Cryptography API¶

For convenience, CCF provides access to commonly used cryptographic primitives to applications.

Note

This page describes the C++ API. For the API for TypeScript/JavaScript applications, see ccf-app/crypto .

Hashing¶

std::vector<uint8_t> ccf::crypto::sha256(const std::vector<uint8_t> &data)¶

HashBytes ccf::crypto::hmac(MDType type, const std::span<const uint8_t> &key, const std::span<const uint8_t> &data)¶: Compute the HMAC of key and data

class HashProvider¶

Subclassed by ccf::crypto::OpenSSLHashProvider

Public Functions

virtual HashBytes hash(const uint8_t *data, size_t size, MDType type) const = 0¶

Generic Hash function

Parameters:

data – The data to hash
size – The size of data
type – The type of hash to compute

std::shared_ptr<HashProvider> ccf::crypto::make_hash_provider()¶: Create a default hash provider

Asymmetric Keys¶

CCF supports EC and RSA keys; public keys are held in [RSA|EC]PublicKey objects and private keys in [RSA|EC]KeyPair objects. [RSA|EC]KeyPair automatically generate random keys when constructed via ECKeyPairPtr ccf::crypto::make_ec_key_pair(CurveID) or RSAKeyPairPtr ccf::crypto::make_rsa_key_pair(size_t, size_t).

class ECPublicKey¶

Subclassed by ccf::crypto::ECPublicKey_OpenSSL

Public Functions

virtual bool verify(const uint8_t *contents, size_t contents_size, const uint8_t *sig, size_t sig_size, MDType md_type, HashBytes &bytes) = 0¶

Verify that a signature was produced on contents with the private key associated with the public key held by the object.

Parameters:

contents – address of contents
contents_size – size of contents
sig – address of signature
sig_size – size of signature
md_type – Digest algorithm to use
bytes – Buffer to write the hash to

Returns:

Whether the signature matches the contents and the key

inline bool verify(const uint8_t *contents, size_t contents_size, const uint8_t *sig, size_t sig_size, MDType md_type = MDType::NONE)¶

Verify that a signature was produced on contents with the private key associated with the public key held by the object.

Parameters:

contents – address of contents
contents_size – size of contents
sig – address of signature
sig_size – size of signature
md_type – Digest algorithm to use (derived from the public key if md_type == MDType::None).

Returns:

Whether the signature matches the contents and the key

inline virtual bool verify(const std::vector<uint8_t> &contents, const std::vector<uint8_t> &signature)¶

Verify that a signature was produced on contents with the private key associated with the public key held by the object.

Parameters:

contents – Sequence of bytes that was signed
signature – Signature as a sequence of bytes

Returns:

Whether the signature matches the contents and the key

inline virtual bool verify_hash(const std::vector<uint8_t> &hash, const std::vector<uint8_t> &signature, MDType md_type)¶

Verify that a signature was produced on the hash of some contents with the private key associated with the public key held by the object.

Parameters:

hash – Hash of some content
signature – Signature as a sequence of bytes
md_type – Type of hash

Returns:

Whether the signature matches the hash and the key

virtual bool verify_hash(const uint8_t *hash, size_t hash_size, const uint8_t *sig, size_t sig_size, MDType md_type) = 0¶

Verify that a signature was produced on the hash of some contents with the private key associated with the public key held by the object.

Parameters:

hash – Hash of some content
hash_size – length of hash
sig – Signature as a sequence of bytes
sig_size – Length of sig
md_type – Digest algorithm

Returns:

Whether the signature matches the hash and the key

virtual Pem public_key_pem() const = 0¶: Get the public key in PEM format

virtual std::vector<uint8_t> public_key_der() const = 0¶: Get the public key in DER format

virtual std::vector<uint8_t> public_key_raw() const = 0¶: Get the raw bytes of the public key

virtual CurveID get_curve_id() const = 0¶: The curve ID

virtual Coordinates coordinates() const = 0¶: The x/y coordinates of the public key

struct Coordinates¶

class ECKeyPair¶

Subclassed by ccf::crypto::ECKeyPair_OpenSSL

Public Functions

virtual Pem create_csr(const std::vector<uint8_t> &subject_name_der, const std::vector<SubjectAltName> &subject_alt_names, const std::optional<Pem> &public_key = std::nullopt) const = 0¶

