In 0.12, the API depends on the version of Botan used at compile time

[teythoon]

I think that this is unfortunate because any downstream user now has to resort to conditional compilation (and directly depend on botan-sys in order to use the botan_ffi_YYYYMMDD features) if they want to opportunistically support algorithms that are only found in newer versions of Botan, e.g. X448.

I'd much rather see the API be independent from the Botan version, and have it return an error at runtime if the algorithm is not available.

This is based on Sequoia's experience with rust-openssl (where the API depends on the version and variant of OpenSSL in use), where we have to both use conditional compilation and runtime detection at the call sites. In contrast, the Nettle bindings we use (and maintain), provide a uniform API and return errors at run time.

[randombit]

Indeed I based the feature detection logic very much on the rust-openssl crate since there are (afaik) relatively few other examples of Rust bindings that adapt at build time to the features that are available from the library being wrapped. Knowing that the way rust-openssl exposes this is not pleasant for end users is a good thing to know, so thanks for bringing this up. Already within the implementation of the C89 interface itself (in Botan proper) if features are not available we return a not-implemented error, this can be extended to the Rust interface similarly.

Just so we are on the same page, what you'd like to see is for example where we currently have

    #[cfg(botan_ffi_20240408)]
    /// Load an X448 private key
    ///
    /// # Examples
    ///
    /// ```
    /// let v = vec![0x42; 56];
    /// let key = botan::Privkey::load_x448(&v);
    /// ```
    pub fn load_x448(key: &[u8]) -> Result<Privkey> {
        let obj = botan_init!(botan_privkey_load_x448, key.as_ptr())?;
        Ok(Privkey { obj })
    }

You would want something like (untested sketch):

    /// Load an X448 private key
    ///
    /// This requires `botan_ffi_20240408`
    ///
    /// # Examples
    ///
    /// ```
    /// let v = vec![0x42; 56];
    /// let key = botan::Privkey::load_x448(&v);
    /// ```
    pub fn load_x448(key: &[u8]) -> Result<Privkey> {
        #[cfg(botan_ffi_20240408)] {
        let obj = botan_init!(botan_privkey_load_x448, key.as_ptr())?;
        Ok(Privkey { obj })
       }

        #[not(cfg(botan_ffi_20240408))] {
           // This function doesn't exist currently but the idea is it would format the message to clearly
           // indicate what version was required, and have an `error_type` of `ErrorType::NotImplemented`
           Err(Error::not_implemented("load_x448", 20240408))
       }
    }

[randombit]

Outline in #157

I'm kind of inclined to still not expose new types (for example OID and EcGroup) if the relevant FFIs are not available.