security::SecurityLayer Class Reference

Public Member Functions
	SecurityLayer ()
	Creates a security layer using compile-time configuration values.
	SecurityLayer (const AeadParams &aead_params, KdfAlgorithms kdf, const std::vector< uint8_t > &master_key, const std::vector< uint8_t > &master_salt, size_t piv_size, size_t sender_seq_number, const std::vector< uint8_t > &sender_id, const std::vector< uint8_t > &receiver_id)
	Creates a security layer from explicitly supplied parameters.
SecurityResult	wrap (uint8_t *data, size_t data_len, size_t data_max_len, uint8_t **cose_ptr, size_t *cose_len)
	Encrypts and serializes an application payload as a COSE message.
SecurityResult	unwrap (uint8_t *data, size_t data_len, size_t data_max_len, size_t *new_data_len)
	Decodes, authenticates, and decrypts a COSE message.

Constructor & Destructor Documentation

SecurityLayer() [1/2]

security::SecurityLayer::SecurityLayer

(

)

Creates a security layer using compile-time configuration values.

Exceptions

std::runtime_error

If identifiers or key material are invalid, or if the security context cannot be derived.

SecurityLayer() [2/2]

security::SecurityLayer::SecurityLayer	(	const AeadParams &	aead_params,
		KdfAlgorithms	kdf,
		const std::vector< uint8_t > &	master_key,
		const std::vector< uint8_t > &	master_salt,
		size_t	piv_size,
		size_t	sender_seq_number,
		const std::vector< uint8_t > &	sender_id,
		const std::vector< uint8_t > &	receiver_id )

Creates a security layer from explicitly supplied parameters.

Parameters

aead_params	Parameters of the AEAD algorithm to use.
kdf	Key-derivation algorithm to use.
master_key	Master secret used to derive encryption keys.
master_salt	Salt used during key derivation.
piv_size	Size, in bytes, of the Partial IV carried in messages.
sender_seq_number	Initial sender sequence number.
sender_id	Sender identifier used to derive the sender key.
receiver_id	Receiver identifier used to derive the receiver key.

Exceptions

std::runtime_error

If the security context cannot be derived.

Member Function Documentation

unwrap()

SecurityResult security::SecurityLayer::unwrap	(	uint8_t *	data,
		size_t	data_len,
		size_t	data_max_len,
		size_t *	new_data_len )

Decodes, authenticates, and decrypts a COSE message.

If stateless compression is enabled, the method first reconstructs the standard COSE serialization. It then decrypts the message using the receiver key and copies the recovered plaintext to data.

Parameters

data	Buffer containing the received COSE message. On success, it is overwritten with the plaintext payload.
data_len	Length of the received message in bytes.
data_max_len	Total capacity of data in bytes.
new_data_len	Output length of the recovered plaintext in bytes.

Returns

OK on success; UNWRAP_ERROR if parsing, authentication, or decryption fails; otherwise a specific processing error.

wrap()

SecurityResult security::SecurityLayer::wrap	(	uint8_t *	data,
		size_t	data_len,
		size_t	data_max_len,
		uint8_t **	cose_ptr,
		size_t *	cose_len )

Encrypts and serializes an application payload as a COSE message.

Generates a Partial IV from the current sender sequence number, adds it as an unprotected COSE header, encrypts the payload with the sender key, and optionally applies the stateless COSE compression format.

On success, the sender sequence number is incremented.

Parameters

data	Buffer containing the plaintext payload and receiving output.
data_len	Length of the plaintext payload in bytes.
data_max_len	Total capacity of data in bytes.
cose_ptr	Output pointer to the beginning of the encoded message.
cose_len	Output length of the encoded COSE message in bytes.

Returns

OK on success; otherwise an error describing the failed step.

Note

The caller must ensure that data has sufficient capacity for the resulting serialized message.

---

The documentation for this class was generated from the following files:

• src/desert_classes/security/SecurityLayer.h
• src/desert_classes/security/SecurityLayer.cpp