Create a CSR for a DER-encoded subject name

Throws:: std::invalid_argument – if subject_name_der is not one DER Name

class RSAPublicKey¶

Subclassed by ccf::crypto::RSAKeyPair, ccf::crypto::RSAPublicKey_OpenSSL

Public Functions

virtual size_t key_size() const = 0¶: Get the key size in bits

virtual std::vector<uint8_t> rsa_oaep_wrap(const uint8_t *input, size_t input_size, const uint8_t *label = nullptr, size_t label_size = 0) = 0¶

Wrap data using RSA-OAEP-256 (CKM_RSA_PKCS_OAEP)

Parameters:

input – Pointer to raw data to wrap
input_size – Size of raw data
label – Optional string used as label during wrapping
label_size – Size of label

Returns:

Wrapped data

virtual std::vector<uint8_t> rsa_oaep_wrap(const std::vector<uint8_t> &input, const std::optional<std::vector<std::uint8_t>> &label = std::nullopt) = 0¶

Wrap data using RSA-OAEP-256 (CKM_RSA_PKCS_OAEP)

Parameters:

input – Raw data to wrap
label – Optional string used as label during wrapping

Returns:

Wrapped data

virtual Pem public_key_pem() const = 0¶: Get the public key in PEM format

virtual std::vector<uint8_t> public_key_der() const = 0¶: Get the public key in DER format

virtual JsonWebKeyRSAPublic public_key_jwk(const std::optional<std::string> &kid = std::nullopt) const = 0¶: Get the public key in JWK format

class RSAKeyPair : public ccf::crypto::RSAPublicKey ¶

Subclassed by ccf::crypto::RSAKeyPair_OpenSSL

Public Functions

virtual std::vector<uint8_t> rsa_oaep_unwrap(const std::vector<uint8_t> &input, const std::optional<std::vector<std::uint8_t>> &label = std::nullopt) = 0¶

Unwrap data using RSA-OAEP-256 (CKM_RSA_PKCS_OAEP)

Parameters:

input – Raw data to unwrap
label – Optional string used as label during unwrapping

Returns:

Unwrapped data

enum class ccf::crypto::CurveID : uint8_t¶

Values:

enumerator NONE¶: No curve.

enumerator SECP384R1¶: The SECP384R1 curve.

enumerator SECP256R1¶: The SECP256R1 curve.

enumerator CURVE25519¶: The CURVE25519 curve.

enumerator X25519¶

enumerator SECP521R1¶: The SECP521R1 curve.

ECKeyPairPtr ccf::crypto::make_ec_key_pair(CurveID curve_id = service_identity_curve_choice)¶

Create a new public / private ECDSA key pair on specified curve and implementation

Parameters:: curve_id – Elliptic curve to use
Returns:: Key pair

ECKeyPairPtr ccf::crypto::make_ec_key_pair(const Pem &pem)¶

Create a public / private ECDSA key pair from existing private key data

Parameters:: pem – PEM key to load
Returns:: Key pair

RSAKeyPairPtr ccf::crypto::make_rsa_key_pair(size_t public_key_size = default_rsa_public_key_size, size_t public_exponent = default_rsa_public_exponent)¶: Create a new public / private RSA key pair with specified size and exponent

ML-DSA Signing Keys¶

CCF supports ML-DSA (FIPS 204) keys with OpenSSL 3.5 or newer; public keys are held in MLDSAPublicKey objects and private keys in MLDSAKeyPair objects. Signatures are pure ML-DSA over the message, with an optional context string of at most 255 bytes. Private keys are exported in plaintext, so callers are responsible for protecting the returned buffers.

class MLDSAPublicKey¶

ML-DSA public-key interface backed by the configured OpenSSL providers.

