33> ** Auto-generated from actual source files.** Last updated: 2026-02-25
44> Pinned rev: ` abba7fdab687753268b63248ec22639dff35d07c `
55
6- This documents every type, trait, and function the server's RustSdk imports from the three
7- sdk-internal crates . Use this to assess breaking change impact when bumping revs.
6+ This documents every type, trait, and function the server's RustSdk imports from
7+ ` bitwarden-crypto ` . Use this to assess breaking change impact when bumping revs.
88
99** Location:** ` util/RustSdk/rust/src/ `
1010
11- ## bitwarden-crypto (primary dependency)
12-
13- ### Types Used
14-
15- | Type | File | Usage |
16- | ------------------------- | ----------------- | -------------------------------------------------------------------------------------------- |
17- | ` BitwardenLegacyKeyBytes ` | lib.rs, cipher.rs | ` BitwardenLegacyKeyBytes::from() ` — wraps raw key bytes for ` SymmetricCryptoKey::try_from() ` |
18- | ` HashPurpose ` | lib.rs | ` HashPurpose::ServerAuthorization ` enum variant |
19- | ` Kdf ` | lib.rs | ` Kdf::PBKDF2 { iterations } ` enum variant with ` NonZeroU32 ` |
20- | ` KeyStore ` | cipher.rs | ` KeyStore::<KeyIds>::default() ` , ` .context_mut() ` , ` .add_local_symmetric_key() ` |
21- | ` MasterKey ` | lib.rs | ` MasterKey::derive() ` , ` .derive_master_key_hash() ` , ` .make_user_key() ` |
22- | ` PrivateKey ` | lib.rs | ` PrivateKey::from_pem() ` , ` .to_public_key() ` , ` .to_der() ` |
23- | ` PublicKey ` | lib.rs | ` PublicKey::from_der() ` |
24- | ` RsaKeyPair ` | lib.rs | Struct literal: ` RsaKeyPair { private, public } ` |
25- | ` SpkiPublicKeyBytes ` | lib.rs | ` SpkiPublicKeyBytes::from() ` — wraps public key DER bytes |
26- | ` SymmetricCryptoKey ` | lib.rs, cipher.rs | ` .make_aes256_cbc_hmac_key() ` , ` ::try_from() ` , ` .to_base64() ` |
27- | ` UnsignedSharedKey ` | lib.rs | ` ::encapsulate_key_unsigned() ` (deprecated — wrapped with ` #[allow(deprecated)] ` ) |
28- | ` UserKey ` | lib.rs | ` UserKey::new() ` , ` .make_key_pair() ` , ` .0 ` field access |
11+ ## bitwarden-crypto
2912
30- ### Traits Used
31-
32- | Trait | File | Methods Called |
33- | ---------------------- | ----------------- | -------------------------------------------------------------------------- |
34- | ` KeyEncryptable ` | lib.rs, cipher.rs | ` .encrypt_with_key(&key) ` — encrypts DER bytes and strings |
35- | ` CompositeEncryptable ` | cipher.rs | ` .encrypt_composite(&mut ctx, key_id) ` — encrypts ` CipherView ` -> ` Cipher ` |
36- | ` Decryptable ` | cipher.rs | ` .decrypt(&mut ctx, key_id) ` — decrypts ` Cipher ` -> ` CipherView ` |
37-
38- ## bitwarden-core (minimal dependency)
39-
40- | Type | File | Usage |
41- | ------------------------ | --------- | -------------------------------------------- |
42- | ` key_management::KeyIds ` | cipher.rs | Generic type parameter: ` KeyStore::<KeyIds> ` |
43-
44- ## bitwarden-vault (data model dependency)
13+ ### Types Used — lib.rs (key generation and management)
4514
46- ### Production Code
15+ | Type | Usage |
16+ | ------------------------- | -------------------------------------------------------------------------------------------- |
17+ | ` BitwardenLegacyKeyBytes ` | ` BitwardenLegacyKeyBytes::from() ` — wraps raw key bytes for ` SymmetricCryptoKey::try_from() ` |
18+ | ` HashPurpose ` | ` HashPurpose::ServerAuthorization ` enum variant |
19+ | ` Kdf ` | ` Kdf::PBKDF2 { iterations } ` enum variant with ` NonZeroU32 ` |
20+ | ` MasterKey ` | ` MasterKey::derive() ` , ` .derive_master_key_hash() ` , ` .make_user_key() ` |
21+ | ` PrivateKey ` | ` PrivateKey::from_pem() ` , ` .to_public_key() ` , ` .to_der() ` |
22+ | ` PublicKey ` | ` PublicKey::from_der() ` |
23+ | ` RsaKeyPair ` | Struct literal: ` RsaKeyPair { private, public } ` |
24+ | ` SpkiPublicKeyBytes ` | ` SpkiPublicKeyBytes::from() ` — wraps public key DER bytes |
25+ | ` SymmetricCryptoKey ` | ` .make_aes256_cbc_hmac_key() ` , ` ::try_from() ` , ` .to_base64() ` |
26+ | ` UnsignedSharedKey ` | ` ::encapsulate_key_unsigned() ` (deprecated — wrapped with ` #[allow(deprecated)] ` ) |
27+ | ` UserKey ` | ` UserKey::new() ` , ` .make_key_pair() ` , ` .0 ` field access |
4728
48- | Type | File | Usage |
49- | ------------ | --------- | ----------------------------------------------------- |
50- | ` Cipher ` | cipher.rs | Protected Data container (encrypted), deserialized from JSON via serde |
51- | ` CipherView ` | cipher.rs | Vault Data in Use (decrypted view), serialized to/from JSON via serde |
29+ ### Types Used — cipher.rs (field-level encryption)
5230
53- ### Test-Only Types
31+ | Type | Usage |
32+ | ------------------------- | ----------------------------------------------------------------------------------------------- |
