pub struct PKey<T>(/* private fields */);
Available on crate feature dns-over-openssl only.
Expand description

A public or private key.

Implementations§

source§

impl<T> PKey<T>

source

pub fn from_rsa(rsa: Rsa<T>) -> Result<PKey<T>, ErrorStack>

Creates a new PKey containing an RSA key.

This corresponds to EVP_PKEY_assign_RSA.

source

pub fn from_dsa(dsa: Dsa<T>) -> Result<PKey<T>, ErrorStack>

Creates a new PKey containing a DSA key.

This corresponds to EVP_PKEY_assign_DSA.

source

pub fn from_dh(dh: Dh<T>) -> Result<PKey<T>, ErrorStack>

Creates a new PKey containing a Diffie-Hellman key.

This corresponds to EVP_PKEY_assign_DH.

source

pub fn from_ec_key(ec_key: EcKey<T>) -> Result<PKey<T>, ErrorStack>

Creates a new PKey containing an elliptic curve key.

This corresponds to EVP_PKEY_assign_EC_KEY.

source§

impl PKey<Private>

source

pub fn hmac(key: &[u8]) -> Result<PKey<Private>, ErrorStack>

Creates a new PKey containing an HMAC key.

Note

To compute HMAC values, use the sign module.

This corresponds to EVP_PKEY_new_mac_key.

source

pub fn cmac(cipher: &Cipher, key: &[u8]) -> Result<PKey<Private>, ErrorStack>

Creates a new PKey containing a CMAC key.

Requires OpenSSL 1.1.0 or newer.

Note

To compute CMAC values, use the sign module.

source

pub fn generate_x25519() -> Result<PKey<Private>, ErrorStack>

Generates a new private X25519 key.

To import a private key from raw bytes see PKey::private_key_from_raw_bytes.

Examples
use openssl::pkey::{PKey, Id};
use openssl::derive::Deriver;

let public = // ...
let public_key = PKey::public_key_from_raw_bytes(public, Id::X25519)?;

let key = PKey::generate_x25519()?;
let mut deriver = Deriver::new(&key)?;
deriver.set_peer(&public_key)?;

let secret = deriver.derive_to_vec()?;
assert_eq!(secret.len(), 32);
source

pub fn generate_x448() -> Result<PKey<Private>, ErrorStack>

Generates a new private X448 key.

To import a private key from raw bytes see PKey::private_key_from_raw_bytes.

Examples
use openssl::pkey::{PKey, Id};
use openssl::derive::Deriver;

let public = // ...
let public_key = PKey::public_key_from_raw_bytes(public, Id::X448)?;

let key = PKey::generate_x448()?;
let mut deriver = Deriver::new(&key)?;
deriver.set_peer(&public_key)?;

let secret = deriver.derive_to_vec()?;
assert_eq!(secret.len(), 56);
source

pub fn generate_ed25519() -> Result<PKey<Private>, ErrorStack>

Generates a new private Ed25519 key.

To import a private key from raw bytes see PKey::private_key_from_raw_bytes.

Examples
use openssl::pkey::{PKey, Id};
use openssl::sign::Signer;

let key = PKey::generate_ed25519()?;
let public_key = key.raw_public_key()?;

let mut signer = Signer::new_without_digest(&key)?;
let digest = // ...
let signature = signer.sign_oneshot_to_vec(digest)?;
assert_eq!(signature.len(), 64);
source

pub fn generate_ed448() -> Result<PKey<Private>, ErrorStack>

Generates a new private Ed448 key.

To import a private key from raw bytes see PKey::private_key_from_raw_bytes.

Examples
use openssl::pkey::{PKey, Id};
use openssl::sign::Signer;

let key = PKey::generate_ed448()?;
let public_key = key.raw_public_key()?;

let mut signer = Signer::new_without_digest(&key)?;
let digest = // ...
let signature = signer.sign_oneshot_to_vec(digest)?;
assert_eq!(signature.len(), 114);
source

pub fn ec_gen(curve: &str) -> Result<PKey<Private>, ErrorStack>

Generates a new EC key using the provided curve.

Requires OpenSSL 3.0.0 or newer.

This corresponds to EVP_EC_gen.

source

pub fn private_key_from_pem(pem: &[u8]) -> Result<PKey<Private>, ErrorStack>

Deserializes a private key from a PEM-encoded key type specific format.