Subclassed by ccf::crypto::MLDSAPublicKey_OpenSSL

Public Functions

virtual Pem public_key_pem() const = 0¶: Export a SubjectPublicKeyInfo public key.

virtual bool verify(std::span<const uint8_t> contents, std::span<const uint8_t> signature, std::span<const uint8_t> context = {}) = 0¶: Verify a pure ML-DSA signature over the supplied message bytes. Context is an optional domain-separation string of at most 255 bytes. Invalid signatures return false. Provider errors, including rejected contexts, throw exceptions.

class MLDSAKeyPair¶

ML-DSA key-pair interface backed by the configured OpenSSL providers.

Subclassed by ccf::crypto::MLDSAKeyPair_OpenSSL

Public Functions

virtual Pem private_key_pem() const = 0¶: Export an unencrypted PKCS#8 private key using the configured provider’s encoder, which selects the RFC 9881 private-key form. The returned Pem and vector contain plaintext secrets in ordinary caller-owned memory. Callers are responsible for protecting and erasing exported keys and their copies.

virtual Pem public_key_pem() const = 0¶: Export a SubjectPublicKeyInfo public key.

virtual std::vector<uint8_t> sign(std::span<const uint8_t> contents, std::span<const uint8_t> context = {}) const = 0¶: Sign contents with pure ML-DSA over the supplied message bytes. Context is an optional domain-separation string of at most 255 bytes. Provider errors, including rejected contexts, throw exceptions.

virtual bool verify(std::span<const uint8_t> contents, std::span<const uint8_t> signature, std::span<const uint8_t> context = {}) = 0¶: Invalid signatures return false; provider errors throw.

virtual Pem create_csr(const std::string &subject_name, const std::vector<SubjectAltName> &subject_alt_names = {}, const std::optional<Pem> &public_key = std::nullopt) const = 0¶: PKCS#10 request for this key, or for public_key (SPKI PEM) when given, signed with pure ML-DSA. Subject name is “K=V,K=V”, e.g. “CN=CCF Node”.

virtual Pem create_csr(const std::vector<uint8_t> &subject_name_der, const std::vector<SubjectAltName> &subject_alt_names = {}, const std::optional<Pem> &public_key = std::nullopt) const = 0¶: As above, with the subject name as a DER-encoded X.501 Name. Throws std::invalid_argument unless subject_name_der is exactly one Name.

inline Pem sign_csr(const Pem &issuer_cert, const Pem &signing_request, const std::string &valid_from, const std::string &valid_to, bool ca = false, Signer signer = Signer::SUBJECT) const¶: X.509 certificate for signing_request, issued under issuer_cert with pure ML-DSA; the request signature is verified with the key of signer. Times are “YYYYMMDDHHMMSSZ”. Throws std::logic_error on an invalid validity period, std::runtime_error on other invalid input or provider failures.

inline Pem self_sign(const std::string &subject_name, const std::string &valid_from, const std::string &valid_to, const std::vector<SubjectAltName> &subject_alt_names = {}, bool ca = true) const¶: Self-signed X.509 certificate for this key, a CA by default. Times are “YYYYMMDDHHMMSSZ”. Throws std::logic_error on an invalid validity period, std::runtime_error on other invalid input or provider failures.

inline Pem self_sign(const std::vector<uint8_t> &subject_name_der, const std::string &valid_from, const std::string &valid_to, const std::vector<SubjectAltName> &subject_alt_names = {}, bool ca = true) const¶: As above, with the subject name as a DER-encoded X.501 Name.

enum class ccf::crypto::MLDSAParameterSet : uint8_t¶

Values:

enumerator ML_DSA_44¶

enumerator ML_DSA_65¶

enumerator ML_DSA_87¶

MLDSAKeyPairPtr ccf::crypto::make_mldsa_key_pair(MLDSAParameterSet parameter_set)¶: Generate a key pair with an explicitly selected parameter set. Throws std::invalid_argument for an unknown parameter set.

