Struct HsmKeyPair 

pub struct HsmKeyPair { /* private fields */ }

HSM key pair reference.

Implementations

impl HsmKeyPair

pub fn generate( slot: &HsmSlot, algorithm: KeyAlgorithm, label: &str, id: &[u8], provider_config: &HsmProviderConfig, pqc_mechanisms: &PqcMechanismIds, ) -> HsmResult<Self>

Generate a new key pair.

Arguments

• slot - HSM slot
• algorithm - Key algorithm
• label - Key label (CKA_LABEL)
• id - Key ID (CKA_ID), typically SHA-1 hash of public key
• provider_config - Provider configuration (for PQC mechanism IDs)

NIAP CA PP Compliance

Generated keys MUST have:

• CKA_EXTRACTABLE = false (FCS_CKM.1)
• CKA_SENSITIVE = true (FCS_CKM.1)

Errors

Returns HsmError::PqcNotSupported if the HSM does not support the requested PQC algorithm and fallback to software is not enabled.

pub fn find_by_label( slot: &HsmSlot, label: &str, algorithm: KeyAlgorithm, ) -> HsmResult<Self>

Find a key pair by label.

pub fn find_by_id( slot: &HsmSlot, id: &[u8], algorithm: KeyAlgorithm, ) -> HsmResult<Self>

Find a key pair by CKA_ID.

pub fn from_uri( slot: &HsmSlot, uri: &str, algorithm: KeyAlgorithm, ) -> HsmResult<Self>

Parse a PKCS#11 URI and find the corresponding key.

URI Format

pkcs11:token=MyToken;object=MyKey;type=private

Supported attributes:

• token - Token label
• object - Key label (CKA_LABEL)
• id - Key ID (CKA_ID, hex-encoded)
• type - Object type (private, public, cert)

pub fn private_key(&self) -> ObjectHandle

Get the private key handle.

pub fn public_key(&self) -> ObjectHandle

Get the public key handle.

pub fn session(&self) -> &Session

Get the session.

pub fn algorithm(&self) -> KeyAlgorithm

Get the key algorithm.