Map a hybrid KEM `CryptographicAlgorithm` to the OpenSSL algorithm name string.

Initialize the server-managed `AlwaysSensitive` attribute at object creation or registration time (KMIP 2.1 §4.3, Table 34). The server SHALL create

Spawn an async one-shot HTTP/1.1 server on a random port. The server runs as a `tokio::spawn` task on the **same** event-loop as the test, avoiding t

Get a client from the pool, retrying on transient connection errors. Used by Migrate trait methods for startup resilience.

Read all bytes from a file

Rebuild the connection URL, removing only SSL-related query parameters. Other parameters like `target_session_attrs` are preserved for `tokio-postgres

If the user specified tags, we will use these and remove them from the request. else we will use the tags with the object attributes If no tags are fo

Remove an object handle from the cache.

Retrieve objects from the database. The `uid_or_tags` parameter can be either a `uid` or a JSON array of tags. The `user_filter` parameter allows fi

This operation requests the server to either add or modify an attribute. The request contains the Unique Identifier of the Managed Object to which the

Helper: build a signed JWT with the given claims, kid, and RSA private key.

With Utimaco HSM

Start an isolated test KMS server from a TOML configuration file. The TOML file is loaded into [`ClapConfig`], the HTTP port is overridden to a free

Copy `data` into `pb_output/cb_output` and write the actual size to `*pcb_result`. If `pb_output` is null, only fill `*pcb_result`.

Add a vendor attribute to the list of vendor attributes.

Applies the selected noise method on a given date string. # Arguments `date_str` - - A date string in the RFC3339 format. # Returns The resulting

Login to the KMS SPIRE/Vault-compatible API using an `AppRole` identity. Sends `POST {server_url}/v1/auth/approle/login` with a JSON body of `{"role_

Benchmark a single KMIP operation under a plain (unparameterized) label. The operation is serialized **once**; every criterion iteration then measure

Build a configurable KEM `CreateKeyPair`.

Build a `ReKeyKeyPair` request. To re-key an attribute of a user decryption key, we first need: - the MSK UID - the `CoverCrypt` attributes to revoke

Issue a certificate with a KEM algorithm using the given CA.

Check that - `algorithm` is among `allowed` algorithms. - `algorithm` is compliant with usage mask provided for private and public key components. Fo

Asymmetrically unwrap keys referring to PKCS#11 `CKM_RSA_AES_KEY_WRAP` available at <http://docs.oasis-open.org/pkcs11/pkcs11-curr/v2.40/cos01/pkcs11-

Helper function to create a symmetric key for testing `DeriveKey` operations

Create an EC key pair in the KMS with the given curve and name tag. The private key is created with `Sign | DeriveKey | KeyAgreement` usage mask and

Create an FPE key via the CLI and return its unique identifier.

Create an RSA key pair via KMIP and return `(private_kid, public_kid)`.

Destroy an object in the HSM

ECDSA signature helper implementing RFC6979 determinism for NIST P-256 + SHA-256 in non-fips builds, falling back to OpenSSL Signer otherwise.

Encrypts the given `value` using the FPE method. The value must be less than or equal to the `max_value` of the `Integer` representation. # Example

Fetch a certificate and return its Object, attributes and DER bytes

Run a `C_FindObjectsInit`/`C_FindObjects`/`C_FindObjectsFinal` sequence for the given class and `CKA_ID`, returning the matched object handles.