key into an unwrap-input for a typed unwrap mint (see the wrapping interface): the material never reaches the caller. Fails error.not-permitted without the can-unwrap grant; failures are otherwise as decrypt.

async fn export_key_jwk( accessor: &Accessor<T, Self>, self_: Resource<DecryptionKey>, ) -> Result<Result<String, Error>>

The private key as a JWK, behind the extractability gate and fallible beyond it like every export (README.md, “Extractability”).

async fn export_key_pkcs8( accessor: &Accessor<T, Self>, self_: Resource<DecryptionKey>, ) -> Result<Result<Vec<u8>, Error>>

The private key as a PKCS#8 PrivateKeyInfo (DER), behind the same gate.

async fn to_wrap_input_jwk( accessor: &Accessor<T, Self>, self_: Resource<DecryptionKey>, ) -> Result<Result<Resource<WrapInput>, Error>>

The private-key JWK serialization as a wrap-input, for wrapping under another key. Behind the extractability gate.

async fn to_wrap_input_pkcs8( accessor: &Accessor<T, Self>, self_: Resource<DecryptionKey>, ) -> Result<Result<Resource<WrapInput>, Error>>

The PKCS#8 serialization as a wrap-input, behind the same gate.

async fn drop( accessor: &Accessor<T, Self>, rep: Resource<DecryptionKey>, ) -> Result<()>

impl<T: Send> HostDeriveInputWithStore<T> for WasiWebcrypto

async fn derive_bits( accessor: &Accessor<T, Self>, self_: Resource<DeriveInput>, length: Option<u32>, ) -> Result<Result<Vec<u8>, Error>>

The derived bits.

async fn drop( accessor: &Accessor<T, Self>, rep: Resource<DeriveInput>, ) -> Result<()>

impl<T: Send> HostDeriveOptionsWithStore<T> for WasiWebcrypto

async fn drop( accessor: &Accessor<T, Self>, rep: Resource<DeriveOptions>, ) -> Result<()>

impl<T: Send> HostDigestWithStore<T> for WasiWebcrypto

async fn compute( accessor: &Accessor<T, Self>, self_: Resource<Digest>, data: StreamReader<u8>, ) -> Result<Result<Vec<u8>, Error>>

Digest an entire byte stream. A success resolves only after the stream is fully drained (its writer dropped).

async fn drop(accessor: &Accessor<T, Self>, rep: Resource<Digest>) -> Result<()>

impl<T: Send> HostEncryptionKeyWithStore<T> for WasiWebcrypto

async fn encrypt( accessor: &Accessor<T, Self>, self_: Resource<EncryptionKey>, label: Option<Vec<u8>>, plaintext: Vec<u8>, ) -> Result<Result<Vec<u8>, Error>>

Encrypt a plaintext bounded by the key. label is optional context bound into the padding: decryption succeeds only under the same label (WebCrypto’s RsaOaepParams.label). A plaintext above the key’s bound fails error.extension — origin "polymorph:webcrypto", name "message-too-long" — the signal to switch to hybrid wrapping (encrypt a symmetric key, wrap the payload under it).

async fn wrap( accessor: &Accessor<T, Self>, self_: Resource<EncryptionKey>, label: Option<Vec<u8>>, input: Resource<WrapInput>, ) -> Result<Result<Vec<u8>, Error>>

Wrap key material serialized as a wrap-input (see the wrapping interface): the material transits neither caller. The serialized form must fit the key’s bound — symmetric-key JWKs do, private-key serializations generally do not — else error.extension "message-too-long", as on encrypt.

async fn export_key_raw( accessor: &Accessor<T, Self>, self_: Resource<EncryptionKey>, ) -> Result<Result<Vec<u8>, Error>>

The public key material, in the minting interface’s documented public format; algorithms without a raw public form (the RSA family) fail error.unsupported. No extractability gate — public keys are unconditionally exportable — but still fallible: a provider may hold a handle it can use but not read (see README.md, “Extractability”).

async fn export_key_spki( accessor: &Accessor<T, Self>, self_: Resource<EncryptionKey>, ) -> Result<Result<Vec<u8>, Error>>

The public key as an X.509 SubjectPublicKeyInfo (DER), with the same fallibility as export-key-raw.

async fn export_key_jwk( accessor: &Accessor<T, Self>, self_: Resource<EncryptionKey>, ) -> Result<Result<String, Error>>

The public key as a JWK. See mac-key.export-key-jwk for the package-wide JWK contract; the same fallibility applies.

async fn drop( accessor: &Accessor<T, Self>, rep: Resource<EncryptionKey>, ) -> Result<()>

impl<T: Send> HostIkmWithStore<T> for WasiWebcrypto

async fn drop(accessor: &Accessor<T, Self>, rep: Resource<Ikm>) -> Result<()>

impl<T: Send> HostKwKeyOptionsWithStore<T> for WasiWebcrypto

async fn drop( accessor: &Accessor<T, Self>, rep: Resource<KwKeyOptions>, ) -> Result<()>

impl<T: Send> HostKwKeyWithStore<T> for WasiWebcrypto

async fn wrap( accessor: &Accessor<T, Self>, self_: Resource<KwKey>, input: Resource<WrapInput>, ) -> Result<Result<Vec<u8>, Error>>

Encrypt serialized key material. The minting interface documents the wrapped wire format and the algorithm’s input domain; material whose serialization falls outside that domain fails error.invalid-key.

async fn unwrap( accessor: &Accessor<T, Self>, self_: Resource<KwKey>, wrapped: Vec<u8>, ) -> Result<Result<Resource<UnwrapInput>, Error>>

Decrypt and integrity-check wrapped key material, as produced by wrap under the same algorithm. The result awaits a typed mint (see unwrap-input, including the verification-timing latitude); the material never reaches the caller.

async fn to_wrap_input_raw( accessor: &Accessor<T, Self>, self_: Resource<KwKey>, ) -> Result<Result<Resource<WrapInput>, Error>>

This key’s raw material as a wrap-input, for wrapping under another key. Behind the same extractability gate as export-key-raw; the material itself never reaches the caller.

async fn to_wrap_input_jwk( accessor: &Accessor<T, Self>, self_: Resource<KwKey>, ) -> Result<Result<Resource<WrapInput>, Error>>

The JWK serialization as a wrap-input, behind the same gate. See README.md, “JWK contract”.

async fn export_key_raw( accessor: &Accessor<T, Self>, self_: Resource<KwKey>, ) -> Result<Result<Vec<u8>, Error>>

The raw key material. Fails with error.not-extractable unless the key was created with extractable true.

async fn export_key_jwk( accessor: &Accessor<T, Self>, self_: Resource<KwKey>, ) -> Result<Result<String, Error>>

The key as an RFC 7517 JSON Web Key, behind the same extractability gate as export-key-raw. See README.md, “JWK contract”.

async fn drop(accessor: &Accessor<T, Self>, rep: Resource<KwKey>) -> Result<()>

impl<T: Send> HostMacKeyOptionsWithStore<T> for WasiWebcrypto

async fn drop( accessor: &Accessor<T, Self>, rep: Resource<MacKeyOptions>, ) -> Result<()>

impl<T: Send> HostMacKeyWithStore<T> for WasiWebcrypto

async fn sign( accessor: &Accessor<T, Self>, self_: Resource<MacKey>, data: StreamReader<u8>, ) -> Result<Result<Vec<u8>, Error>>