This corresponds to PEM_read_bio_PrivateKey.

source

pub fn private_key_from_pem_passphrase( pem: &[u8], passphrase: &[u8] ) -> Result<PKey<Private>, ErrorStack>

Deserializes a private key from a PEM-encoded encrypted key type specific format.

This corresponds to PEM_read_bio_PrivateKey.

source

pub fn private_key_from_pem_callback<F>( pem: &[u8], callback: F ) -> Result<PKey<Private>, ErrorStack>where F: FnOnce(&mut [u8]) -> Result<usize, ErrorStack>,

Deserializes a private key from a PEM-encoded encrypted key type specific format.

The callback should fill the password into the provided buffer and return its length.

This corresponds to PEM_read_bio_PrivateKey.

source

pub fn private_key_from_der(der: &[u8]) -> Result<PKey<Private>, ErrorStack>

Decodes a DER-encoded private key.

This function will attempt to automatically detect the underlying key format, and supports the unencrypted PKCS#8 PrivateKeyInfo structures as well as key type specific formats.

This corresponds to d2i_AutoPrivateKey.

source

pub fn private_key_from_pkcs8(der: &[u8]) -> Result<PKey<Private>, ErrorStack>

Deserializes a DER-formatted PKCS#8 unencrypted private key.

This method is mainly for interoperability reasons. Encrypted keyfiles should be preferred.

source

pub fn private_key_from_pkcs8_callback<F>( der: &[u8], callback: F ) -> Result<PKey<Private>, ErrorStack>where F: FnOnce(&mut [u8]) -> Result<usize, ErrorStack>,

Deserializes a DER-formatted PKCS#8 private key, using a callback to retrieve the password if the key is encrypted.

The callback should copy the password into the provided buffer and return the number of bytes written.

This corresponds to d2i_PKCS8PrivateKey_bio.

source

pub fn private_key_from_pkcs8_passphrase( der: &[u8], passphrase: &[u8] ) -> Result<PKey<Private>, ErrorStack>

Deserializes a DER-formatted PKCS#8 private key, using the supplied password if the key is encrypted.

Panics

Panics if passphrase contains an embedded null.

This corresponds to d2i_PKCS8PrivateKey_bio.

source

pub fn private_key_from_raw_bytes( bytes: &[u8], key_type: Id ) -> Result<PKey<Private>, ErrorStack>

Creates a private key from its raw byte representation

Algorithm types that support raw private keys are HMAC, X25519, ED25519, X448 or ED448

This corresponds to EVP_PKEY_new_raw_private_key.

source§

impl PKey<Public>

source

pub fn public_key_from_pem(pem: &[u8]) -> Result<PKey<Public>, ErrorStack>

Decodes a PEM-encoded SubjectPublicKeyInfo structure.

The input should have a header of -----BEGIN PUBLIC KEY-----.

This corresponds to PEM_read_bio_PUBKEY.

source

pub fn public_key_from_der(der: &[u8]) -> Result<PKey<Public>, ErrorStack>

Decodes a DER-encoded SubjectPublicKeyInfo structure.

This corresponds to d2i_PUBKEY.

source

pub fn public_key_from_raw_bytes( bytes: &[u8], key_type: Id ) -> Result<PKey<Public>, ErrorStack>

Creates a public key from its raw byte representation

Algorithm types that support raw public keys are X25519, ED25519, X448 or ED448

This corresponds to EVP_PKEY_new_raw_public_key.

Methods from Deref<Target = PKeyRef<T>>§

source

pub fn rsa(&self) -> Result<Rsa<T>, ErrorStack>

Returns a copy of the internal RSA key.

This corresponds to EVP_PKEY_get1_RSA.

source

pub fn dsa(&self) -> Result<Dsa<T>, ErrorStack>

Returns a copy of the internal DSA key.

This corresponds to EVP_PKEY_get1_DSA.

source

pub fn dh(&self) -> Result<Dh<T>, ErrorStack>

Returns a copy of the internal DH key.

This corresponds to EVP_PKEY_get1_DH.

source

pub fn ec_key(&self) -> Result<EcKey<T>, ErrorStack>

Returns a copy of the internal elliptic curve key.

This corresponds to EVP_PKEY_get1_EC_KEY.

source

pub fn id(&self) -> Id

Returns the Id that represents the type of this key.

This corresponds to EVP_PKEY_id.

source

pub fn size(&self) -> usize

Returns the maximum size of a signature in bytes.

This corresponds to EVP_PKEY_size.

source

pub fn public_key_to_pem(&self) -> Result<Vec<u8>, ErrorStack>

Serializes the public key into a PEM-encoded SubjectPublicKeyInfo structure.

