特性 PacketKey 

pub trait PacketKey: Send + Sync {
    // Required methods
    fn encrypt_in_place(
        &self,
        packet_number: u64,
        header: &[u8],
        payload: &mut [u8],
    ) -> Result<Tag, Error>;
    fn decrypt_in_place<'a>(
        &self,
        packet_number: u64,
        header: &[u8],
        payload: &'a mut [u8],
    ) -> Result<&'a [u8], Error>;
    fn tag_len(&self) -> usize;
    fn confidentiality_limit(&self) -> u64;
    fn integrity_limit(&self) -> u64;

    // Provided methods
    fn encrypt_in_place_for_path(
        &self,
        _path_id: u32,
        _packet_number: u64,
        _header: &[u8],
        _payload: &mut [u8],
    ) -> Result<Tag, Error> { ... }
    fn decrypt_in_place_for_path<'a>(
        &self,
        _path_id: u32,
        _packet_number: u64,
        _header: &[u8],
        _payload: &'a mut [u8],
    ) -> Result<&'a [u8], Error> { ... }
}

Keys 到 encrypt 或 decrypt the payload of 一个 packet

必需方法

fn encrypt_in_place( &self, packet_number: u64, header: &[u8], payload: &mut [u8], ) -> Result<Tag, Error>

Encrypt 一个 QUIC packet

Takes 一个 packet_number, 用 到 derive the nonce; the packet header, which is 用 as the additional authenticated data; 并 the payload。 此 authentication tag is returned if encryption succeeds.

Fails if 并 only if the payload is longer than allowed by 密码套件’s AEAD 算法.

fn decrypt_in_place<'a>( &self, packet_number: u64, header: &[u8], payload: &'a mut [u8], ) -> Result<&'a [u8], Error>

Decrypt 一个 QUIC packet

Takes the packet header, which is 用 as the additional authenticated data, 并 the payload, which includes the authentication tag.

If the return value is Ok, the decrypted payload can be found in payload, up 到 the length found in the return value.

fn tag_len(&self) -> usize

Tag length 用于 底层 AEAD 算法

fn confidentiality_limit(&self) -> u64

Number of QUIC messages that can be safely encrypted with 一个 single key of this type.

Once 一个 MessageEncrypter produced 用于 this suite has encrypted more than confidentiality_limit messages, an attacker gains an advantage in distinguishing it 从 an ideal pseudorandom permutation (PRP)。

This is 到 be set on the assumption that messages are maximally sized – 2 ** 16. For non-QUIC TCP connections see CipherSuiteCommon::confidentiality_limit。

fn integrity_limit(&self) -> u64

Number of QUIC messages that can be safely decrypted with 一个 single key of this type

Once 一个 MessageDecrypter produced 用于 this suite has failed 到 decrypt integrity_limit messages, an attacker gains an advantage in forging messages.

This is not relevant 用于 TLS over TCP (which 也 implemented in this crate) because 一个 single failed decryption 是致命 到 the connection. However, this quantity is 用于 QUIC.

提供方法

fn encrypt_in_place_for_path( &self, _path_id: u32, _packet_number: u64, _header: &[u8], _payload: &mut [u8], ) -> Result<Tag, Error>

Encrypts 一个 multipath QUIC packet

Takes 一个 path_id 并 packet_number, 用 到 derive the nonce; the packet header, which is 用 as the additional authenticated data; 并 the payload。 此 authentication tag is returned if encryption succeeds.

Fails if 并 only if the payload is longer than allowed by 密码套件’s AEAD 算法.

，请参见https://www.ietf.org/archive/id/draft-ietf-quic-multipath-11.html#name-nonce-calculation。

fn decrypt_in_place_for_path<'a>( &self, _path_id: u32, _packet_number: u64, _header: &[u8], _payload: &'a mut [u8], ) -> Result<&'a [u8], Error>

Decrypt 一个 multipath QUIC packet

Takes 一个 path_id 并 packet_number, 用 到 derive the nonce; the packet header, which is 用 as the additional authenticated data; 并 the payload。 此 authentication tag is returned if encryption succeeds.

If the return value is Ok, the decrypted payload can be found in payload, up 到 the length found in the return value.

，请参见https://www.ietf.org/archive/id/draft-ietf-quic-multipath-11.html#name-nonce-calculation。

实现者