Compute the authentication tag over an entire byte stream keyed by this key. A success resolves only after the stream is fully drained (its writer dropped).

async fn verify( accessor: &Accessor<T, Self>, self_: Resource<MacKey>, data: StreamReader<u8>, tag: Vec<u8>, ) -> Result<Result<(), Error>>

Verify tag against the tag computed over an entire byte stream keyed by this key, in constant time. Both verdicts — ok and error.authentication-failed — are computed over the entire stream and resolve only after it is fully drained.

async fn export_key_raw( accessor: &Accessor<T, Self>, self_: Resource<MacKey>, ) -> Result<Result<Vec<u8>, Error>>

The raw key material. Fails with error.not-extractable unless the key was created with extractable true.

async fn export_key_jwk( accessor: &Accessor<T, Self>, self_: Resource<MacKey>, ) -> Result<Result<String, Error>>

The key as an RFC 7517 JSON Web Key, behind the same extractability gate as export-key-raw. See README.md, “JWK contract”.

async fn to_wrap_input_raw( accessor: &Accessor<T, Self>, self_: Resource<MacKey>, ) -> Result<Result<Resource<WrapInput>, Error>>

This key’s raw material as a wrap-input, for wrapping under another key (see the wrapping interface). Behind the same extractability gate as export-key-raw; the material itself never reaches the caller.

async fn to_wrap_input_jwk( accessor: &Accessor<T, Self>, self_: Resource<MacKey>, ) -> Result<Result<Resource<WrapInput>, Error>>

The JWK serialization as a wrap-input, behind the same gate. See README.md, “JWK contract”.

async fn drop(accessor: &Accessor<T, Self>, rep: Resource<MacKey>) -> Result<()>

impl<T: Send> HostPasswordWithStore<T> for WasiWebcrypto

async fn drop( accessor: &Accessor<T, Self>, rep: Resource<Password>, ) -> Result<()>

impl<T: Send> HostPublicKeyWithStore<T> for WasiWebcrypto

async fn export_key_raw( accessor: &Accessor<T, Self>, self_: Resource<AgreementPublicKey>, ) -> Result<Result<Vec<u8>, Error>>

The public key material, in the minting interface’s documented public format. Fallible with error.other even though this resource has no extractability gate: a provider may hold the key as a handle it can use but not read.

async fn export_key_jwk( accessor: &Accessor<T, Self>, self_: Resource<AgreementPublicKey>, ) -> Result<Result<String, Error>>

The public key as a JWK, e.g. an RFC 8037 OKP public key for X25519. See mac-key.export-key-jwk for the package-wide JWK contract; the same handle-not-bytes fallibility as export-key-raw applies.

async fn export_key_spki( accessor: &Accessor<T, Self>, self_: Resource<AgreementPublicKey>, ) -> Result<Result<Vec<u8>, Error>>

The public key as an X.509 SubjectPublicKeyInfo (DER). The same handle-not-bytes fallibility as export-key-raw applies.

async fn drop( accessor: &Accessor<T, Self>, rep: Resource<AgreementPublicKey>, ) -> Result<()>

impl<T: Send> HostSecretKeyWithStore<T> for WasiWebcrypto

async fn agree( accessor: &Accessor<T, Self>, self_: Resource<AgreementSecretKey>, peer: Resource<AgreementPublicKey>, ) -> Result<Result<Resource<DeriveInput>, Error>>

The shared secret with peer, as a derive-input whose grants are copied from this key’s mint options (the Web Cryptography API’s model: derive usages live on the secret key).

async fn export_key_jwk( accessor: &Accessor<T, Self>, self_: Resource<AgreementSecretKey>, ) -> Result<Result<String, Error>>

The secret key as an RFC 8037 OKP private JWK. Fails error.not-extractable unless the key was minted extractable; fallible beyond the gate like every export (README.md, “Extractability”).

async fn export_key_pkcs8( accessor: &Accessor<T, Self>, self_: Resource<AgreementSecretKey>, ) -> Result<Result<Vec<u8>, Error>>

The secret key as a PKCS#8 PrivateKeyInfo (DER), behind the same extractability gate as export-key-jwk.

async fn to_wrap_input_jwk( accessor: &Accessor<T, Self>, self_: Resource<AgreementSecretKey>, ) -> Result<Result<Resource<WrapInput>, Error>>

The private-key JWK serialization as a wrap-input, for wrapping under another key (see the wrapping interface). Behind the same extractability gate as export-key-jwk, and fallible beyond it like every export; the material itself never reaches the caller.

async fn to_wrap_input_pkcs8( accessor: &Accessor<T, Self>, self_: Resource<AgreementSecretKey>, ) -> Result<Result<Resource<WrapInput>, Error>>

The PKCS#8 serialization as a wrap-input, behind the same gate.

async fn drop( accessor: &Accessor<T, Self>, rep: Resource<AgreementSecretKey>, ) -> Result<()>

impl<T: Send> HostSigningKeyOptionsWithStore<T> for WasiWebcrypto

async fn drop( accessor: &Accessor<T, Self>, rep: Resource<SigningKeyOptions>, ) -> Result<()>

impl<T: Send> HostSigningKeyWithStore<T> for WasiWebcrypto

async fn sign( accessor: &Accessor<T, Self>, self_: Resource<SigningKey>, data: StreamReader<u8>, ) -> Result<Result<Vec<u8>, Error>>

Sign an entire byte stream. A success resolves only after the stream is fully drained (its writer dropped). The minting interface documents the signature’s wire format.

async fn export_key_jwk( accessor: &Accessor<T, Self>, self_: Resource<SigningKey>, ) -> Result<Result<String, Error>>

The private key as a JWK (an RFC 8037 OKP private key for Ed25519, an EC private key for ECDSA). Fails error.not-extractable unless the key was minted extractable; fallible beyond the gate like every export (README.md, “Extractability”). See mac-key.export-key-jwk for the package-wide JWK contract.

async fn export_key_pkcs8( accessor: &Accessor<T, Self>, self_: Resource<SigningKey>, ) -> Result<Result<Vec<u8>, Error>>

The private key as a PKCS#8 PrivateKeyInfo (DER), behind the same extractability gate as export-key-jwk.

async fn to_wrap_input_jwk( accessor: &Accessor<T, Self>, self_: Resource<SigningKey>, ) -> Result<Result<Resource<WrapInput>, Error>>

The private-key JWK serialization as a wrap-input, for wrapping under another key (see the wrapping interface). Behind the same extractability gate as export-key-jwk, and fallible beyond it like every export; the material itself never reaches the caller.

async fn to_wrap_input_pkcs8( accessor: &Accessor<T, Self>, self_: Resource<SigningKey>, ) -> Result<Result<Resource<WrapInput>, Error>>

The PKCS#8 serialization as a wrap-input, behind the same gate.

