Global BSL_AbsSecBlock_AddParam (BSL_AbsSecBlock_t *self, const BSL_SecParam_t *param)

- Can be backend-only.

Global BSL_AbsSecBlock_AddResult (BSL_AbsSecBlock_t *self, const BSL_SecResult_t *result)

- Can be backend-only.

Global BSL_AbsSecBlock_AddTarget (BSL_AbsSecBlock_t *self, uint64_t target_block_id)

- Can be backend-only.

Global BSL_AbsSecBlock_Init (BSL_AbsSecBlock_t *self, int64_t sec_context_id, BSL_HostEID_t source_eid)

- Can be backend-only.

Global BSL_AbsSecBlock_Print (const BSL_AbsSecBlock_t *self)

Refactor to dump this to a pre-allocated string.

- Can be backend-only.

Global BSL_AbsSecBlock_StripResults (BSL_AbsSecBlock_t *self, uint64_t target_block_num)

- Can be backend-only.

Global BSL_Cipher_AddData (BSL_Cipher_t *cipher_ctx, BSL_Data_t plaintext, BSL_Data_t ciphertext)

Doxygen

Global BSL_Crypto_UnwrapKey (BSL_Data_t *unwrapped_key_output, BSL_Data_t wrapped_key_plaintext, const char *key_id, size_t aes_variant)

Doxygen

Global BSL_Crypto_WrapKey (BSL_Data_t *wrapped_key, BSL_Data_t cek, const char *content_key_id, size_t aes_variant)

Doxygen

Global BSL_Data_InitBuffer (BSL_Data_t *data, size_t bytelen)

Clarify to indicate this calls MALLOC.

Global BSL_Log_DumpAsHexString (uint8_t *dstbuf, size_t dstlen, const uint8_t *srcbuf, size_t srclen)

- Can be moved to backend.

Global BSL_SecBlockType_e

Consider making an RFC9172 header file.

Global BSL_SecCtx_ValidatePolicyActionSet (BSL_LibCtx_t *lib, const BSL_BundleRef_t *bundle, const BSL_SecurityActionSet_t *action_set)

Doxygen

Global BSL_SecOper_AppendParam (BSL_SecOper_t *self, const BSL_SecParam_t *param)

Clarify pointer/copy semantics.

Global BSL_SecOper_GetParamAt (const BSL_SecOper_t *self, size_t index)

Clarify behavior if index is out of range.

Global BSL_SecOper_IsConsistent (const BSL_SecOper_t *self)

Formalize invariants

Global BSL_SecOutcome_AppendParam (BSL_SecOutcome_t *self, const BSL_SecParam_t *param)

Double-check copy semantics.

Global BSL_SecOutcome_AppendResult (BSL_SecOutcome_t *self, const BSL_SecResult_t *sec_result)

Double-check copy semantics.

Global BSL_SecOutcome_IsInAbsSecBlock (const BSL_SecOutcome_t *self, const BSL_AbsSecBlock_t *abs_sec_block)

Can move to backend

Global BSL_SecParam_GetAsBytestr (const BSL_SecParam_t *self, BSL_Data_t *result)

Clarify whether result contains copy or view of content

Global BSL_SecParam_InternalIds

- Maybe move to SecurityContext.h

Global BSL_SecParam_IsParamIDOutput (uint64_t param_id)

Rename to avoid using negative logic and clarify.

Global BSL_SecurityResponseSet_Init (BSL_SecurityResponseSet_t *self, size_t noperations, size_t nfailed)

This is still undefined.

File CryptoInterface.h

Significant perform tidying and housekeeping.

Page Example PPs, SCs, and Mock BPA

A more full-featured draft PP maintained as part of the BSL source is based on the JSON-encoded policy structure used in the earlier ION implementation of the Default Security Contexts [10]. This PP is not fully implemented for BSL v1.0.0 so is not considered part of this release.

File PublicInterfaceImpl.c

MAJOR Complete implementation for ApplySecurity so it can drop blocks or bundles as-needed.

File SecurityContext.c

Enable checking (not just using a stub returning True.)

Complete implementation for BCB acceptor.