Struct KeyPair 

pub struct KeyPair { /* private fields */ }

Available on crate features aws-lc and crypto and std only.

An RSA key pair, used for signing.

Implementations

impl KeyPair

pub fn generate(size: KeySize) -> Result<KeyPair, Unspecified>

Generate a RSA KeyPair of the specified key-strength.

Supports the following key sizes:

• KeySize::Rsa2048
• KeySize::Rsa3072
• KeySize::Rsa4096
• KeySize::Rsa8192

Errors

• Unspecified: Any key generation failure.

pub fn from_pkcs8(pkcs8: &[u8]) -> Result<KeyPair, KeyRejected>

Parses an unencrypted PKCS#8 DER encoded RSA private key.

Keys can be generated using KeyPair::generate.

ring-compatibility

aws-lc-rs does not impose the same limitations that ring does for RSA keys. Thus signatures may be generated by keys that are not accepted by ring. In particular:

• RSA private keys ranging between 2048-bit keys and 8192-bit keys are supported.
• The public exponent does not have a required minimum size.

Errors

error::KeyRejected if bytes do not encode an RSA private key or if the key is otherwise not acceptable.

pub fn from_der(input: &[u8]) -> Result<KeyPair, KeyRejected>

Parses a DER-encoded RSAPrivateKey structure (RFC 8017).

Errors

error:KeyRejected on error.

pub fn sign( &self, padding_alg: &'static dyn RsaEncoding, _rng: &dyn SecureRandom, msg: &[u8], signature: &mut [u8], ) -> Result<(), Unspecified>

Sign msg. msg is digested using the digest algorithm from padding_alg and the digest is then padded using the padding algorithm from padding_alg. The signature is written into signature; signature’s length must be exactly the length returned by public_modulus_len().

This function does not take a precomputed digest; instead, sign calculates the digest itself. See sign_digest.

ring Compatibility

Our implementation ignores the SecureRandom parameter.

Errors

error::Unspecified on error. With “fips” feature enabled, errors if digest length is greater than u32::MAX.

pub fn sign_digest( &self, padding_alg: &'static dyn RsaEncoding, digest: &Digest, signature: &mut [u8], ) -> Result<(), Unspecified>

The digest is padded using the padding algorithm from padding_alg. The signature is written into signature; signature’s length must be exactly the length returned by public_modulus_len().

ring Compatibility

Our implementation ignores the SecureRandom parameter.

Errors

error::Unspecified on error. With “fips” feature enabled, errors if digest length is greater than u32::MAX.

pub fn public_modulus_len(&self) -> usize

Returns the length in bytes of the key pair’s public modulus.

A signature has the same length as the public modulus.

pub fn from_components<Public, Private>( components: &KeyPairComponents<Public, Private>, ) -> Result<KeyPair, KeyRejected>

where Public: AsRef<[u8]>, Private: AsRef<[u8]>,

Constructs an RSA private key from its big-endian-encoded components.

All components, including the CRT parameters (dP, dQ, qInv), are required and are validated for consistency with one another: the key is rejected unless n == p * q, d * e == 1 (mod p-1), d * e == 1 (mod q-1), dP == d (mod p-1), dQ == d (mod q-1), and qInv == q**-1 (mod p). No primality tests are performed on p and q.

Only two-prime (not multi-prime) keys are supported. The public modulus (n) must be 2048 to 8192 bits. The public exponent (e) must be odd, greater than 1, and no longer than 33 bits.

The public components (n and e) must be encoded without leading zero bytes, as documented on PublicKeyComponents. Leading zero bytes are permitted on the private components.

ring compatibility

aws-lc-rs does not impose the same limitations that ring does, so keys rejected by ring may be accepted here. In particular:

• The public modulus may be up to 8192 bits, rather than 4096.
• The public exponent has no required minimum size, whereas ring requires it to be at least 65537.

In two respects aws-lc-rs is stricter than ring, so a key accepted by ring may be rejected here:

• ring never uses d and so does not fully validate it. We do validate d, which means a key carrying a placeholder or otherwise inconsistent d is rejected.
• ring defers validation of the CRT parameters until the key is used for signing. We validate them here, so an inconsistent key fails at construction rather than at first use.

Errors

KeyRejected if the components do not form a valid, supported RSA private key.

Trait Implementations

impl AsDer<Pkcs8V1Der<'static>> for KeyPair

fn as_der(&self) -> Result<Pkcs8V1Der<'static>, Unspecified>

Serializes into a DER format.

impl Debug for KeyPair

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl KeyPair for KeyPair

type PublicKey = PublicKey

The type of the public key.

fn public_key(&self) -> &<KeyPair as KeyPair>::PublicKey

The public key for the key pair.

impl Send for KeyPair

impl Sync for KeyPair