async fn drop( accessor: &Accessor<T, Self>, rep: Resource<SigningKey>, ) -> Result<()>

impl<T: Send> HostUnwrapInputWithStore<T> for WasiWebcrypto

async fn drop( accessor: &Accessor<T, Self>, rep: Resource<UnwrapInput>, ) -> Result<()>

impl<T: Send> HostVerifyingKeyWithStore<T> for WasiWebcrypto

async fn verify( accessor: &Accessor<T, Self>, self_: Resource<VerifyingKey>, data: StreamReader<u8>, sig: Vec<u8>, ) -> Result<Result<(), Error>>

Verify sig over an entire byte stream. Like mac-key.verify, both verdicts are computed over the entire stream and resolve only after it is fully drained, and it fails closed with error.authentication-failed (a result, not a bool: an ignored boolean fails open).

async fn export_key_raw( accessor: &Accessor<T, Self>, self_: Resource<VerifyingKey>, ) -> Result<Result<Vec<u8>, Error>>

The public key material, in the minting interface’s documented public format. Algorithms without a raw public form (the RSA family — the platform serves spki and jwk only) fail error.unsupported.

async fn export_key_spki( accessor: &Accessor<T, Self>, self_: Resource<VerifyingKey>, ) -> Result<Result<Vec<u8>, Error>>

The public key as an X.509 SubjectPublicKeyInfo (DER), with the same fallibility as export-key-raw.

async fn export_key_jwk( accessor: &Accessor<T, Self>, self_: Resource<VerifyingKey>, ) -> Result<Result<String, Error>>

The public key as a JWK (an RFC 8037 OKP public key for Ed25519, an EC public key for ECDSA). See mac-key.export-key-jwk for the package-wide JWK contract; the same fallibility as export-key-raw applies.

async fn drop( accessor: &Accessor<T, Self>, rep: Resource<VerifyingKey>, ) -> Result<()>

impl<T: Send> HostWithStore<T> for WasiWebcrypto

async fn import_key_raw( accessor: &Accessor<T, Self>, variant: AesVariant, raw: Vec<u8>, options: Resource<CipherKeyOptions>, ) -> Result<Result<Resource<CipherKey>, Error>>

Import raw key material as the declared AES variant (see aes-gcm.import-key-raw for the variant-redundancy contract).

async fn import_key_jwk( accessor: &Accessor<T, Self>, variant: AesVariant, jwk: String, options: Resource<CipherKeyOptions>, ) -> Result<Result<Resource<CipherKey>, Error>>

Import an RFC 7517 JSON Web Key as an AES-CBC key of the declared variant. The key must be an oct key whose alg, if present, names the declared variant ("A128CBC"/"A192CBC"/"A256CBC"); otherwise as aes-gcm.import-key-jwk.

async fn generate_key( accessor: &Accessor<T, Self>, variant: AesVariant, options: Resource<CipherKeyOptions>, ) -> Result<Result<Resource<CipherKey>, Error>>

Generate a fresh random key of the given AES variant. Fails with error.unsupported if this implementation does not serve the variant.

async fn derive_key( accessor: &Accessor<T, Self>, variant: AesVariant, input: Resource<DeriveInput>, options: Resource<CipherKeyOptions>, ) -> Result<Result<Resource<CipherKey>, Error>>

Mint a key from a parameterized derivation (the aes-gcm.derive-key contract, minting a cipher-key).

async fn unwrap_key_raw( accessor: &Accessor<T, Self>, variant: AesVariant, input: Resource<UnwrapInput>, options: Resource<CipherKeyOptions>, ) -> Result<Result<Resource<CipherKey>, Error>>

Mint a key from unwrapped key material read as raw bytes, subject to import-key-raw’s contract. input is consumed; see aes-gcm.unwrap-key-raw for the options model.

async fn unwrap_key_jwk( accessor: &Accessor<T, Self>, variant: AesVariant, input: Resource<UnwrapInput>, options: Resource<CipherKeyOptions>, ) -> Result<Result<Resource<CipherKey>, Error>>

Mint a key from unwrapped key material read as an oct JWK, subject to import-key-jwk’s contract. input is consumed.

impl<T: Send> HostWithStore<T> for WasiWebcrypto

async fn import_key_raw( accessor: &Accessor<T, Self>, variant: AesVariant, raw: Vec<u8>, options: Resource<CipherKeyOptions>, ) -> Result<Result<Resource<CipherKey>, Error>>

Import raw key material as the declared AES variant (see aes-gcm.import-key-raw for the variant-redundancy contract).

async fn import_key_jwk( accessor: &Accessor<T, Self>, variant: AesVariant, jwk: String, options: Resource<CipherKeyOptions>, ) -> Result<Result<Resource<CipherKey>, Error>>

Import an RFC 7517 JSON Web Key as an AES-CTR key of the declared variant. The key must be an oct key whose alg, if present, names the declared variant ("A128CTR"/"A192CTR"/"A256CTR"); otherwise as aes-gcm.import-key-jwk.

async fn generate_key( accessor: &Accessor<T, Self>, variant: AesVariant, options: Resource<CipherKeyOptions>, ) -> Result<Result<Resource<CipherKey>, Error>>

Generate a fresh random key of the given AES variant. Fails with error.unsupported if this implementation does not serve the variant.

async fn derive_key( accessor: &Accessor<T, Self>, variant: AesVariant, input: Resource<DeriveInput>, options: Resource<CipherKeyOptions>, ) -> Result<Result<Resource<CipherKey>, Error>>

Mint a key from a parameterized derivation (the aes-gcm.derive-key contract, minting a cipher-key).

async fn unwrap_key_raw( accessor: &Accessor<T, Self>, variant: AesVariant, input: Resource<UnwrapInput>, options: Resource<CipherKeyOptions>, ) -> Result<Result<Resource<CipherKey>, Error>>

Mint a key from unwrapped key material read as raw bytes, subject to import-key-raw’s contract. input is consumed; see aes-gcm.unwrap-key-raw for the options model.

async fn unwrap_key_jwk( accessor: &Accessor<T, Self>, variant: AesVariant, input: Resource<UnwrapInput>, options: Resource<CipherKeyOptions>, ) -> Result<Result<Resource<CipherKey>, Error>>

Mint a key from unwrapped key material read as an oct JWK, subject to import-key-jwk’s contract. input is consumed.

impl<T: Send> HostWithStore<T> for WasiWebcrypto

async fn import_public_key_raw( accessor: &Accessor<T, Self>, raw: Vec<u8>, ) -> Result<Result<Resource<AgreementPublicKey>, Error>>

Import a raw 32-byte RFC 7748 u-coordinate as a public key.

async fn import_public_key_spki( accessor: &Accessor<T, Self>, spki: Vec<u8>, ) -> Result<Result<Resource<AgreementPublicKey>, Error>>

Import a public key as an X.509 SubjectPublicKeyInfo (DER, RFC 8410 algorithm id 1.3.101.110). The embedded u-coordinate is admitted exactly as import-public-key-raw admits it.

async fn import_public_key_jwk( accessor: &Accessor<T, Self>, jwk: String, ) -> Result<Result<Resource<AgreementPublicKey>, Error>>

Import a public key as an RFC 8037 OKP public JWK (kty: "OKP", crv: "X25519", x). jwk is the JWK as JSON text; see mac-key.export-key-jwk for the package-wide JWK contract.