The output will have a header of -----BEGIN PUBLIC KEY-----.

This corresponds to PEM_write_bio_PUBKEY.

source

pub fn public_key_to_der(&self) -> Result<Vec<u8>, ErrorStack>

Serializes the public key into a DER-encoded SubjectPublicKeyInfo structure.

This corresponds to i2d_PUBKEY.

source

pub fn bits(&self) -> u32

Returns the size of the key.

This corresponds to the bit length of the modulus of an RSA key, and the bit length of the group order for an elliptic curve key, for example.

This corresponds to EVP_PKEY_bits.

source

pub fn security_bits(&self) -> u32

Returns the number of security bits.

Bits of security is defined in NIST SP800-57.

This corresponds to EVP_PKEY_security_bits.

source

pub fn public_eq<U>(&self, other: &PKeyRef<U>) -> boolwhere U: HasPublic,

Compares the public component of this key with another.

This corresponds to EVP_PKEY_cmp.

source

pub fn raw_public_key(&self) -> Result<Vec<u8>, ErrorStack>

Raw byte representation of a public key.

This function only works for algorithms that support raw public keys. Currently this is: Id::X25519, Id::ED25519, Id::X448 or Id::ED448.

This corresponds to EVP_PKEY_get_raw_public_key.

source

pub fn private_key_to_pem_pkcs8(&self) -> Result<Vec<u8>, ErrorStack>

Serializes the private key to a PEM-encoded PKCS#8 PrivateKeyInfo structure.

The output will have a header of -----BEGIN PRIVATE KEY-----.

This corresponds to PEM_write_bio_PKCS8PrivateKey.

source

pub fn private_key_to_pem_pkcs8_passphrase( &self, cipher: Cipher, passphrase: &[u8] ) -> Result<Vec<u8>, ErrorStack>

Serializes the private key to a PEM-encoded PKCS#8 EncryptedPrivateKeyInfo structure.

The output will have a header of -----BEGIN ENCRYPTED PRIVATE KEY-----.

This corresponds to PEM_write_bio_PKCS8PrivateKey.

source

pub fn private_key_to_der(&self) -> Result<Vec<u8>, ErrorStack>

Serializes the private key to a DER-encoded key type specific format.

This corresponds to i2d_PrivateKey.

source

pub fn raw_private_key(&self) -> Result<Vec<u8>, ErrorStack>

Raw byte representation of a private key.

This function only works for algorithms that support raw private keys. Currently this is: Id::HMAC, Id::X25519, Id::ED25519, Id::X448 or Id::ED448.

This corresponds to EVP_PKEY_get_raw_private_key.

source

pub fn private_key_to_pkcs8(&self) -> Result<Vec<u8>, ErrorStack>

Serializes a private key into an unencrypted DER-formatted PKCS#8

This corresponds to i2d_PKCS8PrivateKey_bio.

source

pub fn private_key_to_pkcs8_passphrase( &self, cipher: Cipher, passphrase: &[u8] ) -> Result<Vec<u8>, ErrorStack>

Serializes a private key into a DER-formatted PKCS#8, using the supplied password to encrypt the key.

This corresponds to i2d_PKCS8PrivateKey_bio.

Trait Implementations§

source§

impl<T> AsRef<PKeyRef<T>> for PKey<T>

source§

fn as_ref(&self) -> &PKeyRef<T>

Converts this type into a shared reference of the (usually inferred) input type.
source§

impl<T> Borrow<PKeyRef<T>> for PKey<T>

source§

fn borrow(&self) -> &PKeyRef<T>

Immutably borrows from an owned value. Read more
source§

impl<T> Clone for PKey<T>

source§

fn clone(&self) -> PKey<T>

Returns a copy of the value. Read more
1.0.0 · source§

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source. Read more
source§

impl<T> Debug for PKey<T>

source§

fn fmt(&self, fmt: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter. Read more
source§

impl<T> Deref for PKey<T>

§

type Target = PKeyRef<T>

The resulting type after dereferencing.
source§

fn deref(&self) -> &PKeyRef<T>

Dereferences the value.
source§

impl<T> DerefMut for PKey<T>

source§

fn deref_mut(&mut self) -> &mut PKeyRef<T>

Mutably dereferences the value.
source§

impl<T> Drop for PKey<T>

source§

fn drop(&mut self)

