Struct PKey

Source

pub struct PKey<T>(/* private fields */);

Expand description

A public or private key.

Implementations§

Source §

impl<T> PKey<T>

Source

pub fn from_rsa(rsa: Rsa<T>) -> Result<PKey<T>, ErrorStack>

Creates a new PKey containing an RSA key.

This corresponds to EVP_PKEY_set1_RSA.

Source

pub fn from_dsa(dsa: Dsa<T>) -> Result<PKey<T>, ErrorStack>

Creates a new PKey containing a DSA key.

This corresponds to EVP_PKEY_set1_DSA.

Source

pub fn from_dh(dh: Dh<T>) -> Result<PKey<T>, ErrorStack>

Creates a new PKey containing a Diffie-Hellman key.

This corresponds to EVP_PKEY_set1_DH.

Source

pub fn from_dhx(dh: Dh<T>) -> Result<PKey<T>, ErrorStack>

Creates a new PKey containing a Diffie-Hellman key with type DHX.

Source

pub fn from_ec_key(ec_key: EcKey<T>) -> Result<PKey<T>, ErrorStack>

Creates a new PKey containing an elliptic curve key.

This corresponds to EVP_PKEY_set1_EC_KEY.

Source §

impl PKey<Private>

Source

pub fn hmac(key: &[u8]) -> Result<PKey<Private>, ErrorStack>

Creates a new PKey containing an HMAC key.

§Note

To compute HMAC values, use the sign module.

This corresponds to EVP_PKEY_new_mac_key.

Source

pub fn cmac(cipher: &Cipher, key: &[u8]) -> Result<PKey<Private>, ErrorStack>

Creates a new PKey containing a CMAC key.

Requires OpenSSL 1.1.0 or newer.

§Note

To compute CMAC values, use the sign module.

Source

pub fn generate_x25519() -> Result<PKey<Private>, ErrorStack>

Generates a new private X25519 key.

To import a private key from raw bytes see PKey::private_key_from_raw_bytes.

§Examples

use openssl::pkey::{PKey, Id};
use openssl::derive::Deriver;

let public = // ...
let public_key = PKey::public_key_from_raw_bytes(public, Id::X25519)?;

let key = PKey::generate_x25519()?;
let mut deriver = Deriver::new(&key)?;
deriver.set_peer(&public_key)?;

let secret = deriver.derive_to_vec()?;
assert_eq!(secret.len(), 32);

Source

pub fn generate_x448() -> Result<PKey<Private>, ErrorStack>

Generates a new private X448 key.

To import a private key from raw bytes see PKey::private_key_from_raw_bytes.

§Examples

use openssl::pkey::{PKey, Id};
use openssl::derive::Deriver;

let public = // ...
let public_key = PKey::public_key_from_raw_bytes(public, Id::X448)?;

let key = PKey::generate_x448()?;
let mut deriver = Deriver::new(&key)?;
deriver.set_peer(&public_key)?;

let secret = deriver.derive_to_vec()?;
assert_eq!(secret.len(), 56);

Source

pub fn generate_ed25519() -> Result<PKey<Private>, ErrorStack>

Generates a new private Ed25519 key.

To import a private key from raw bytes see PKey::private_key_from_raw_bytes.

§Examples

use openssl::pkey::{PKey, Id};
use openssl::sign::Signer;

let key = PKey::generate_ed25519()?;
let public_key = key.raw_public_key()?;

let mut signer = Signer::new_without_digest(&key)?;
let digest = // ...
let signature = signer.sign_oneshot_to_vec(digest)?;
assert_eq!(signature.len(), 64);

Source

pub fn generate_ed448() -> Result<PKey<Private>, ErrorStack>

Generates a new private Ed448 key.

To import a private key from raw bytes see PKey::private_key_from_raw_bytes.

§Examples

use openssl::pkey::{PKey, Id};
use openssl::sign::Signer;

let key = PKey::generate_ed448()?;
let public_key = key.raw_public_key()?;

let mut signer = Signer::new_without_digest(&key)?;
let digest = // ...
let signature = signer.sign_oneshot_to_vec(digest)?;
assert_eq!(signature.len(), 114);

Source

pub fn ec_gen(curve: &str) -> Result<PKey<Private>, ErrorStack>

Generates a new EC key using the provided curve.