async fn import_secret_key_pkcs8( accessor: &Accessor<T, Self>, pkcs8: Vec<u8>, options: Resource<AgreementKeyOptions>, ) -> Result<Result<Resource<AgreementSecretKey>, Error>>

Import a static secret key as a PKCS#8 PrivateKeyInfo (DER, RFC 8410: the 32-byte scalar in a CurvePrivateKey). The scalar is clamped at use per RFC 7748, like the JWK import’s d.

async fn import_secret_key_jwk( accessor: &Accessor<T, Self>, jwk: String, options: Resource<AgreementKeyOptions>, ) -> Result<Result<Resource<AgreementSecretKey>, Error>>

Import a static secret key as an RFC 8037 OKP private JWK (kty: "OKP", crv: "X25519", with x and d both required — RFC 8037 makes the public coordinate mandatory, so this is inherently the public+private form).

async fn generate_key( accessor: &Accessor<T, Self>, options: Resource<AgreementKeyOptions>, ) -> Result<Result<(Resource<AgreementSecretKey>, Resource<AgreementPublicKey>), Error>>

Generate a fresh X25519 key pair.

async fn unwrap_secret_key_jwk( accessor: &Accessor<T, Self>, input: Resource<UnwrapInput>, options: Resource<AgreementKeyOptions>, ) -> Result<Result<Resource<AgreementSecretKey>, Error>>

Mint a static secret key from unwrapped key material (see the wrapping interface): input’s bytes are read as an OKP private JWK, subject to import-secret-key-jwk’s contract plus the unwrap-path use/key_ops checks (see README.md, “JWK contract”). input is consumed.

async fn unwrap_secret_key_pkcs8( accessor: &Accessor<T, Self>, input: Resource<UnwrapInput>, options: Resource<AgreementKeyOptions>, ) -> Result<Result<Resource<AgreementSecretKey>, Error>>

Mint a static secret key from unwrapped key material read as a PKCS#8 PrivateKeyInfo, subject to import-secret-key-pkcs8’s contract. input is consumed; see unwrap-secret-key-jwk for the options model.

impl<T: Send> HostWithStore<T> for WasiWebcrypto

async fn import_public_key_raw( accessor: &Accessor<T, Self>, variant: EcdhVariant, raw: Vec<u8>, ) -> Result<Result<Resource<AgreementPublicKey>, Error>>

Import a public key as an uncompressed SEC1 point (04 ‖ x ‖ y; 65 bytes for P-256, 97 bytes for P-384 — WebCrypto’s raw format). Anything else — including compressed points and points not on the declared variant’s curve — fails with error.invalid-key. public-key.export-key-raw returns this same form.

async fn import_public_key_spki( accessor: &Accessor<T, Self>, variant: EcdhVariant, spki: Vec<u8>, ) -> Result<Result<Resource<AgreementPublicKey>, Error>>

Import a public key as an X.509 SubjectPublicKeyInfo (DER). The curve must be named by OID and must match the declared variant’s, or the import fails with error.invalid-key: an encoding that carries explicit ECParameters instead of the named-curve OID is rejected even when the parameters describe the variant’s curve. A point not on the curve is always rejected. An uncompressed point is always accepted; whether a compressed encoding is accepted is implementation-defined, as it is across WebCrypto engines — do not rely on either behavior.

async fn import_public_key_jwk( accessor: &Accessor<T, Self>, variant: EcdhVariant, jwk: String, ) -> Result<Result<Resource<AgreementPublicKey>, Error>>

Import a public key as an EC public JWK (kty: "EC", with crv, x, and y). jwk is the JWK as JSON text; see mac-key.export-key-jwk for the package-wide JWK contract (alg is ignored entirely, WebCrypto’s rule for the ECDH family). The JWK’s crv must match the declared variant’s curve (error.invalid-key otherwise), and the encoded point is admitted exactly as import-public-key-raw admits it.

async fn import_secret_key_jwk( accessor: &Accessor<T, Self>, variant: EcdhVariant, jwk: String, options: Resource<AgreementKeyOptions>, ) -> Result<Result<Resource<AgreementSecretKey>, Error>>

Import a static secret key as an EC private JWK (kty: "EC", with crv, d, and the public coordinates x/y, which RFC 7518 makes mandatory — this is inherently the public+private form). jwk is the JWK as JSON text; see mac-key.export-key-jwk for the package-wide JWK contract, including ext validation against the options’ extractability. d is the curve’s scalar and must lie in [1, n-1] (error.invalid-key otherwise).

async fn import_secret_key_pkcs8( accessor: &Accessor<T, Self>, variant: EcdhVariant, pkcs8: Vec<u8>, options: Resource<AgreementKeyOptions>, ) -> Result<Result<Resource<AgreementSecretKey>, Error>>

Import a static secret key as a PKCS#8 PrivateKeyInfo (DER, the RFC 5915 ECPrivateKey body). The encoded curve must match the declared variant’s (error.invalid-key), and the scalar must lie in [1, n-1]; an embedded public key, when present, is validated against the scalar and never trusted on its own.

async fn generate_key( accessor: &Accessor<T, Self>, variant: EcdhVariant, options: Resource<AgreementKeyOptions>, ) -> Result<Result<(Resource<AgreementSecretKey>, Resource<AgreementPublicKey>), Error>>

Generate a fresh key pair on the declared variant’s curve.

async fn unwrap_secret_key_jwk( accessor: &Accessor<T, Self>, variant: EcdhVariant, input: Resource<UnwrapInput>, options: Resource<AgreementKeyOptions>, ) -> Result<Result<Resource<AgreementSecretKey>, Error>>

Mint a static secret key from unwrapped key material (see the wrapping interface): input’s bytes are read as an EC private JWK, subject to import-secret-key-jwk’s contract plus the unwrap-path use/key_ops checks (see README.md, “JWK contract”). input is consumed.

async fn unwrap_secret_key_pkcs8( accessor: &Accessor<T, Self>, variant: EcdhVariant, input: Resource<UnwrapInput>, options: Resource<AgreementKeyOptions>, ) -> Result<Result<Resource<AgreementSecretKey>, Error>>

Mint a static secret key from unwrapped key material read as a PKCS#8 PrivateKeyInfo, subject to import-secret-key-pkcs8’s contract. input is consumed; see unwrap-secret-key-jwk for the options model.

impl<T: Send> HostWithStore<T> for WasiWebcrypto

async fn import_key_raw( accessor: &Accessor<T, Self>, variant: Sha2Variant, raw: Vec<u8>, options: Resource<MacKeyOptions>, ) -> Result<Result<Resource<MacKey>, Error>>

Import raw key material as an HMAC key over the declared SHA-2 variant.

async fn import_key_jwk( accessor: &Accessor<T, Self>, variant: Sha2Variant, jwk: String, options: Resource<MacKeyOptions>, ) -> Result<Result<Resource<MacKey>, Error>>

Import an RFC 7517 JSON Web Key as an HMAC key over the declared SHA-2 variant.

