Behaviour for algorithm adapters.
Adapts a JOSE alg to a PKCS#11 mechanism, the wire signature encoding for
a given context (JOSE vs. X.509/CMS), and the canonical hash. See
docs/specs/api.md §2.1.
Implementations registered under :algorithms are accepted by the algorithm
allowlist; unknown atoms surface as :unsupported_alg.
Summary
Callbacks
The JOSE alg atom this adapter handles.
Key types compatible with this algorithm.
Inverse of encode_signature/2. Used on verify to feed PKCS#11 the format
it expects.
Transform a raw PKCS#11 signature into the wire format required by the given encoding context.
Canonical hash function for this algorithm.
Atom describing the PKCS#11 mechanism used for signing.
Atom describing the PKCS#11 mechanism used for verification.
Types
Callbacks
@callback alg() :: alg()
The JOSE alg atom this adapter handles.
@callback compatible_key_types() :: [key_type(), ...]
Key types compatible with this algorithm.
@callback decode_signature(signature(), encoding_context()) :: {:ok, raw :: binary()} | {:error, term()}
Inverse of encode_signature/2. Used on verify to feed PKCS#11 the format
it expects.
@callback encode_signature(raw :: binary(), encoding_context()) :: {:ok, signature()} | {:error, term()}
Transform a raw PKCS#11 signature into the wire format required by the given encoding context.
:jose— JWS / JOSE format (e.g., ES256 rawr‖s).:der— X.509 / CMS format (e.g., ES256 DERSEQUENCE(r, s)).
Most algorithms (PS256, RS256) are identity in both contexts.
@callback hash() :: hash()
Canonical hash function for this algorithm.
@callback signing_mechanism() :: mechanism()
Atom describing the PKCS#11 mechanism used for signing.
The Rust bridge translates the atom into a CK_MECHANISM plus parameters.
Elixir never builds PKCS#11 binary structures directly.
@callback verifying_mechanism() :: mechanism()
Atom describing the PKCS#11 mechanism used for verification.
Functions
The built-in algorithm registry.
Returns the algorithm-adapter module for an alg atom.
Looks up Application.get_env(:pkcs11ex, :algorithms) first, falling back
to the built-in registry. Returns {:error, :unsupported_alg} if the alg
is not registered.