Requires OpenSSL 3.0.0 or newer.

This corresponds to EVP_EC_gen.

Source

pub fn private_key_from_pem(pem: &[u8]) -> Result<PKey<Private>, ErrorStack>

Deserializes a private key from a PEM-encoded key type specific format.

This corresponds to PEM_read_bio_PrivateKey.

Source

pub fn private_key_from_pem_passphrase( pem: &[u8], passphrase: &[u8], ) -> Result<PKey<Private>, ErrorStack>

Deserializes a private key from a PEM-encoded encrypted key type specific format.

This corresponds to PEM_read_bio_PrivateKey.

Source

pub fn private_key_from_pem_callback<F>( pem: &[u8], callback: F, ) -> Result<PKey<Private>, ErrorStack>
where F: FnOnce(&mut [u8]) -> Result<usize, ErrorStack>,

Deserializes a private key from a PEM-encoded encrypted key type specific format.

The callback should fill the password into the provided buffer and return its length.

This corresponds to PEM_read_bio_PrivateKey.

Source

pub fn private_key_from_der(der: &[u8]) -> Result<PKey<Private>, ErrorStack>

Decodes a DER-encoded private key.

This function will attempt to automatically detect the underlying key format, and supports the unencrypted PKCS#8 PrivateKeyInfo structures as well as key type specific formats.

This corresponds to d2i_AutoPrivateKey.

Source

pub fn private_key_from_pkcs8(der: &[u8]) -> Result<PKey<Private>, ErrorStack>

Deserializes a DER-formatted PKCS#8 unencrypted private key.

This method is mainly for interoperability reasons. Encrypted keyfiles should be preferred.

Source

pub fn private_key_from_pkcs8_callback<F>( der: &[u8], callback: F, ) -> Result<PKey<Private>, ErrorStack>
where F: FnOnce(&mut [u8]) -> Result<usize, ErrorStack>,

Deserializes a DER-formatted PKCS#8 private key, using a callback to retrieve the password if the key is encrypted.

The callback should copy the password into the provided buffer and return the number of bytes written.

This corresponds to d2i_PKCS8PrivateKey_bio.

Source

pub fn private_key_from_pkcs8_passphrase( der: &[u8], passphrase: &[u8], ) -> Result<PKey<Private>, ErrorStack>

Deserializes a DER-formatted PKCS#8 private key, using the supplied password if the key is encrypted.

§Panics

Panics if passphrase contains an embedded null.

This corresponds to d2i_PKCS8PrivateKey_bio.

Source

pub fn private_key_from_raw_bytes( bytes: &[u8], key_type: Id, ) -> Result<PKey<Private>, ErrorStack>

Creates a private key from its raw byte representation

Algorithm types that support raw private keys are HMAC, X25519, ED25519, X448 or ED448

This corresponds to EVP_PKEY_new_raw_private_key.

Source §

impl PKey<Public>

Source

pub fn public_key_from_pem(pem: &[u8]) -> Result<PKey<Public>, ErrorStack>

Decodes a PEM-encoded SubjectPublicKeyInfo structure.

The input should have a header of -----BEGIN PUBLIC KEY-----.

This corresponds to PEM_read_bio_PUBKEY.

Source

pub fn public_key_from_pem_passphrase( pem: &[u8], passphrase: &[u8], ) -> Result<PKey<Public>, ErrorStack>

Decodes a PEM-encoded SubjectPublicKeyInfo structure.

This corresponds to PEM_read_bio_PUBKEY.

Source

pub fn public_key_from_pem_callback<F>( pem: &[u8], callback: F, ) -> Result<PKey<Public>, ErrorStack>
where F: FnOnce(&mut [u8]) -> Result<usize, ErrorStack>,

Decodes a PEM-encoded SubjectPublicKeyInfo structure.

The callback should fill the password into the provided buffer and return its length.

This corresponds to PEM_read_bio_PrivateKey.

Source

pub fn public_key_from_der(der: &[u8]) -> Result<PKey<Public>, ErrorStack>

Decodes a DER-encoded SubjectPublicKeyInfo structure.

This corresponds to d2i_PUBKEY.