async fn generate_key( accessor: &Accessor<T, Self>, variant: Sha2Variant, length: Option<u32>, options: Resource<MacKeyOptions>, ) -> Result<Result<Resource<MacKey>, Error>>

Generate a fresh random HMAC key over the declared SHA-2 variant.

async fn derive_key( accessor: &Accessor<T, Self>, variant: Sha2Variant, input: Resource<DeriveInput>, length: Option<u32>, options: Resource<MacKeyOptions>, ) -> Result<Result<Resource<MacKey>, Error>>

Mint a key from a parameterized derivation: the derivation runs at length bits and the result is subject to import-key-raw’s contract.

async fn unwrap_key_raw( accessor: &Accessor<T, Self>, variant: Sha2Variant, input: Resource<UnwrapInput>, options: Resource<MacKeyOptions>, ) -> Result<Result<Resource<MacKey>, Error>>

Mint a key from unwrapped key material (see the wrapping interface): input’s bytes are read as raw key material, subject to import-key-raw’s contract. input is consumed.

async fn unwrap_key_jwk( accessor: &Accessor<T, Self>, variant: Sha2Variant, input: Resource<UnwrapInput>, options: Resource<MacKeyOptions>, ) -> Result<Result<Resource<MacKey>, Error>>

Mint a key from unwrapped key material read as an RFC 7517 JSON Web Key, subject to import-key-jwk’s contract plus the unwrap-path use/key_ops checks (see README.md, “JWK contract”). input is consumed; see unwrap-key-raw for the options model.

impl<T: Send> HostWithStore<T> for WasiWebcrypto

async fn import_key_raw( accessor: &Accessor<T, Self>, variant: AesVariant, raw: Vec<u8>, options: Resource<AeadKeyOptions>, ) -> Result<Result<Resource<AeadKey>, Error>>

Import raw key material as the declared AES variant.

async fn import_key_jwk( accessor: &Accessor<T, Self>, variant: AesVariant, jwk: String, options: Resource<AeadKeyOptions>, ) -> Result<Result<Resource<AeadKey>, Error>>

Import an RFC 7517 JSON Web Key as an AES-GCM key of the declared variant.

async fn generate_key( accessor: &Accessor<T, Self>, variant: AesVariant, options: Resource<AeadKeyOptions>, ) -> Result<Result<Resource<AeadKey>, Error>>

Generate a fresh random key of the given AES variant. Fails with error.unsupported if this implementation does not serve the variant.

async fn derive_key( accessor: &Accessor<T, Self>, variant: AesVariant, input: Resource<DeriveInput>, options: Resource<AeadKeyOptions>, ) -> Result<Result<Resource<AeadKey>, Error>>

Mint a key from a parameterized derivation: the derivation runs at the variant’s key length (WebCrypto’s deriveKey chain — get key length, derive bits, import) and the result is subject to import-key-raw’s contract.

async fn unwrap_key_raw( accessor: &Accessor<T, Self>, variant: AesVariant, input: Resource<UnwrapInput>, options: Resource<AeadKeyOptions>, ) -> Result<Result<Resource<AeadKey>, Error>>

Mint a key from unwrapped key material (see the wrapping interface): input’s bytes are read as raw key material, subject to import-key-raw’s contract. input is consumed.

async fn unwrap_key_jwk( accessor: &Accessor<T, Self>, variant: AesVariant, input: Resource<UnwrapInput>, options: Resource<AeadKeyOptions>, ) -> Result<Result<Resource<AeadKey>, Error>>

Mint a key from unwrapped key material read as an RFC 7517 JSON Web Key, subject to import-key-jwk’s contract plus the unwrap-path use/key_ops checks (see README.md, “JWK contract”). input is consumed; see unwrap-key-raw for the options model.

impl<T: Send> HostWithStore<T> for WasiWebcrypto

async fn import_verifying_key_raw( accessor: &Accessor<T, Self>, raw: Vec<u8>, ) -> Result<Result<Resource<VerifyingKey>, Error>>

Import a 32-byte raw public key (RFC 8032 encoding). Material of any other length fails with error.invalid-key; a non-canonical or small-order encoding is rejected here or at verification, per the interface’s verification criterion.

async fn import_verifying_key_spki( accessor: &Accessor<T, Self>, spki: Vec<u8>, ) -> Result<Result<Resource<VerifyingKey>, Error>>

Import a public key as an X.509 SubjectPublicKeyInfo (DER, RFC 8410 algorithm id 1.3.101.112). The embedded point is subject to the same strict criterion as import-verifying-key-raw.

async fn import_verifying_key_jwk( accessor: &Accessor<T, Self>, jwk: String, ) -> Result<Result<Resource<VerifyingKey>, Error>>

Import a public key as an RFC 8037 OKP public JWK (kty: "OKP", crv: "Ed25519", x). jwk is the JWK as JSON text; see mac-key.export-key-jwk for the package-wide JWK contract. An alg member, when present, must be "Ed25519" or "EdDSA". The same strict point criterion applies.

impl<T: Send> HostWithStore<T> for WasiWebcrypto

async fn generate_key( accessor: &Accessor<T, Self>, options: Resource<SigningKeyOptions>, ) -> Result<Result<(Resource<SigningKey>, Resource<VerifyingKey>), Error>>

Generate a fresh random signing key, returning both halves — the only point at which every provider is guaranteed to have the public key on hand.

async fn import_signing_key_pkcs8( accessor: &Accessor<T, Self>, pkcs8: Vec<u8>, options: Resource<SigningKeyOptions>, ) -> Result<Result<Resource<SigningKey>, Error>>

Import a signing key as a PKCS#8 PrivateKeyInfo (DER, RFC 8410: the 32-byte seed in a CurvePrivateKey). Wrong OIDs and malformed DER fail with error.invalid-key.

async fn import_signing_key_jwk( accessor: &Accessor<T, Self>, jwk: String, options: Resource<SigningKeyOptions>, ) -> Result<Result<Resource<SigningKey>, Error>>

Import a signing key as an RFC 8037 OKP private JWK (kty: "OKP", crv: "Ed25519", with x and d both required; an alg member, when present, must be "Ed25519" or "EdDSA"). Implementations MAY reject a JWK whose x is not the public key of d, and MUST NOT trust x for any operation. See mac-key.export-key-jwk for the package-wide JWK contract.

async fn unwrap_signing_key_pkcs8( accessor: &Accessor<T, Self>, input: Resource<UnwrapInput>, options: Resource<SigningKeyOptions>, ) -> Result<Result<Resource<SigningKey>, Error>>

Mint a signing key from unwrapped key material (see the wrapping interface): input’s bytes are read as a PKCS#8 PrivateKeyInfo, subject to import-signing-key-pkcs8’s contract. input is consumed.

async fn unwrap_signing_key_jwk( accessor: &Accessor<T, Self>, input: Resource<UnwrapInput>, options: Resource<SigningKeyOptions>, ) -> Result<Result<Resource<SigningKey>, Error>>

Mint a signing key from unwrapped key material read as an OKP private JWK, subject to import-signing-key-jwk’s contract plus the unwrap-path use/key_ops checks (see README.md, “JWK contract”). input is consumed; see unwrap-signing-key-pkcs8 for the options model.

