Struct Pkcs11Instance 

pub struct Pkcs11Instance {
    pub config: Config,
    /* private fields */
}

One open PKCS#11-backed keystore connection.

Owns the cryptoki client and the live session. Both are Send + Sync (the underlying PKCS#11 module was initialised with CKF_OS_LOCKING_OK), so the trait object is sound without a manual unsafe impl.

Fields

config: Config

Resolved configuration parsed from Options at open time.

Trait Implementations

impl StoreInstance for Pkcs11Instance

fn put_secret( &mut self, _module: &str, _app: &str, _key_id: &str, _key: *mut c_void, ) -> Result<()>

Insert a secret key into the private compartment, indexed by key_id.

fn get_secret( &self, _module: &str, _app: &str, _key_id: &str, ) -> Result<*mut c_void>

Fetch a secret key from the private compartment by key_id. Returns crate::error::Error::ValueNotFound if absent.

fn put_public( &mut self, _module: &str, _app: &str, _identity: &str, _key: *mut c_void, _sig: &[u8], ) -> Result<()>

Insert a public key into the public compartment, indexed by identity, with a detached signature over the identity.

fn get_public( &self, _module: &str, _app: &str, _identity: &str, ) -> Result<(*mut c_void, Vec<u8>)>

Fetch a public key from the public compartment by identity. Returns the key handle and the stored signature bytes.

fn enumerate( &self, _module: &str, _app: &str, _compartment: Compartment, ) -> Result<Vec<(*mut c_void, String)>>

Enumerate entries in one compartment of one (module, app) scope. Each entry is the opaque key handle paired with its index string (key_id for private, canonical identity for public).

fn sign( &self, _module: &str, _app: &str, _key_id: &str, _algorithm: &str, _message: &[u8], ) -> Result<Vec<u8>, Error>

Sign message with the remote key named by key_id, using the provider-specific algorithm name (e.g. "ECDSA_SHA_256" on AWS KMS, "EC_SIGN_P256_SHA256" on Cloud KMS, "ES256" on Key Vault). Input is the raw message — providers that sign digests hash it themselves or the backend does. This is the remote-sign half of the sign-with-handle contract: backends that hold keys out-of-process (cloud KMS, PKCS#11, TPM) implement it; local backends keep the default.

impl Sync for Pkcs11Instance