pub struct RecipientContext<A: Aead, D: Kdf>(/* private fields */);Expand description
The recipient’s decryption context, returned by new_recipient.
See SenderContext for the ordering and message-limit requirements.
Implementations§
Source§impl<A: Aead, D: Kdf> RecipientContext<A, D>
impl<A: Aead, D: Kdf> RecipientContext<A, D>
Sourcepub fn open_in_place(
&mut self,
in_out: &mut [u8],
associated_data: &[u8],
tag: &[u8],
) -> Result<(), HpkeError>
pub fn open_in_place( &mut self, in_out: &mut [u8], associated_data: &[u8], tag: &[u8], ) -> Result<(), HpkeError>
Decrypts in_out in place using the detached authentication tag.
The sequence number is only advanced when decryption succeeds.
§Errors
Returns HpkeError::OpenError when the ciphertext is invalid (wrong
key, tampered data or wrong associated data),
HpkeError::MessageLimitReached when the ciphertext is longer than
the AEAD’s maximum (C_MAX) or the context’s sequence number is
exhausted, or HpkeError::NotSupported when the ciphersuite uses
the ExportOnly pseudo-AEAD.
§Buffer contents on error
When decryption succeeds but the sequence number is exhausted, the
plaintext has already been written to in_out even though
HpkeError::MessageLimitReached is returned (matching
draft-ietf-hpke-hpke-05 Section 5.2, which raises the error after
Open). On HpkeError::OpenError the buffer is left untouched.
Sourcepub fn open(
&mut self,
ciphertext: &[u8],
associated_data: &[u8],
) -> Result<Vec<u8>, HpkeError>
pub fn open( &mut self, ciphertext: &[u8], associated_data: &[u8], ) -> Result<Vec<u8>, HpkeError>
Decrypts ciphertext (which must end with the authentication tag) and
returns the plaintext.
§Errors
Returns HpkeError::OpenError when the ciphertext is invalid or too
short to contain a tag, HpkeError::MessageLimitReached when the
ciphertext is longer than the AEAD’s maximum (C_MAX) or the context’s
sequence number is exhausted, or HpkeError::NotSupported when the
ciphersuite uses the
ExportOnly pseudo-AEAD.
Sourcepub fn export(
&self,
out: &mut [u8],
exporter_context: &[u8],
) -> Result<(), HpkeError>
pub fn export( &self, out: &mut [u8], exporter_context: &[u8], ) -> Result<(), HpkeError>
Derives out.len() bytes of exported key material, bound to
exporter_context (draft-ietf-hpke-hpke-05 Section 5.3).
§Replay
HPKE does not provide replay protection: replaying the encapsulated key
enc produces an identical context and therefore identical exported
secrets. Applications MUST NOT use an exported secret unless it is safe
for the same value to be produced more than once, and MUST NOT derive an
AEAD (key, nonce) pair from it (as the example in RFC 9180 Section 9.8
did). When an exported secret feeds encryption, mix in fresh
recipient-provided randomness, as in draft-ietf-hpke-hpke-05
Section 9.8.
§Errors
Returns HpkeError::KdfOutputTooLong when out is longer than the
KDF can produce (255 * OUTPUT_SIZE for two-stage KDFs, 2^16 - 1 bytes for
single-stage KDFs).