Generate RSA keypair using OpenSSL (random size from 2048, 3072, or 4096 bits).

Generate a complete self-signed PKI (CA + server cert + client cert) and write PEM files. Returns [`CertPaths`] with the paths of the generated files

Retrieve the list of slot identifiers for the HSM. This function returns the IDs of all slots that the HSM has been initialized with, typically from

Get the key type, sensitivity and label length # Arguments `key_handle` - The key handle # Returns `Result<Option<KeyType>>` - The key type if the key

Insert a private key (`<base>`) and its paired public key (`<base>_pk`) directly into the global `OBJECTS_STORE`, returning the two handles.

Create a cryptographic key via the JOSE REST endpoint. This is a convenience wrapper around `POST /v1/crypto/keys`.

Derive KMIP `CryptographicParameters` from JOSE algorithm identifiers. For encrypt/decrypt, pass both `alg` and `enc`. For sign/verify, pass only `al

Extract the Key bytes from the given `KeyBlock` and give an optional reference to `Attributes` Returns an error if there is no valid key material

List all the permissions granted to a user per object uid

Mask the password component of a database connection URL before logging. Uses [`url::Url::parse`] for standard single-host URLs; falls back to a simp

Sign data using an ML-DSA private key. ML-DSA uses an internal hash, so we use `Signer::new_without_digest` (same pattern as `EdDSA`).

Verify a signature using an ML-DSA public key.

Open a serial session on the test slot.

Send an HTTP POST request with raw bytes and a specified content type. # Errors Returns an error if the request fails.

POST tags to a key; returns the parsed response body.

Read an object T from a JSON file # Errors If the file cannot be opened or read, an error is returned.

Remove a permission to the user on an object

Resolve a path relative to the repository root (two levels up from `CARGO_MANIFEST_DIR`).

Set the attributes's `CryptographicUsageMask`.

Set the bits in `mask` to the attributes's `CryptographicUsageMask` bits.

Set a vendor attribute to the list of vendor attributes replacing one with an existing value if any This function will remove the vendor attribute if

Sign a pre-hashed digest using a private key in the KMS. `hash_alg` names the algorithm that produced `hash` (e.g. `SHA256`). `padding_scheme` is `No

Sign using RSA with KMIP `Sign` request semantics (PKCS#1 v1.5 and RSASSA-PSS). - Honors `cryptographic_parameters.hashing_algorithm` when provided -

Sign `data` then verify the signature for a given algorithm and key pair. Also asserts that tampered data yields `valid=false` (or a non-200 response)

This operation requests the server to perform a signature verify operation on the provided data using a Managed Cryptographic Object as the key for th

Creates the SPIRE app-token authentication middleware for KMS SPIRE-compatible scopes. Middleware order (last `.wrap()` runs first): - Reads `X-Vault

Privileged users. Base configuration is loaded from `test_data/configs/server/privileged_users.toml`; the `privileged_users` field is injected from t

Build a TTLV Structure header (8 bytes) claiming the given `content_len`.

Helper function to test signing for elliptic curves

Attempt to encrypt; returns Ok on 200, Err(status) otherwise.

This operation requests the version of the server

This is not officially supported in TTLV and will only be called if the user is attempting to deserialize an array of TTLV

Return the wrapped key bytes if the object is wrapped, an error otherwise

Atomically adjust the active-key counter by `delta`. "Active key" means a non-destroyed key object (`ObjectType` ∈ {`SymmetricKey`, `PrivateKey`, `Pu

Atomically adjust the live-object counter by `delta`. Uses `INCRBY` (positive) or `DECRBY` (negative). Redis creates the key with value `0` before ap