33+ | ` BitwardenLegacyKeyBytes ` | ` BitwardenLegacyKeyBytes::from() ` — wraps raw key bytes for ` SymmetricCryptoKey::try_from() ` |
34+ | ` EncString ` | ` enc_str.parse::<EncString>() ` , ` .to_string() ` — parsed from and serialized to EncString format |
35+ | ` SymmetricCryptoKey ` | ` ::try_from() ` , ` .make_aes256_cbc_hmac_key() ` , ` .to_base64() ` — key construction and testing |
5436
55- | Type | File | Usage |
56- | -------------------- | --------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
57- | ` CipherRepromptType ` | cipher.rs tests | ` CipherRepromptType::None ` enum variant |
58- | ` CipherType ` | cipher.rs tests | ` CipherType::Login ` enum variant |
59- | ` LoginView ` | cipher.rs tests | Struct literal with fields: ` username ` , ` password ` , ` password_revision_date ` , ` uris ` , ` totp ` , ` autofill_on_page_load ` , ` fido2_credentials ` |
37+ ### Traits Used
6038
61- ### CipherView Fields (used in test struct literal)
39+ | Trait | File | Methods Called |
40+ | ---------------- | --------- | -------------------------------------------------------------------- |
41+ | ` KeyEncryptable ` | lib.rs | ` .encrypt_with_key(&key) ` — encrypts DER bytes and strings |
42+ | ` KeyEncryptable ` | cipher.rs | ` .encrypt_with_key(&key) ` — encrypts plaintext strings to EncStrings |
43+ | ` KeyDecryptable ` | cipher.rs | ` .decrypt_with_key(&key) ` — decrypts EncString back to plaintext |
6244
63- The test helper ` create_test_cipher_view() ` constructs a ` CipherView ` with these fields:
45+ ## FFI Functions Exposed
6446
65- ` id ` , ` organization_id ` , ` folder_id ` , ` collection_ids ` , ` key ` , ` name ` , ` notes ` , ` type ` ,
66- ` login ` , ` identity ` , ` card ` , ` secure_note ` , ` ssh_key ` , ` favorite ` , ` reprompt ` ,
67- ` organization_use_totp ` , ` edit ` , ` permissions ` , ` view_password ` , ` local_data ` , ` attachments ` ,
68- ` attachment_decryption_failures ` , ` fields ` , ` password_history ` , ` creation_date ` , ` deleted_date ` ,
69- ` revision_date ` , ` archived_date `
47+ The Rust layer exposes these functions to C# via csbindgen:
7048
71- Any new required field added to ` CipherView ` upstream will break this struct literal.
49+ | Function | File | Purpose |
50+ | -------------------------------- | --------- | --------------------------------------------------------- |
51+ | ` generate_user_keys ` | lib.rs | Derive master key, user key, key pair from email/password |
52+ | ` generate_organization_keys ` | lib.rs | Generate org symmetric key + RSA key pair |
53+ | ` generate_user_organization_key ` | lib.rs | Encapsulate org key with user's public key (unsigned) |
54+ | ` encrypt_string ` | cipher.rs | Encrypt a single plaintext string with a symmetric key |
55+ | ` decrypt_string ` | cipher.rs | Decrypt an EncString with a symmetric key |
56+ | ` encrypt_fields ` | cipher.rs | Encrypt specified fields in a JSON object by dot-path |
57+ | ` free_c_string ` | lib.rs | Free a C string returned by any of the above functions |
7258
7359## Breaking Change Risk Matrix
7460
@@ -77,9 +63,9 @@ When reviewing upstream commits, prioritize checking for changes to:
7763** Critical (compilation failure):**
7864
7965- Any type rename or removal listed above
80- - New required fields on ` CipherView ` , ` Cipher ` , or ` LoginView `
81- - Changes to ` KeyStore ` generic parameters or ` context_mut() ` method
82- - Changes to encryption/decryption trait method signatures
66+ - Changes to ` EncString ` parsing or serialization format
67+ - Changes to ` KeyEncryptable ` or ` KeyDecryptable ` trait method signatures
68+ - Changes to ` SymmetricCryptoKey::try_from() ` or ` BitwardenLegacyKeyBytes `
8369
8470** High (runtime failure):**
8571
@@ -96,21 +82,12 @@ When reviewing upstream commits, prioritize checking for changes to:
9682** Low (transparent):**
9783
9884- Internal implementation changes that don't affect the public API
99- - New optional fields on structs (serde defaults to ` None ` for ` Option<T> ` )
10085- New methods added to existing types (additive, non-breaking)
10186
10287## How to Check for Changes
10388
104- For each crate, check the public API exports:
105-
10689``` bash
10790cd /path/to/sdk-internal
10891# bitwarden-crypto public API
10992git diff < old> ..< new> -- crates/bitwarden-crypto/src/lib.rs crates/bitwarden-crypto/src/keys/mod.rs
110-
111- # bitwarden-vault Cipher/CipherView changes
112- git diff < old> ..< new> -- crates/bitwarden-vault/src/cipher/cipher.rs crates/bitwarden-vault/src/cipher/login.rs
113-
114- # bitwarden-core KeyIds
115- git diff < old> ..< new> -- crates/bitwarden-core/src/key_management/mod.rs
11693```
0 commit comments