Cmsex.RecipientInfo (cmsex v0.1.0)

Copy Markdown View Source

One recipient of an EnvelopedData, AuthEnvelopedData or AuthenticatedData message, as Cmsex.decode/2 reads it (RFC 5652, 6.2): the means by which that recipient gets the content-encryption key.

Fields:

  • :type - which kind of RecipientInfo:
    • :key_transport - the key encrypted to the public key of a certificate, with RSA (KeyTransRecipientInfo);
    • :key_agreement - a key wrapped with one agreed with ECDH or X25519 and X448 (KeyAgreeRecipientInfo), for one or more recipients;
    • :kek - the key wrapped with a symmetric key the parties share (KEKRecipientInfo);
    • :password - the key wrapped with one derived from a password (PasswordRecipientInfo);
    • :other - an OtherRecipientInfo, which this library does not decrypt.
  • :version - the version written in the message; nil for :other.
  • :rid - which key the recipient holds: for :key_transport, {:issuer_and_serial, issuer, serial}, with the issuer as the DER of its Name as received, or {:subject_key_identifier, ski}; for :kek, {:kek, key_identifier}; nil for the others.
  • :key_encryption_algorithm - the name of the key-encryption algorithm in Cmsex.OID, or its OID: :rsaes_oaep or :rsa_encryption; a key agreement scheme, such as :std_dh_sha256kdf; a key wrap, such as :aes256_wrap; or :pwri_kek.
  • :encrypted_key - the encrypted key; nil for :key_agreement, which has one per recipient, and for :other.
  • :originator - for :key_agreement, the key of the sender: {:public_key, algorithm, key}, with the algorithm as a name such as :ec_public_key or :x25519 and the key as the bytes of the public key (an EC point, or the raw X25519 or X448 key), or a certificate, as {:issuer_and_serial, issuer, serial} or {:subject_key_identifier, ski}.
  • :ukm - for :key_agreement, the user keying material, or nil.
  • :key_wrap_algorithm - for :key_agreement, the key wrap the scheme uses, such as :aes128_wrap, or nil when the parameters do not name one.
  • :recipient_encrypted_keys - for :key_agreement, a list of {rid, encrypted_key}, with rid as :rid above. The date and the other attribute of a RecipientKeyIdentifier are not read.
  • :date - for :kek, the date of the KEKIdentifier, or nil.
  • :key_derivation_algorithm - for :password, the name of the key derivation algorithm, such as :pbkdf2, or nil when absent.
  • :other_type - for :other, the oriType.
  • :deviations - what the library tolerated when reading, against RFC 5652: :recipient_info_version when the version is not the one the type and the identifier call for.

Summary

Types

originator()
rid()
t()

Types

originator()

@type originator() ::
  {:public_key, atom() | tuple(), binary()}
  | {:issuer_and_serial, binary(), integer()}
  | {:subject_key_identifier, binary()}

rid()

@type rid() ::
  {:issuer_and_serial, binary(), integer()}
  | {:subject_key_identifier, binary()}
  | {:kek, binary()}

t()

@type t() :: %Cmsex.RecipientInfo{
  date: DateTime.t() | nil,
  deviations: [atom()],
  encrypted_key: binary() | nil,
  key_derivation_algorithm: atom() | tuple() | nil,
  key_encryption_algorithm: atom() | tuple() | nil,
  key_wrap_algorithm: atom() | tuple() | nil,
  originator: originator() | nil,
  other_type: atom() | tuple() | nil,
  raw: map() | nil,
  recipient_encrypted_keys: [{rid(), binary()}],
  rid: rid() | nil,
  type: :key_transport | :key_agreement | :kek | :password | :other,
  ukm: binary() | nil,
  version: non_neg_integer() | nil
}