feat(cms)!: encrypt content to an EC public key with ECDH key agreement

Cargo.toml

@@ -59,7 +59,7 @@ base16ct = { version = "1.0.0", features = ["alloc"] }
 base32ct = { version = "0.3.1", features = ["alloc"] }
 base64ct = { version = "1.8.3", features = ["alloc"] }
 rand = "0.10.1"
-openssl = { version = "0.10.78" }
+openssl = { version = "0.10.79" }
 openssl-sys = { version = "0.9.109" }
 cryptoki = "0.12"
 yubikey = "0.8"

crates/rite-model/src/types.rs

@@ -134,9 +134,10 @@ pub enum ActionType {
     ///
     /// Reads `data` and exactly one of `encryption_key` or `recipient`. With
     /// `encryption_key`, the backend generates a content-encryption key and
-    /// protects it with that key. With `recipient`, an RSA-2048 or RSA-4096
-    /// public key held elsewhere, the backend supplies the content-encryption
-    /// key's random bytes, which are protected with RSAES-OAEP over SHA-256.
+    /// protects it with that key. With `recipient`, a public key held
+    /// elsewhere, the backend supplies the content-encryption key's random
+    /// bytes, which are protected with RSAES-OAEP over SHA-256 for an RSA-2048
+    /// or RSA-4096 key, or with ECDH and AES key wrap for a P-256 or P-384 key.
     /// The data itself is not sent to the backend.
     EncryptData,
     /// Decrypt data encrypted by `encrypt_data`, or a CMS file sealed

crates/rite-openssl/src/lib.rs

@@ -35,7 +35,7 @@
 mod backend;
 mod content;
 
-pub use backend::{OpenSslBackend, data_key_for_recipient, verify_signature};
+pub use backend::{OpenSslBackend, open_key_agreement, recipient_info_for, verify_signature};
 pub use content::{SealedContent, open_content, seal_content};
 
 /// Whether this build can generate ML-KEM keys and wrap to them.