MLDSAKeyPairPtr ccf::crypto::make_mldsa_key_pair(const Pem &pem, MLDSAParameterSet expected)¶: Import with an expected parameter set for a trust anchor or identity. A mismatch throws std::invalid_argument once the key is decoded. Other import errors have the same contract as unpinned import.

MLDSAPublicKeyPtr ccf::crypto::make_mldsa_public_key(const Pem &pem, MLDSAParameterSet expected)¶: Import with an expected parameter set for a trust anchor or identity. A mismatch throws std::invalid_argument once the key is decoded. Other import errors have the same contract as unpinned import.

Symmetric Keys¶

Currently, only AES-GCM is supported for symmetric encryption. New keys are generated via ccf::crypto::Entropy::random()

class Entropy¶

Subclassed by ccf::crypto::Entropy_OpenSSL

Public Functions

virtual std::vector<uint8_t> random(size_t len) = 0¶

Generate len random bytes

Parameters:: len – Number of random bytes to generate
Returns:: vector random bytes

virtual void random(unsigned char *data, size_t len) = 0¶

Generate len random bytes into data

Parameters:

len – Number of random bytes to generate
data – Buffer to fill

virtual uint64_t random64() = 0¶

Generate a random uint64_t

Returns:: a random uint64_t

Signatures¶

Verification of signatures is supported via the Verifier class.

class Verifier¶

Subclassed by ccf::crypto::Verifier_OpenSSL

Public Functions

virtual bool verify(const uint8_t *contents, size_t contents_size, const uint8_t *sig, size_t sig_size, MDType md_type = MDType::NONE) const¶

Verify a signature

Parameters:

contents – Contents over which the signature was generated
contents_size – Size of contents
sig – Signature
sig_size – Size of sig
md_type – Hash algorithm. Pure ML-DSA accepts only MDType::NONE

Returns:

Boolean indicating success

inline virtual bool verify(std::span<const uint8_t> contents, std::span<const uint8_t> sig, MDType md_type = MDType::NONE) const¶

Verify a signature

Parameters:

contents – Contents over which the signature was generated
sig – Signature
md_type – Hash algorithm

Returns:

Boolean indicating success

inline virtual bool verify(const std::vector<uint8_t> &contents, const std::vector<uint8_t> &signature, MDType md_type = MDType::NONE) const¶

Verify a signature

Parameters:

contents – Contents over which the signature was generated
signature – Signature
md_type – Hash algorithm

Returns:

Boolean indicating success

virtual bool verify_hash(const uint8_t *hash, size_t hash_size, const uint8_t *sig, size_t sig_size, MDType md_type = MDType::NONE)¶

Verify a signature over a hash

Parameters:

hash – Hash over which the signature was generated
hash_size – Size of hash
sig – Signature
sig_size – Size of sig
md_type – Hash algorithm

Throws:

std::logic_error – for pure ML-DSA (no pre-hashed input support)

Returns:

Boolean indicating success

inline virtual bool verify_hash(const std::vector<uint8_t> &hash, const std::vector<uint8_t> &signature, MDType md_type = MDType::NONE)¶

Verify a signature over a hash

Parameters:

hash – Hash over which the signature was generated
signature – Signature
md_type – Hash algorithm

Returns:

Boolean indicating success

template<size_t SIZE> inline bool verify_hash(const std::array<uint8_t, SIZE> &hash, const std::vector<uint8_t> &signature, MDType md_type = MDType::NONE)¶

Verify a signature over a hash

Parameters:

hash – Hash over which the signature was generated
signature – Signature
md_type – Hash algorithm

Returns:

Boolean indicating success

virtual Pem public_key_pem() const¶

Extract the public key of the certificate in PEM format

Returns:: PEM encoded public key

virtual std::vector<uint8_t> public_key_der() const¶

Extract the public key of the certificate in DER format

Returns:: DER encoded public key

virtual bool verify_certificate(const std::vector<const Pem*> &trusted_certs, const std::vector<const Pem*> &chain = {}, bool ignore_time = false) = 0¶

