confium_api/plugin/
signature.rs

1//! `SignaturePlugin` trait — the Rust-side counterpart of the
2//! asymmetric signature v0 wire protocol.
3//!
4//! The signature interface has three object types: a signer (holds the
5//! secret key), a verifier (holds the public key), and a keypair
6//! generator. A single plugin implements all three.
7//!
8//! Plugin authors implement this trait on a state type that represents
9//! the signer/verifier context, then apply
10//! `#[plugin_interface(name = "signature", version = 0)]` to the impl
11//! block.
12//!
13//! The FFI surface splits symbols into `cfmp_sig_signer_*`,
14//! `cfmp_sig_verifier_*`, and `cfmp_sig_keypair_generate`. The trait
15//! methods map to these symbols.
16//!
17//! See `crates/confium-core/src/ffi/signature.rs` for the loader-side
18//! wire types.
19
20use crate::error::PluginResult;
21use crate::options::OptionView;
22
23/// A keypair generation result.
24pub struct SignatureKeypair {
25    /// Public key bytes.
26    pub public_key: Vec<u8>,
27    /// Secret key bytes.
28    pub secret_key: Vec<u8>,
29}
30
31/// Trait implemented by signature plugins. The type `Self` serves as
32/// both the signer and verifier state — the plugin dispatches
33/// internally based on which entry points are called.
34pub trait SignaturePlugin: Sized {
35    /// Construct a signer from the secret key.
36    fn signer_create(
37        algorithm: &str,
38        secret_key: &[u8],
39        opts: Option<OptionView<'_>>,
40    ) -> PluginResult<Self>;
41
42    /// Construct a verifier from the public key.
43    fn verifier_create(
44        algorithm: &str,
45        public_key: &[u8],
46        opts: Option<OptionView<'_>>,
47    ) -> PluginResult<Self>;
48
49    /// Set the hash algorithm used for signing/verifying (for
50    /// hash-then-sign schemes).
51    fn set_hash(&mut self, hash_name: &str) -> PluginResult<()>;
52
53    /// Absorb message bytes into the signing/verification context.
54    fn update(&mut self, data: &[u8]) -> PluginResult<()>;
55
56    /// Finalize signing: write the signature into `sig_out`. Returns
57    /// the number of bytes written.
58    fn signer_finalize(&mut self, sig_out: &mut [u8]) -> PluginResult<usize>;
59
60    /// Finalize verification: return `Ok(())` if the signature is
61    /// valid.
62    fn verifier_finalize(&mut self, signature: &[u8]) -> PluginResult<()>;
63
64    /// Generate a keypair for the named algorithm. If `seed` is
65    /// provided, it is used deterministically; otherwise the plugin
66    /// generates fresh randomness.
67    fn keypair_generate(
68        algorithm: &str,
69        seed: Option<&[u8]>,
70        opts: Option<OptionView<'_>>,
71    ) -> PluginResult<SignatureKeypair>;
72}
confium_api/plugin/signature.rs

confium_api/plugin/
signature.rs
