Struct TlsRecordSealingKey

pub struct TlsRecordSealingKey { /* private fields */ }

AEAD Encryption key used for TLS protocol record encryption.

This type encapsulates encryption operations for TLS AEAD algorithms. It validates that the provides nonce values are monotonically increasing for each invocation.

The following algorithms are supported:

• AES_128_GCM
• AES_256_GCM

Prefer this type in place of LessSafeKey, OpeningKey, SealingKey for TLS protocol implementations.

Implementations

impl TlsRecordSealingKey

pub fn new( algorithm: &'static Algorithm, protocol: TlsProtocolId, key_bytes: &[u8], ) -> Result<Self, Unspecified>

New TLS record sealing key. Only supports AES_128_GCM and AES_256_GCM.

Errors

• Unspecified: Returned if the length of key_bytes does not match the chosen algorithm, or if an unsupported algorithm is provided.

pub fn seal_in_place_append_tag<A, InOut>( &mut self, nonce: Nonce, aad: Aad<A>, in_out: &mut InOut, ) -> Result<(), Unspecified>

where A: AsRef<[u8]>, InOut: AsMut<[u8]> + for<'in_out> Extend<&'in_out u8>,

Accepts a Nonce and Aad construction that is unique for this key and TLS record sealing operation for the configured TLS protocol version.

nonce must be unique and incremented per each sealing operation, otherwise an error is returned.

Errors

error::Unspecified if encryption operation fails.

pub fn seal_in_place_separate_tag<A>( &mut self, nonce: Nonce, aad: Aad<A>, in_out: &mut [u8], ) -> Result<Tag, Unspecified>

where A: AsRef<[u8]>,

Encrypts and signs (“seals”) data in place.

aad is the additional authenticated data (AAD), if any. This is authenticated but not encrypted. The type A could be a byte slice &[u8], a byte array [u8; N] for some constant N, Vec<u8>, etc. If there is no AAD then use Aad::empty().

The plaintext is given as the input value of in_out. seal_in_place() will overwrite the plaintext with the ciphertext and return the tag. For most protocols, the caller must append the tag to the ciphertext. The tag will be self.algorithm.tag_len() bytes long.

The Nonce used for the operation is randomly generated, and returned to the caller.

Errors

error::Unspecified if encryption operation fails.

pub fn algorithm(&self) -> &'static Algorithm

The key’s AEAD algorithm.

pub fn tls_protocol_id(&self) -> TlsProtocolId

The key’s associated TlsProtocolId.

Trait Implementations

impl Debug for TlsRecordSealingKey

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.