impl<T: Send> HostWithStore<T> for WasiWebcrypto

async fn import_verifying_key_raw( accessor: &Accessor<T, Self>, variant: EcdsaVariant, raw: Vec<u8>, ) -> Result<Result<Resource<VerifyingKey>, Error>>

Import a public key as an uncompressed SEC1 point (04 ‖ x ‖ y; 65 bytes for P-256, 97 bytes for P-384 — WebCrypto’s raw format). Anything else — including compressed points and points not on the curve — fails with error.invalid-key. verifying-key.export-key-raw returns this same form.

async fn import_verifying_key_spki( accessor: &Accessor<T, Self>, variant: EcdsaVariant, spki: Vec<u8>, ) -> Result<Result<Resource<VerifyingKey>, Error>>

Import a public key as an X.509 SubjectPublicKeyInfo (DER). The curve must be named by OID and must match the declared variant’s, or the import fails with error.invalid-key: an encoding that carries explicit ECParameters instead of the named-curve OID is rejected even when the parameters describe the variant’s curve. A point not on the curve is always rejected. An uncompressed point is always accepted; whether a compressed encoding is accepted is implementation-defined, as it is across WebCrypto engines — do not rely on either behavior.

async fn import_verifying_key_jwk( accessor: &Accessor<T, Self>, variant: EcdsaVariant, jwk: String, ) -> Result<Result<Resource<VerifyingKey>, Error>>

Import a public key as an EC JWK (kty: "EC", with crv, x, and y). jwk is the JWK as JSON text; see mac-key.export-key-jwk for the package-wide JWK contract. The JWK’s crv must match the declared variant’s curve (error.invalid-key otherwise), and an alg member, when present, must be the curve’s JOSE signature alg ("ES256" for P-256, "ES384" for P-384) — curve-determined, so it does not vary with the variant’s mint-bound hash.

impl<T: Send> HostWithStore<T> for WasiWebcrypto

async fn generate_key( accessor: &Accessor<T, Self>, variant: EcdsaVariant, options: Resource<SigningKeyOptions>, ) -> Result<Result<(Resource<SigningKey>, Resource<VerifyingKey>), Error>>

Generate a fresh random signing key of the declared variant, returning both halves — the only point at which every provider is guaranteed to have the public key on hand.

async fn import_signing_key_pkcs8( accessor: &Accessor<T, Self>, variant: EcdsaVariant, pkcs8: Vec<u8>, options: Resource<SigningKeyOptions>, ) -> Result<Result<Resource<SigningKey>, Error>>

Import a signing key as a PKCS#8 PrivateKeyInfo (DER, the SEC1 private-key body). The encoded curve must match the declared variant’s (error.invalid-key); an embedded public key, when present, is validated against the scalar and never trusted on its own. Returns only the signing key (see the interface doc).

async fn import_signing_key_jwk( accessor: &Accessor<T, Self>, variant: EcdsaVariant, jwk: String, options: Resource<SigningKeyOptions>, ) -> Result<Result<Resource<SigningKey>, Error>>

Import a signing key as an EC private JWK (kty: "EC", with crv, d, and the mandatory public coordinates x/y, which implementations MAY validate against d and MUST NOT trust). crv and alg are validated as in import-verifying-key-jwk. See mac-key.export-key-jwk for the package-wide JWK contract.

async fn unwrap_signing_key_pkcs8( accessor: &Accessor<T, Self>, variant: EcdsaVariant, input: Resource<UnwrapInput>, options: Resource<SigningKeyOptions>, ) -> Result<Result<Resource<SigningKey>, Error>>

Mint a signing key from unwrapped key material (see the wrapping interface): input’s bytes are read as a PKCS#8 PrivateKeyInfo, subject to import-signing-key-pkcs8’s contract. input is consumed.

async fn unwrap_signing_key_jwk( accessor: &Accessor<T, Self>, variant: EcdsaVariant, input: Resource<UnwrapInput>, options: Resource<SigningKeyOptions>, ) -> Result<Result<Resource<SigningKey>, Error>>

Mint a signing key from unwrapped key material read as an EC private JWK, subject to import-signing-key-jwk’s contract plus the unwrap-path use/key_ops checks (see README.md, “JWK contract”). input is consumed; see unwrap-signing-key-pkcs8 for the options model.

impl<T: Send> HostWithStore<T> for WasiWebcrypto

async fn import_verifying_key_spki( accessor: &Accessor<T, Self>, variant: RsaVariant, spki: Vec<u8>, ) -> Result<Result<Resource<VerifyingKey>, Error>>

Import a public key as an X.509 SubjectPublicKeyInfo (DER). Admission follows the family contract (see rsa).

async fn import_verifying_key_jwk( accessor: &Accessor<T, Self>, variant: RsaVariant, jwk: String, ) -> Result<Result<Resource<VerifyingKey>, Error>>

Import a public key as an RSA public JWK (kty: "RSA", with n and e). jwk is the JWK as JSON text; see mac-key.export-key-jwk for the package-wide JWK contract. An alg member, when present, must be the variant’s JOSE alg ("RS256", "RS384", or "RS512").

impl<T: Send> HostWithStore<T> for WasiWebcrypto

async fn import_verifying_key_spki( accessor: &Accessor<T, Self>, variant: RsaVariant, salt_length: u32, spki: Vec<u8>, ) -> Result<Result<Resource<VerifyingKey>, Error>>

Import a public key as an X.509 SubjectPublicKeyInfo (DER). Admission follows the family contract (see rsa).

async fn import_verifying_key_jwk( accessor: &Accessor<T, Self>, variant: RsaVariant, salt_length: u32, jwk: String, ) -> Result<Result<Resource<VerifyingKey>, Error>>

Import a public key as an RSA public JWK (kty: "RSA", with n and e); see import-verifying-key-spki for salt-length, and mac-key.export-key-jwk for the package-wide JWK contract. An alg member, when present, must be the variant’s JOSE alg ("PS256", "PS384", or "PS512").

impl<T: Send> HostWithStore<T> for WasiWebcrypto

async fn import_key_raw( accessor: &Accessor<T, Self>, variant: AesVariant, raw: Vec<u8>, options: Resource<KwKeyOptions>, ) -> Result<Result<Resource<KwKey>, Error>>

Import raw key material as the declared AES variant (see aes-gcm.import-key-raw for the variant-redundancy contract).

async fn import_key_jwk( accessor: &Accessor<T, Self>, variant: AesVariant, jwk: String, options: Resource<KwKeyOptions>, ) -> Result<Result<Resource<KwKey>, Error>>

Import an RFC 7517 JSON Web Key as an AES-KW key of the declared variant. The key must be an oct key whose alg, if present, names the declared variant ("A128KW"/"A192KW"/"A256KW"); otherwise as aes-gcm.import-key-jwk.

async fn generate_key( accessor: &Accessor<T, Self>, variant: AesVariant, options: Resource<KwKeyOptions>, ) -> Result<Result<Resource<KwKey>, Error>>

Generate a fresh random key of the given AES variant. Fails with error.unsupported if this implementation does not serve the variant.

async fn derive_key( accessor: &Accessor<T, Self>, variant: AesVariant, input: Resource<DeriveInput>, options: Resource<KwKeyOptions>, ) -> Result<Result<Resource<KwKey>, Error>>