Executes the destructor for this type. Read more
source§

impl<T> ForeignType for PKey<T>

§

type CType = EVP_PKEY

The raw C type.
§

type Ref = PKeyRef<T>

The type representing a reference to this type.
source§

unsafe fn from_ptr(ptr: *mut EVP_PKEY) -> PKey<T>

Constructs an instance of this type from its raw type.
source§

fn as_ptr(&self) -> *mut EVP_PKEY

Returns a raw pointer to the wrapped value.
source§

impl<T> TryFrom<Dh<T>> for PKey<T>

§

type Error = ErrorStack

The type returned in the event of a conversion error.
source§

fn try_from(dh: Dh<T>) -> Result<PKey<T>, ErrorStack>

Performs the conversion.
source§

impl<T> TryFrom<Dsa<T>> for PKey<T>

§

type Error = ErrorStack

The type returned in the event of a conversion error.
source§

fn try_from(dsa: Dsa<T>) -> Result<PKey<T>, ErrorStack>

Performs the conversion.
source§

impl<T> TryFrom<EcKey<T>> for PKey<T>

§

type Error = ErrorStack

The type returned in the event of a conversion error.
source§

fn try_from(ec_key: EcKey<T>) -> Result<PKey<T>, ErrorStack>

Performs the conversion.
source§

impl<T> TryFrom<Rsa<T>> for PKey<T>

§

type Error = ErrorStack

The type returned in the event of a conversion error.
source§

fn try_from(rsa: Rsa<T>) -> Result<PKey<T>, ErrorStack>

Performs the conversion.
source§

impl<T> Send for PKey<T>

source§

impl<T> Sync for PKey<T>

Auto Trait Implementations§

§

impl<T> RefUnwindSafe for PKey<T>where T: RefUnwindSafe,

§

impl<T> Unpin for PKey<T>where T: Unpin,

§

impl<T> UnwindSafe for PKey<T>where T: UnwindSafe,

Blanket Implementations§

source§

impl<T> Any for Twhere T: 'static + ?Sized,

source§

fn type_id(&self) -> TypeId

Gets the TypeId of self. Read more
source§

impl<T> Borrow<T> for Twhere T: ?Sized,

source§

fn borrow(&self) -> &T

Immutably borrows from an owned value. Read more
source§

impl<T> BorrowMut<T> for Twhere T: ?Sized,

source§

fn borrow_mut(&mut self) -> &mut T

Mutably borrows from an owned value. Read more
source§

impl<T> From<T> for T

source§

fn from(t: T) -> T

Returns the argument unchanged.

source§

impl<T> Instrument for T

source§

fn instrument(self, span: Span) -> Instrumented<Self>

Instruments this type with the provided Span, returning an Instrumented wrapper. Read more
source§

fn in_current_span(self) -> Instrumented<Self>

Instruments this type with the current Span, returning an Instrumented wrapper. Read more
source§

impl<T, U> Into<U> for Twhere U: From<T>,

source§

fn into(self) -> U

Calls U::from(self).

That is, this conversion is whatever the implementation of From<T> for U chooses to do.

source§

impl<T> ToOwned for Twhere T: Clone,

§

type Owned = T

The resulting type after obtaining ownership.
source§

fn to_owned(&self) -> T

Creates owned data from borrowed data, usually by cloning. Read more
source§

fn clone_into(&self, target: &mut T)

Uses borrowed data to replace owned data, usually by cloning. Read more
source§

impl<T, U> TryFrom<U> for Twhere U: Into<T>,

§

type Error = Infallible

The type returned in the event of a conversion error.
source§

fn try_from(value: U) -> Result<T, <T as TryFrom<U>>::Error>

Performs the conversion.
source§

impl<T, U> TryInto<U> for Twhere U: TryFrom<T>,

§

type Error = <U as TryFrom<T>>::Error

The type returned in the event of a conversion error.
source§

fn try_into(self) -> Result<U, <U as TryFrom<T>>::Error>

Performs the conversion.
§

impl<V, T> VZip<V> for Twhere V: MultiLane<T>,

§

fn vzip(self) -> V

source§

impl<T> WithSubscriber for T

source§

fn with_subscriber<S>(self, subscriber: S) -> WithDispatch<Self>where S: Into<Dispatch>,

Attaches the provided Subscriber to this type, returning a WithDispatch wrapper. Read more
source§

fn with_current_subscriber(self) -> WithDispatch<Self>

Attaches the current default Subscriber to this type, returning a WithDispatch wrapper. Read more