Verify the certificate (held internally)

Parameters:

trusted_certs – Vector of trusted certificates
chain – Vector of ordered untrusted certificates used to build a chain to trusted certificates
ignore_time – Flag to disable certificate expiry checks

Returns:

true if the verification is successful

virtual bool is_self_signed() const = 0¶: Indicates whether the certificate (held intenally) is self-signed

virtual std::string serial_number() const = 0¶: The serial number of the certificate

virtual std::pair<std::string, std::string> validity_period() const = 0¶: The validity period of the certificate

virtual size_t remaining_seconds(const ccf::nonstd::SystemClock::time_point &now) const = 0¶: The number of seconds of the validity period of the certificate remaining at now. Both ends of the period are included, so this is the whole period before it starts, and 0 once it has expired

virtual double remaining_percentage(const ccf::nonstd::SystemClock::time_point &now) const = 0¶: The fraction, from 0.0 to 1.0, of the validity period of the certificate remaining at now

virtual std::string subject() const = 0¶: The subject name of the certificate

virtual std::vector<uint8_t> subject_der() const = 0¶: The DER-encoded subject name of the certificate

COSE Keys¶

EC2 (P-256, P-384 or P-521), OKP (Ed25519) and RSA public keys can be held as COSE_Keys (RFC 9052), which are parsed, validated and encoded by ccf::crypto::COSEKey, and verify COSE_Sign1 signatures through a verifier made by ccf::crypto::make_cose_verifier_from_key().

class COSEKey¶

A public key that verifies COSE_Sign1 signatures, as carried in a COSE_Key (RFC 9052 Section 7): an EC2 key on P-256, P-384 or P-521 (RFC 9053 Section 7.1.1), an OKP key on Ed25519 (RFC 9053 Section 7.2), or an RSA key (RFC 8230 Section 4).

The key parameters, the encoding and the RFC 9679 thumbprint are derived from the key on each call, so callers that use them repeatedly should keep the result, for example by kid. Pass the key to ccf::crypto::make_cose_verifier_from_key() to verify signatures.

Public Functions

explicit COSEKey(ECPublicKeyPtr key)¶

Throws:

std::invalid_argument – if key is null
std::runtime_error – if the curve is not P-256, P-384 or P-521

explicit COSEKey(RSAPublicKeyPtr key)¶

Throws:

std::invalid_argument – if key is null
std::runtime_error – if the modulus is not 2048 to 16384 bits long, or the public exponent is not odd, at least 3 and at most 64 bits long.

explicit COSEKey(EdDSAPublicKeyPtr key)¶

Throws:

std::invalid_argument – if key is null
std::runtime_error – if the curve is not Ed25519, or the key is not a canonical encoding, with y below the field prime

std::optional<int64_t> alg() const¶: The “alg” of a parsed COSE_Key, if any. Verifiers made from this key reject every other algorithm (RFC 9052 Section 7.1).

std::optional<EC2Parameters> ec2_parameters() const¶: The key parameters, or std::nullopt if kty() is not EC2.

std::optional<RSAParameters> rsa_parameters() const¶: The key parameters, or std::nullopt if kty() is not RSA.

std::optional<OKPParameters> okp_parameters() const¶: The key parameters, or std::nullopt if kty() is not OKP.

ECPublicKeyPtr ec_public_key() const¶: The key, or nullptr if kty() is not EC2.

RSAPublicKeyPtr rsa_public_key() const¶: The key, or nullptr if kty() is not RSA.

EdDSAPublicKeyPtr eddsa_public_key() const¶: The key, or nullptr if kty() is not OKP.

std::vector<uint8_t> to_cbor(int64_t alg) const¶

Deterministically encoded COSE_Key (RFC 8949 Section 4.2.1), with kty, the key parameters and alg.

Parameters:: alg – Algorithm of the key, such as alg() for a parsed key
Throws:: std::runtime_error – if alg is not an algorithm that CCF can verify with the key

std::vector<uint8_t> to_cbor(int64_t alg, std::span<const uint8_t> kid) const¶

As to_cbor(int64_t), with a key identifier.

