polymorph_webcrypto_guest/
hkdf.rs

1//! `hkdf` base-secret import (RFC 5869).
2//!
3//! This module mints no keys and runs no derivation: it imports the input
4//! keying material that [`hkdf_sha2`](crate::hkdf_sha2) and
5//! [`hkdf_sha1`](crate::hkdf_sha1) parameterize into
6//! [`DeriveInput`](crate::DeriveInput)s.
7
8use crate::{bindings, DeriveOptions, Error, Ikm};
9
10/// Import input keying material.
11///
12/// IKM is a cryptographic secret (a shared secret, a master key) — for a
13/// human-chosen password, use [`pbkdf2::import_password`](crate::pbkdf2::import_password)
14/// instead. Empty material fails [`Error::InvalidKey`]; a policy with no
15/// grant enabled fails [`Error::NotPermitted`].
16pub async fn import_ikm(raw: impl Into<Vec<u8>>, options: DeriveOptions) -> Result<Ikm, Error> {
17    Ok(Ikm::from_raw(
18        bindings::hkdf::import_ikm(raw.into(), options.lower()).await?,
19    ))
20}
21
22/// Mint input keying material from unwrapped bytes, subject to
23/// [`import_ikm`]'s contract. Consumes the
24/// [`UnwrapInput`](crate::UnwrapInput).
25pub async fn unwrap_ikm(input: crate::UnwrapInput, options: DeriveOptions) -> Result<Ikm, Error> {
26    Ok(Ikm::from_raw(
27        bindings::hkdf::unwrap_ikm(input.into_raw(), options.lower()).await?,
28    ))
29}
polymorph_webcrypto_guest/hkdf.rs

polymorph_webcrypto_guest/
hkdf.rs