Mint a key from a parameterized derivation (the aes-gcm.derive-key contract, minting a kw-key).

async fn unwrap_key_raw( accessor: &Accessor<T, Self>, variant: AesVariant, input: Resource<UnwrapInput>, options: Resource<KwKeyOptions>, ) -> Result<Result<Resource<KwKey>, Error>>

Mint a key from unwrapped key material read as raw bytes, subject to import-key-raw’s contract. input is consumed; see aes-gcm.unwrap-key-raw for the options model.

async fn unwrap_key_jwk( accessor: &Accessor<T, Self>, variant: AesVariant, input: Resource<UnwrapInput>, options: Resource<KwKeyOptions>, ) -> Result<Result<Resource<KwKey>, Error>>

Mint a key from unwrapped key material read as an oct JWK, subject to import-key-jwk’s contract. input is consumed.

impl<T: Send> HostWithStore<T> for WasiWebcrypto

async fn generate_key( accessor: &Accessor<T, Self>, variant: RsaVariant, modulus: RsaModulus, options: Resource<SigningKeyOptions>, ) -> Result<Result<(Resource<SigningKey>, Resource<VerifyingKey>), Error>>

Generate a fresh signing key pair, returning both halves — the only point at which every provider is guaranteed to have the public key on hand. The public exponent is 65537; it is not a parameter.

async fn import_signing_key_pkcs8( accessor: &Accessor<T, Self>, variant: RsaVariant, pkcs8: Vec<u8>, options: Resource<SigningKeyOptions>, ) -> Result<Result<Resource<SigningKey>, Error>>

Import a signing key as a PKCS#8 PrivateKeyInfo (DER, the RFC 8017 RSAPrivateKey body, with its CRT parameters — the form every platform emits). Admission follows the family contract plus the signing window above.

async fn import_signing_key_jwk( accessor: &Accessor<T, Self>, variant: RsaVariant, jwk: String, options: Resource<SigningKeyOptions>, ) -> Result<Result<Resource<SigningKey>, Error>>

Import a signing key as an RSA private JWK (kty: "RSA", with n, e, d, and the CRT members p/q/dp/dq/qi, which the platforms require of private RSA JWKs). alg, when present, must be the variant’s JOSE alg, as on the -verify interface.

async fn unwrap_signing_key_pkcs8( accessor: &Accessor<T, Self>, variant: RsaVariant, input: Resource<UnwrapInput>, options: Resource<SigningKeyOptions>, ) -> Result<Result<Resource<SigningKey>, Error>>

Mint a signing key from unwrapped key material read as a PKCS#8 PrivateKeyInfo, subject to import-signing-key-pkcs8’s contract. input is consumed; the minted key’s usages and extractability come from options alone (the W3C Web Cryptography API’s unwrapKey model).

async fn unwrap_signing_key_jwk( accessor: &Accessor<T, Self>, variant: RsaVariant, input: Resource<UnwrapInput>, options: Resource<SigningKeyOptions>, ) -> Result<Result<Resource<SigningKey>, Error>>

Mint a signing key from unwrapped key material read as an RSA private JWK, subject to import-signing-key-jwk’s contract plus the unwrap-path use/key_ops checks (see README.md, “JWK contract”). input is consumed.

impl<T: Send> HostWithStore<T> for WasiWebcrypto

async fn generate_key( accessor: &Accessor<T, Self>, variant: RsaVariant, modulus: RsaModulus, options: Resource<SigningKeyOptions>, ) -> Result<Result<(Resource<SigningKey>, Resource<VerifyingKey>), Error>>

See rsassa-pkcs1-v15-sign.generate-key.

async fn import_signing_key_pkcs8( accessor: &Accessor<T, Self>, variant: RsaVariant, pkcs8: Vec<u8>, options: Resource<SigningKeyOptions>, ) -> Result<Result<Resource<SigningKey>, Error>>

See rsassa-pkcs1-v15-sign.import-signing-key-pkcs8.

async fn import_signing_key_jwk( accessor: &Accessor<T, Self>, variant: RsaVariant, jwk: String, options: Resource<SigningKeyOptions>, ) -> Result<Result<Resource<SigningKey>, Error>>

See rsassa-pkcs1-v15-sign.import-signing-key-jwk.

async fn unwrap_signing_key_pkcs8( accessor: &Accessor<T, Self>, variant: RsaVariant, input: Resource<UnwrapInput>, options: Resource<SigningKeyOptions>, ) -> Result<Result<Resource<SigningKey>, Error>>

See rsassa-pkcs1-v15-sign.unwrap-signing-key-pkcs8.

async fn unwrap_signing_key_jwk( accessor: &Accessor<T, Self>, variant: RsaVariant, input: Resource<UnwrapInput>, options: Resource<SigningKeyOptions>, ) -> Result<Result<Resource<SigningKey>, Error>>

See rsassa-pkcs1-v15-sign.unwrap-signing-key-jwk.

impl<T: Send> HostWithStore<T> for WasiWebcrypto

async fn import_encryption_key_spki( accessor: &Accessor<T, Self>, variant: RsaVariant, spki: Vec<u8>, ) -> Result<Result<Resource<EncryptionKey>, Error>>

Import a public key as an X.509 SubjectPublicKeyInfo (DER). Admission follows the family contract (see rsa) plus the window above.

async fn import_encryption_key_jwk( accessor: &Accessor<T, Self>, variant: RsaVariant, jwk: String, ) -> Result<Result<Resource<EncryptionKey>, Error>>

Import a public key as an RSA public JWK (kty: "RSA", with n and e). An alg member, when present, must be the variant’s JOSE alg ("RSA-OAEP-256", "RSA-OAEP-384", or "RSA-OAEP-512"). See mac-key.export-key-jwk for the package-wide JWK contract.

impl<T: Send> HostWithStore<T> for WasiWebcrypto

async fn generate_key( accessor: &Accessor<T, Self>, variant: RsaVariant, modulus: RsaModulus, options: Resource<DecryptionKeyOptions>, ) -> Result<Result<(Resource<DecryptionKey>, Resource<EncryptionKey>), Error>>

Generate a fresh key pair, returning both halves — the only point at which every provider is guaranteed to have the public key on hand. The public exponent is 65537; it is not a parameter.

async fn import_decryption_key_pkcs8( accessor: &Accessor<T, Self>, variant: RsaVariant, pkcs8: Vec<u8>, options: Resource<DecryptionKeyOptions>, ) -> Result<Result<Resource<DecryptionKey>, Error>>

Import a decryption key as a PKCS#8 PrivateKeyInfo (DER, with CRT parameters).

async fn import_decryption_key_jwk( accessor: &Accessor<T, Self>, variant: RsaVariant, jwk: String, options: Resource<DecryptionKeyOptions>, ) -> Result<Result<Resource<DecryptionKey>, Error>>

Import a decryption key as a full-CRT RSA private JWK. alg, when present, follows import-encryption-key-jwk’s values.

async fn unwrap_decryption_key_pkcs8( accessor: &Accessor<T, Self>, variant: RsaVariant, input: Resource<UnwrapInput>, options: Resource<DecryptionKeyOptions>, ) -> Result<Result<Resource<DecryptionKey>, Error>>

