Struct HsmKey

struct HsmKey<'a, 'b> {
    public_key: PublicKey,
    nethsm: &'a NetHsm,
    key_id: &'b KeyId,
}

PGP-adapter for a NetHSM key.

All PGP-related operations executed on objects of this type will be forwarded to the NetHSM instance.

Fields

public_key: PublicKey

nethsm: &'a NetHsm

key_id: &'b KeyId

Implementations

impl<'a, 'b> HsmKey<'a, 'b>

fn new(nethsm: &'a NetHsm, public_key: PublicKey, key_id: &'b KeyId) -> Self

Creates a new remote signing key which will use key_id key for signing.

fn sign_mode(&self) -> Result<SignatureType>

Returns correct mode to use for signatures which depend on the public key.

Trait Implementations

impl Debug for HsmKey<'_, '_>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl KeyDetails for HsmKey<'_, '_>

fn version(&self) -> KeyVersion

fn fingerprint(&self) -> Fingerprint

fn key_id(&self) -> KeyId

fn algorithm(&self) -> PublicKeyAlgorithm

impl SecretKeyTrait for HsmKey<'_, '_>

fn create_signature( &self, _key_pw: &Password, hash: HashAlgorithm, data: &[u8], ) -> Result<SignatureBytes>

Creates a data signature.

Note

The NetHsm in use is expected to be unlocked and configured to use a user in the Operator role with access to the signing key. Using a [Password] is not necessary as the operation deals with unencrypted cryptographic key material.

Errors

Returns an error if

• the key uses unsupported parameters (e.g. brainpool curves),
• digest serialization fails (e.g. ASN1 encoding of digest for RSA signatures),
• NetHSM sign_digest call fails,
• parsing of signature returned from the NetHSM fails.

fn hash_alg(&self) -> HashAlgorithm

Returns the preferred hash algorithm for data digests.

Note

We always return SHA-512 since this it is faster than SHA-256 on modern hardware and of sufficient size to accommodate all elliptic-curve algorithms.