Source

pub fn public_key_from_raw_bytes( bytes: &[u8], key_type: Id, ) -> Result<PKey<Public>, ErrorStack>

Creates a public key from its raw byte representation

Algorithm types that support raw public keys are X25519, ED25519, X448 or ED448

This corresponds to EVP_PKEY_new_raw_public_key.

Methods from Deref<Target = PKeyRef<T>>§

Source

pub fn rsa(&self) -> Result<Rsa<T>, ErrorStack>

Returns a copy of the internal RSA key.

This corresponds to EVP_PKEY_get1_RSA.

Source

pub fn dsa(&self) -> Result<Dsa<T>, ErrorStack>

Returns a copy of the internal DSA key.

This corresponds to EVP_PKEY_get1_DSA.

Source

pub fn dh(&self) -> Result<Dh<T>, ErrorStack>

Returns a copy of the internal DH key.

This corresponds to EVP_PKEY_get1_DH.

Source

pub fn ec_key(&self) -> Result<EcKey<T>, ErrorStack>

Returns a copy of the internal elliptic curve key.

This corresponds to EVP_PKEY_get1_EC_KEY.

Source

pub fn id(&self) -> Id

Returns the Id that represents the type of this key.

This corresponds to EVP_PKEY_id.

Source

pub fn size(&self) -> usize

Returns the maximum size of a signature in bytes.

This corresponds to EVP_PKEY_size.

Source

pub fn public_key_to_pem(&self) -> Result<Vec<u8>, ErrorStack>

Serializes the public key into a PEM-encoded SubjectPublicKeyInfo structure.

The output will have a header of -----BEGIN PUBLIC KEY-----.

This corresponds to PEM_write_bio_PUBKEY.

Source

pub fn public_key_to_der(&self) -> Result<Vec<u8>, ErrorStack>

Serializes the public key into a DER-encoded SubjectPublicKeyInfo structure.

This corresponds to i2d_PUBKEY.

Source

pub fn bits(&self) -> u32

Returns the size of the key.

This corresponds to the bit length of the modulus of an RSA key, and the bit length of the group order for an elliptic curve key, for example.

This corresponds to EVP_PKEY_bits.

Source

pub fn security_bits(&self) -> u32

Returns the number of security bits.

Bits of security is defined in NIST SP800-57.

This corresponds to EVP_PKEY_security_bits.

Source

pub fn public_eq(&self, other: &PKeyRef) -> bool
where U: HasPublic,

Compares the public component of this key with another.

This corresponds to EVP_PKEY_cmp.

Source

pub fn raw_public_key(&self) -> Result<Vec<u8>, ErrorStack>

Raw byte representation of a public key.

This function only works for algorithms that support raw public keys. Currently this is: Id::X25519, Id::ED25519, Id::X448 or Id::ED448.

This corresponds to EVP_PKEY_get_raw_public_key.

Source

pub fn private_key_to_pem_pkcs8(&self) -> Result<Vec<u8>, ErrorStack>

Serializes the private key to a PEM-encoded PKCS#8 PrivateKeyInfo structure.

The output will have a header of -----BEGIN PRIVATE KEY-----.

This corresponds to PEM_write_bio_PKCS8PrivateKey.

Source

pub fn private_key_to_pem_pkcs8_passphrase( &self, cipher: Cipher, passphrase: &[u8], ) -> Result<Vec<u8>, ErrorStack>

Serializes the private key to a PEM-encoded PKCS#8 EncryptedPrivateKeyInfo structure.

The output will have a header of -----BEGIN ENCRYPTED PRIVATE KEY-----.

This corresponds to PEM_write_bio_PKCS8PrivateKey.

Source

pub fn private_key_to_der(&self) -> Result<Vec<u8>, ErrorStack>

Serializes the private key to a DER-encoded key type specific format.

This corresponds to i2d_PrivateKey.

Source

pub fn raw_private_key(&self) -> Result<Vec<u8>, ErrorStack>

Raw byte representation of a private key.

This function only works for algorithms that support raw private keys. Currently this is: Id::HMAC, Id::X25519, Id::ED25519, Id::X448 or Id::ED448.

This corresponds to EVP_PKEY_get_raw_private_key.

Source