Parameters:

alg – Algorithm of the key
kid – Key identifier, encoded as a byte string

std::vector<uint8_t> to_cbor(int64_t alg, std::string_view kid) const¶

As to_cbor(int64_t), with a key identifier.

Parameters:

alg – Algorithm of the key
kid – Key identifier, whose bytes are encoded as a byte string

Sha256Hash thumbprint_sha256() const¶: COSE Key Thumbprint (RFC 9679) with SHA-256.

Public Static Functions

static COSEKey from_cbor(std::span<const uint8_t> cose_key)¶

Parse an encoded COSE_Key, which may be untrusted.

Only public keys are accepted: EC2 keys whose coordinates have the curve’s field size and form a point on the curve, OKP keys on Ed25519 whose x is 32 bytes long and encodes a y coordinate below the field prime, and RSA keys of 2048 to 16384 bits whose public exponent is odd, at least 3 and at most 64 bits long. Compressed EC2 points, Ed25519 y coordinates that are not below the field prime, and RSA parameters with leading zero octets, are rejected, so that each key has a single encoding and thumbprint. “alg”, if present, must be an algorithm that CCF can verify with the key, and “key_ops”, if present, must allow verify. “kid” is not retained, and unknown labels are ignored.

Throws:: std::invalid_argument – if cose_key is malformed or unsupported

static COSEKey from_der_cert(std::span<const uint8_t> der)¶

The public key of a DER X.509 certificate, which may be untrusted. An RSA key must meet the same requirements as in from_cbor().

Throws:: std::invalid_argument – if the certificate cannot be parsed, or its key is not supported

struct EC2Parameters¶

EC2 key parameters.

Public Members

int64_t crv = 0¶: COSE curve: 1 (P-256), 2 (P-384) or 3 (P-521)

std::vector<uint8_t> x¶: x-coordinate, of the curve’s field size

std::vector<uint8_t> y¶: y-coordinate, of the curve’s field size

struct OKPParameters¶

OKP key parameters.

Public Members

int64_t crv = 0¶: COSE curve: 6 (Ed25519)

std::vector<uint8_t> x¶: Public key.

struct RSAParameters¶

RSA key parameters, big-endian without leading zero octets.

Public Members

std::vector<uint8_t> n¶: Modulus.

std::vector<uint8_t> e¶: Public exponent.

enum class ccf::crypto::COSEKeyType : uint8_t¶

COSE key types, from the IANA “COSE Key Types” registry.

Values:

enumerator OKP¶

enumerator EC2¶

enumerator RSA¶

COSEVerifierUniquePtr ccf::crypto::make_cose_verifier_from_key(const COSEKey &key)¶: Create a verifier from a COSE key, with no re-encoding of the key. If the key has an “alg”, the verifier rejects every other algorithm.

Key Wrapping¶

PKCS11 2.1.8 CKM_RSA_PKCS_OAEP

std::vector<uint8_t> ccf::crypto::ckm_rsa_pkcs_oaep_wrap(RSAPublicKeyPtr wrapping_key, const std::vector<uint8_t> &unwrapped, const std::optional<std::vector<uint8_t>> &label = {})¶

PKCS11 2.1.8 CKM_RSA_PKCS_OAEP wrap

Parameters:

wrapping_key – The wrapping (encryption) key
unwrapped – The unwrapped key to be wrapped
label – Optional label

Returns:

Wrapped key

std::vector<uint8_t> ccf::crypto::ckm_rsa_pkcs_oaep_wrap(const Pem &wrapping_key, const std::vector<uint8_t> &unwrapped, const std::optional<std::vector<uint8_t>> &label = {})¶

PKCS11 2.1.8 CKM_RSA_PKCS_OAEP

Parameters:

wrapping_key – The wrapping (encryption) key
unwrapped – The unwrapped key to be wrapped
label – Optional label

Returns:

