Struct Salt 

pub struct Salt { /* private fields */ }

Available on crate features aws-lc and crypto and std only.

A salt for HKDF operations.

Implementations

impl Salt

pub fn new(algorithm: Algorithm, value: &[u8]) -> Salt

Constructs a new Salt with the given value based on the given digest algorithm.

Constructing a Salt is relatively expensive so it is good to reuse a Salt object instead of re-constructing Salts with the same value.

Panics

new panics if salt creation fails

pub fn none(algorithm: Algorithm) -> Salt

Constructs a Salt with no salt value.

This is equivalent to a salt argument of “a string of HashLen zeros” as described in RFC 5869 Section 2.2, and avoids the awkward Salt::new(alg, b"") idiom.

Use a salt when you can

HKDF’s extraction step is strengthened by a non-secret, ideally random salt; RFC 5869 Section 3.1 recommends supplying one whenever the application can, and NIST SP 800-56C Rev. 2 §5.1 likewise recommends a non-empty salt for the key-derivation key. In particular, when the input keying material is not uniformly random or when an attacker has any control over it, a salt is what gives the extract step a reduction to HMAC’s PRF security.

Use this constructor only when no salt material is available to the application. Otherwise prefer Salt::new with a salt that is at least as long as the underlying digest’s output and is either random or chosen with care to avoid collisions across uses of the same key.

pub fn extract(&self, secret: &[u8]) -> Prk

The HKDF-Extract operation.

Panics

Panics if the extract operation is unable to be performed

pub fn algorithm(&self) -> Algorithm

The algorithm used to derive this salt.

Trait Implementations

impl Debug for Salt

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl From<Okm<'_, Algorithm>> for Salt

fn from(okm: Okm<'_, Algorithm>) -> Salt

Converts to this type from the input type.