Mint a decryption key from unwrapped material read as a PKCS#8 PrivateKeyInfo. input is consumed; grants and extractability come from options alone (the W3C unwrapKey model).

async fn unwrap_decryption_key_jwk( accessor: &Accessor<T, Self>, variant: RsaVariant, input: Resource<UnwrapInput>, options: Resource<DecryptionKeyOptions>, ) -> Result<Result<Resource<DecryptionKey>, Error>>

Mint a decryption key from unwrapped material read as an RSA private JWK, subject to the unwrap-path use/key_ops checks (see README.md, “JWK contract”). input is consumed.

impl<T: Send> HostWithStore<T> for WasiWebcrypto

async fn import_ikm( accessor: &Accessor<T, Self>, raw: Vec<u8>, options: Resource<DeriveOptions>, ) -> Result<Result<Resource<Ikm>, Error>>

Import input keying material. Empty material is accepted (RFC 5869 permits it, and the Web Cryptography API serves it), but an implementation enforcing a security policy MAY reject degenerate material with error.invalid-key, as on hmac-sha2.import-key-raw. Fails error.not-permitted if options grants nothing, per the package-wide options contract.

async fn unwrap_ikm( accessor: &Accessor<T, Self>, input: Resource<UnwrapInput>, options: Resource<DeriveOptions>, ) -> Result<Result<Resource<Ikm>, Error>>

Mint input keying material from unwrapped bytes (see the wrapping interface), subject to import-ikm’s contract: a KDF secret can arrive under a wrapping key and parameterize derivations without its bytes ever being observable. Like import-ikm, this is not a format choice — the bytes are the material. input is consumed.

impl<T: Send> HostWithStore<T> for WasiWebcrypto

async fn prepare( accessor: &Accessor<T, Self>, variant: Sha2Variant, input: Resource<Ikm>, salt: Vec<u8>, info: Vec<u8>, ) -> Result<Result<Resource<DeriveInput>, Error>>

Parameterize a derivation: HKDF-Extract with salt runs over the material (eagerly, so the returned input retains the PRK rather than the IKM), and info is bound for the expand step at use. An implementation not serving the variant fails error.unsupported (the truncated SHA-2 variants are unserved package-wide, as for hmac-sha2).

async fn prepare_from( accessor: &Accessor<T, Self>, variant: Sha2Variant, input: Resource<DeriveInput>, salt: Vec<u8>, info: Vec<u8>, ) -> Result<Result<Resource<DeriveInput>, Error>>

Parameterize a derivation whose IKM is another derivation’s output — the chaining step (a future agreement’s shared secret fed to HKDF without transiting the caller).

impl<T: Send> HostWithStore<T> for WasiWebcrypto

async fn import_key_raw( accessor: &Accessor<T, Self>, raw: Vec<u8>, options: Resource<MacKeyOptions>, ) -> Result<Result<Resource<MacKey>, Error>>

Import raw key material as an HMAC-SHA-1 key. See hmac-sha2.import-key-raw for the key-length contract.

async fn import_key_jwk( accessor: &Accessor<T, Self>, jwk: String, options: Resource<MacKeyOptions>, ) -> Result<Result<Resource<MacKey>, Error>>

Import an RFC 7517 JSON Web Key as an HMAC-SHA-1 key (alg, when present, must be "HS1"). See hmac-sha2.import-key-jwk.

async fn generate_key( accessor: &Accessor<T, Self>, length: Option<u32>, options: Resource<MacKeyOptions>, ) -> Result<Result<Resource<MacKey>, Error>>

Generate a fresh random HMAC-SHA-1 key. See hmac-sha2.generate-key for the length contract; none means SHA-1’s block size, 512 bits.

async fn derive_key( accessor: &Accessor<T, Self>, input: Resource<DeriveInput>, length: Option<u32>, options: Resource<MacKeyOptions>, ) -> Result<Result<Resource<MacKey>, Error>>

Mint a key from a parameterized derivation. See hmac-sha2.derive-key.

async fn unwrap_key_raw( accessor: &Accessor<T, Self>, input: Resource<UnwrapInput>, options: Resource<MacKeyOptions>, ) -> Result<Result<Resource<MacKey>, Error>>

Mint a key from unwrapped key material read as raw bytes. See hmac-sha2.unwrap-key-raw.

async fn unwrap_key_jwk( accessor: &Accessor<T, Self>, input: Resource<UnwrapInput>, options: Resource<MacKeyOptions>, ) -> Result<Result<Resource<MacKey>, Error>>

Mint a key from unwrapped key material read as an RFC 7517 JSON Web Key. See hmac-sha2.unwrap-key-jwk.

impl<T: Send> HostWithStore<T> for WasiWebcrypto

async fn prepare( accessor: &Accessor<T, Self>, input: Resource<Ikm>, salt: Vec<u8>, info: Vec<u8>, ) -> Result<Result<Resource<DeriveInput>, Error>>

Parameterize an HKDF-SHA-1 derivation. See hkdf-sha2.prepare.

async fn prepare_from( accessor: &Accessor<T, Self>, input: Resource<DeriveInput>, salt: Vec<u8>, info: Vec<u8>, ) -> Result<Result<Resource<DeriveInput>, Error>>

Parameterize an HKDF-SHA-1 derivation from another derivation’s output. See hkdf-sha2.prepare-from.

impl<T: Send> HostWithStore<T> for WasiWebcrypto

async fn prepare( accessor: &Accessor<T, Self>, input: Resource<Password>, salt: Vec<u8>, iterations: u32, ) -> Result<Result<Resource<DeriveInput>, Error>>

Parameterize a PBKDF2-HMAC-SHA-1 derivation. See pbkdf2-sha2.prepare for the salt and iterations contracts.

impl<T: Send> HostWithStore<T> for WasiWebcrypto

async fn import_password( accessor: &Accessor<T, Self>, raw: Vec<u8>, options: Resource<DeriveOptions>, ) -> Result<Result<Resource<Password>, Error>>

Import a password.

async fn unwrap_password( accessor: &Accessor<T, Self>, input: Resource<UnwrapInput>, options: Resource<DeriveOptions>, ) -> Result<Result<Resource<Password>, Error>>

Mint a password from unwrapped bytes (see the wrapping interface), subject to import-password’s contract. See hkdf.unwrap-ikm for the model — the grants come from options alone, and non-extractability stays structural. input is consumed.

impl<T: Send> HostWithStore<T> for WasiWebcrypto

async fn prepare( accessor: &Accessor<T, Self>, variant: Sha2Variant, input: Resource<Password>, salt: Vec<u8>, iterations: u32, ) -> Result<Result<Resource<DeriveInput>, Error>>

Parameterize a derivation: salt and the iteration count are bound now, and the output length arrives per use (the platform’s own split — Pbkdf2Params at deriveBits, length from the target’s get-key-length at deriveKey).

impl<T: Send> HostWrapInputWithStore<T> for WasiWebcrypto

async fn drop( accessor: &Accessor<T, Self>, rep: Resource<WrapInput>, ) -> Result<()>