Global BSL_AbsSecBlock_AddParam (BSL_AbsSecBlock_t *self, const BSL_SecParam_t *param)

- Can be backend-only.

Global BSL_AbsSecBlock_AddResult (BSL_AbsSecBlock_t *self, const BSL_SecResult_t *result)

- Can be backend-only.

Global BSL_AbsSecBlock_AddTarget (BSL_AbsSecBlock_t *self, uint64_t target_block_id)

- Can be backend-only.

Global BSL_AbsSecBlock_Init (BSL_AbsSecBlock_t *self, uint64_t sec_context_id, BSL_HostEID_t source_eid)

- Can be backend-only.

Global BSL_AbsSecBlock_Print (const BSL_AbsSecBlock_t *self)

Refactor to dump this to a pre-allocated string.

- Can be backend-only.

Global BSL_AbsSecBlock_StripResults (BSL_AbsSecBlock_t *self, uint64_t target_block_num)

- Can be backend-only.

Global BSL_Cipher_AddData (BSL_Cipher_t *cipher_ctx, BSL_Data_t plaintext, BSL_Data_t ciphertext)

Doxygen

Global BSL_Crypto_UnwrapKey (BSL_Data_t *unwrapped_key_output, BSL_Data_t wrapped_key_plaintext, size_t key_id, size_t aes_variant)

Doxygen

Global BSL_Crypto_WrapKey (BSL_Data_t *wrapped_key, BSL_Data_t cek, size_t content_key_id, size_t aes_variant)

Doxygen

Global BSL_Data_InitBuffer (BSL_Data_t *data, size_t bytelen)

Clarify to indicate this calls MALLOC.

Global BSL_Log_DumpAsHexString (uint8_t *dstbuf, size_t dstlen, const uint8_t *srcbuf, size_t srclen)

- Can be moved to backend.

Global BSL_SecBlockType_e

Consider making an RFC9172 header file.

Global BSL_SecCtx_ValidatePolicyActionSet (BSL_LibCtx_t *lib, const BSL_BundleRef_t *bundle, const BSL_SecurityActionSet_t *action_set)

Doxygen

Global BSL_SecOper_AppendParam (BSL_SecOper_t *self, const BSL_SecParam_t *param)

Clarify pointer/copy semantics.

Global BSL_SecOper_GetParamAt (const BSL_SecOper_t *self, size_t index)

Clarify behavior if index is out of range.

Global BSL_SecOper_IsConsistent (const BSL_SecOper_t *self)

Formalize invariants

Global BSL_SecOutcome_AppendParam (BSL_SecOutcome_t *self, const BSL_SecParam_t *param)

Double-check copy semantics.

Global BSL_SecOutcome_AppendResult (BSL_SecOutcome_t *self, const BSL_SecResult_t *sec_result)

Double-check copy semantics.

Global BSL_SecOutcome_IsInAbsSecBlock (const BSL_SecOutcome_t *self, const BSL_AbsSecBlock_t *abs_sec_block)

Can move to backend

Global BSL_SecParam_GetAsBytestr (const BSL_SecParam_t *self, BSL_Data_t *result)

Clarify whether result contains copy or view of content

Global BSL_SecParam_InternalIds

- Maybe move to SecurityContext.h

Global BSL_SecParam_IsParamIDOutput (uint64_t param_id)

Rename to avoid using negative logic and clarify.

Global BSL_SecurityResponseSet_Init (BSL_SecurityResponseSet_t *self, size_t noperations, size_t nfailed)

This is still undefined.

File CryptoInterface.h

Significant perform tidying and housekeeping.

File PublicInterfaceImpl.c

MAJOR Complete implementation for ApplySecurity so it can drop blocks or bundles as-needed.

File SecurityContext.c

Enable checking (not just using a stub returning True.)

Complete implementation for BCB acceptor.