Helper: certify with `generate_key_pair=true`, optionally CA-signed.

Check that bits set in `mask` are only bits set in `flags`. If any bit set in `mask` is not set in `flags`, raise an error. If `mask` is None, raise

Cleanup helper: revoke + destroy a key pair (best-effort).

Helper to create a symmetric key (CO operation)

Helper to destroy a key (CO operation — revokes first, then destroys)

Create an AES-256 key and return its UID.

Generate a self-signed CA certificate + private key for testing.

A minimal OAuth2 config that refers to a reachable-but-wrong token URL (127.0.0.1:1) so that the token-exchange step always fails quickly without hang

Generate RSA key pair and return the private and public key handles in this order If exportable is set to `false`, the `sensitive` flag is set to tru

Retrieve the object handle for a given object ID from the HSM. This function attempts to locate the handle of an object (such as a key) in the HSM by

Return the object store for the given `uid` This function retrieves the appropriate object store based on the prefix of the `uid`. Prefix matching u

Initialize test environment once before any tests run

Start (or reuse) the shared in-process KMS test server and return an owner `KmsClient`. A temporary Tokio runtime is used only for the async setup; i

Build a `CreateKeyPair` request for an `CoverCrypt` Master Key

Create an ML-DSA-44 CA and return (`cert_id`, `private_key_id`).

Get the current TTLV element which is the last element on the stack

This operation requests the server to perform a decryption operation on the provided data using a Managed Cryptographic Object as the key for the decr

Grants access to a user

Convert an openssl private key to a KMIP private Key (`Object::PrivateKey`) of the given `KeyFormatType`

Parse the `uid` into a `(slot_id, key_id)` pair, stripping the given prefix.

Returns the currently registered backend. Returns [`ModuleError::UserNotLoggedIn`] when no backend is registered (i.e. before `C_GetFunctionList` or a

Benchmark a single KMIP operation under a parameterized [`BenchmarkId`].

Build a minimal OCSP request for a given serial number using the openssl crate's high-level API.

Create a self-signed CA with a custom common name. This is the multi-CA variant of [`create_ca`]; the plain helper always uses the same CN which caus

Create a fresh AES-256 symmetric key; return its KID.

Encrypts a file using the given symmetric key and access policy.

Enforce that the caller has `Create` access-right. When `crypto_officer.users` is configured, the user must either: - have been explicitly granted th

Generates a symmetric key

Look up a cached object by UID. Returns `Some(owm)` on cache hit, `None` on miss. Uses moka's lock-free concurrent hash table — never blocks concurr

Retrieve the DER-encoded certificate from the KMS.

Unwrap the object (if need be) and return the unwrapped object. The unwrapped object is cached in memory. # Arguments `uid` - The unique identifier of

Initialize the DB parameters based on the command-line parameters # Parameters - `workspace`: The workspace configuration used to determine the publi

Check that `flag` bit is set in object's `CryptographicUsageMask`. If FIPS mode is disabled, check if the Unrestricted bit is set too. Return `true`

Convert an openssl public key to a KMIP public Key (`Object::PublicKey`) of the given `KeyFormatType`

--------------------------------------------------------------------------- Helper: POST raw bytes to the binary KMIP endpoint. Returns the HTTP stat

Create a symmetric key via the CLI