Crate fe11_verify_engine_api 

C ABI for the optional Fe11 verification engine, independent of PKCS#11 tables.

All requests are synchronous: no input pointer is retained after return. The caller pins the component image before invoking anything other than GetInterface. Inputs stay initialized, immutable and readable for their full lengths until return; output slots are aligned, exclusively writable and disjoint from inputs. Integer representations accept all bit patterns and are validated by the callee. The calling thread must not reenter this engine during a request. Calls from different threads are independent. No Rust allocation crosses the ownership boundary: an owned byte view is released by the originating component. The caller never reconstructs or frees that owner.

Modules

eddsa_instance

Instance codes for scheme::EDDSA in VerificationRequest::message_encoding. The ABI layout is unchanged; older engines may reject the added scheme.

key_format

Public-key representation codes.

scheme

Signature verification scheme codes.

status

Service completion and failure codes.

Structs

Bytes

Borrowed bytes; null is accepted only with a zero length. Identifier fields contain UTF-8 names without NUL; ordinary data fields are unrestricted bytes.

DigestRequest

Parameters for a synchronous whole-message digest request.

Information

Versions reported by the selected component and its private crypto library.

Interface

Function pointers use the C calling convention on every supported target. Every request receives its structure size; mismatched sizes are refused before dereferencing fields. Valid output slots are empty/zero on non-OK return; invalid output size/alignment is rejected without accessing that storage. Probe prepares the exact operation without signing or issuing any PKCS#11 call.

OwnedBytes

Engine-owned allocation. Only release(owner), exactly once, may destroy it. The view stays readable until release. None of these fields may be modified to construct a different allocation; even a zero-length owned view is released.

VerificationAlgorithms

Implementations required for a future verification, without a key. Names are UTF-8 without NUL; digest names may be empty when not needed. Success reports that each implementation can be fetched in the engine’s private context. It does not establish that their combination or a future key can be initialized; explicit public-key verification uses the exact-key Probe to establish its own operation requirements. No private possession-proof policy is provided.

VerificationRequest

Exact public verification parameters. Empty digest names mean no digest; unused fields must be zero/empty. PQC encoding is 1 for engine framing and 0 when Fe11 already supplied its exact FIPS frame. Context is not applied twice. For scheme::EDDSA, message_encoding is an eddsa_instance code, digest/MGF names and salt must be empty/zero, and input is the original message.

Constants

ABI_VERSION

Version of the public component ABI.

ENTRY_POINT

NUL-terminated exported discovery symbol.

Type Aliases

CheckVerificationAlgorithms

Check implementation availability without generating/importing a key or performing a PKCS#11 operation. See VerificationAlgorithms for the limited meaning of success; missing implementations return UNAVAILABLE.

Digest

Hash one whole message. On success the caller copies the result then releases its owner; no output allocation belongs to the caller’s allocator.

GetInterface

GetInterface performs no OpenSSL initialization. A successful call copies the exact requested ABI table into the caller’s storage; it never returns a table pointer with an inferred suffix length. Version/size mismatch writes nothing.

Probe

Import the public key and prepare the exact parameters without verification. OK establishes preparation availability, not validity of a future signature.

ReadInformation

Read component/engine versions into the caller’s exact-sized output slot. This may initialize the private engine; the image must already be pinned.

Release

Consume an unmodified owner returned by this image, exactly once. Null is a no-op. Every borrowed view of the allocation becomes invalid after this call.

Verify

Verify one message/signature pair. OK with verified=0 is a signature mismatch; engine/parameter failures have a non-OK status and never claim a mismatch.