Wrapped key

std::vector<uint8_t> ccf::crypto::ckm_rsa_pkcs_oaep_unwrap(RSAKeyPairPtr wrapping_key, const std::vector<uint8_t> &wrapped, const std::optional<std::vector<uint8_t>> &label = {})¶

PKCS11 2.1.8 CKM_RSA_PKCS_OAEP unwrap

Parameters:

wrapping_key – The wrapping (encryption) key
wrapped – The wrapped key to unwrap
label – Optional label

Returns:

Unwrapped key

std::vector<uint8_t> ccf::crypto::ckm_rsa_pkcs_oaep_unwrap(const Pem &wrapping_key, const std::vector<uint8_t> &wrapped, const std::optional<std::vector<uint8_t>> &label = {})¶

PKCS11 2.1.8 CKM_RSA_PKCS_OAEP

Parameters:

wrapping_key – The wrapping (encryption) key
wrapped – The wrapped key to unwrap
label – Optional label

Returns:

Unwrapped key

PKCS11 2.14.3 CKM_AES_KEY_WRAP_PAD (RFC 5649)

std::vector<uint8_t> ccf::crypto::ckm_aes_key_wrap_pad(const std::vector<uint8_t> &wrapping_key, const std::vector<uint8_t> &unwrapped)¶

PKCS11 2.14.3 CKM_AES_KEY_WRAP_PAD wrap

Parameters:

wrapping_key – The wrapping (encryption) key
unwrapped – The unwrapped key to be wrapped

Returns:

Wrapped key

std::vector<uint8_t> ccf::crypto::ckm_aes_key_unwrap_pad(const std::vector<uint8_t> &wrapping_key, const std::vector<uint8_t> &wrapped)¶

PKCS11 2.14.3 CKM_AES_KEY_WRAP_PAD unwrap

Parameters:

wrapping_key – The wrapping (encryption) key
wrapped – The wrapped key to unwrap

Returns:

Unwrapped key

PKCS11 2.1.21 CKM_RSA_AES_KEY_WRAP

std::vector<uint8_t> ccf::crypto::ckm_rsa_aes_key_wrap(size_t aes_key_size, RSAPublicKeyPtr wrapping_key, const std::vector<uint8_t> &unwrapped, const std::optional<std::vector<uint8_t>> &label = {})¶

PKCS11 2.1.21 CKM_RSA_AES_KEY_WRAP wrap

Parameters:

aes_key_size – Key size 128, 192 or 256.
wrapping_key – The wrapping (encryption) key
unwrapped – The key to wrap
label – Optional label

Returns:

Wrapped key

std::vector<uint8_t> ccf::crypto::ckm_rsa_aes_key_wrap(size_t aes_key_size, const Pem &wrapping_key, const std::vector<uint8_t> &unwrapped, const std::optional<std::vector<uint8_t>> &label = {})¶

PKCS11 2.1.21 CKM_RSA_AES_KEY_WRAP wrap

Parameters:

aes_key_size – Key size 128, 192 or 256.
wrapping_key – The wrapping (encryption) key
unwrapped – The key to wrap
label – Optional label

Returns:

Wrapped key

std::vector<uint8_t> ccf::crypto::ckm_rsa_aes_key_unwrap(RSAKeyPairPtr wrapping_key, const std::vector<uint8_t> &wrapped, const std::optional<std::vector<uint8_t>> &label = {})¶

PKCS11 2.1.21 CKM_RSA_AES_KEY_WRAP unwrap

Parameters:

wrapping_key – The wrapping (encryption) key
wrapped – The wrapped key to unwrap
label – Optional label

Returns:

Unwrapped key

std::vector<uint8_t> ccf::crypto::ckm_rsa_aes_key_unwrap(const Pem &wrapping_key, const std::vector<uint8_t> &wrapped, const std::optional<std::vector<uint8_t>> &label = {})¶

PKCS11 2.1.21 CKM_RSA_AES_KEY_WRAP unwrap

Parameters:

wrapping_key – The wrapping (encryption) key
wrapped – The wrapped key to unwrap
label – Optional label

Returns:

Unwrapped key