confium_api/plugin/
aead.rs

1//! `AeadPlugin` trait — the Rust-side counterpart of the AEAD v0 wire
2//! protocol.
3//!
4//! Plugin authors implement this trait on their AEAD state type, then
5//! apply `#[plugin_interface(name = "aead", version = 0)]` to the impl
6//! block.
7//!
8//! Method → symbol mapping (see `crates/confium-core/src/ffi/aead.rs`
9//! for the loader-side wire types):
10//!
11//! | trait method | FFI symbol | purpose |
12//! |--------------|------------|---------|
13//! | [`AeadPlugin::create_with_key`]      | `cfmp_aead_create`                    | construct a new instance |
14//! | [`AeadPlugin::set_nonce`]            | `cfmp_aead_set_nonce`                 | set the nonce |
15//! | [`AeadPlugin::associated_data_update`] | `cfmp_aead_associated_data_update` | absorb associated data |
16//! | [`AeadPlugin::encrypt_update`]       | `cfmp_aead_encrypt_update`            | encrypt a chunk |
17//! | [`AeadPlugin::decrypt_update`]       | `cfmp_aead_decrypt_update`            | decrypt a chunk |
18//! | [`AeadPlugin::finalize`]             | `cfmp_aead_finalize`                  | emit the tag |
19//! | [`AeadPlugin::verify_tag`]           | `cfmp_aead_verify_tag`                | verify the tag |
20//! | `Drop`                               | `cfmp_aead_destroy`                   | reclaim the boxed state |
21
22use crate::error::PluginResult;
23use crate::options::OptionView;
24
25/// Trait implemented by AEAD plugins.
26pub trait AeadPlugin: Sized {
27    /// Construct a new AEAD instance for the named algorithm with the
28    /// given key.
29    fn create_with_key(
30        algorithm: &str,
31        key: &[u8],
32        opts: Option<OptionView<'_>>,
33    ) -> PluginResult<Self>;
34
35    /// Set the nonce for this encryption/decryption session.
36    fn set_nonce(&mut self, nonce: &[u8]) -> PluginResult<()>;
37
38    /// Absorb associated (authenticated but not encrypted) data.
39    fn associated_data_update(&mut self, data: &[u8]) -> PluginResult<()>;
40
41    /// Encrypt a chunk of plaintext. Returns the number of bytes
42    /// written to `output`.
43    fn encrypt_update(&mut self, input: &[u8], output: &mut [u8]) -> PluginResult<usize>;
44
45    /// Decrypt a chunk of ciphertext. Returns the number of bytes
46    /// written to `output`.
47    fn decrypt_update(&mut self, input: &[u8], output: &mut [u8]) -> PluginResult<usize>;
48
49    /// Finalize and write the authentication tag into `tag`. Returns
50    /// the number of bytes written.
51    fn finalize(&mut self, tag: &mut [u8]) -> PluginResult<usize>;
52
53    /// Verify the provided tag. Returns `Ok(())` if valid.
54    fn verify_tag(&mut self, tag: &[u8]) -> PluginResult<()>;
55}
confium_api/plugin/aead.rs

confium_api/plugin/
aead.rs
