Struct EntryEncryptor 

pub struct EntryEncryptor { /* private fields */ }

Encrypts and decrypts Raft log entry payloads using AES-256-GCM.

The AES key and nonce for each entry are deterministically derived from the master key and the entry index via HKDF-SHA256, ensuring unique key material per entry without the need for a random nonce.

Internally backed by an Arc<RwLock<KeyManager>> so that key rotation is supported transparently. EntryEncryptor::new wraps a single key in a 1-version KeyManager; EntryEncryptor::with_key_manager takes a shared KeyManager for the rotation-aware path.

Implementations

impl EntryEncryptor

pub fn new(key: LogEncryptionKey) -> Self

Create a new EntryEncryptor backed by a single fixed key.

Convenience constructor: wraps key in a one-version KeyManager internally. Equivalent to EntryEncryptor::with_key_manager(Arc::new(RwLock::new(KeyManager::new(key, 1)))).

pub fn with_key_manager(keys: Arc<RwLock<KeyManager>>) -> Self

Create an EntryEncryptor backed by a shared, rotation-aware KeyManager.

Both encryption and decryption read through the manager. Encryption always uses the manager’s current key (and tags the resulting payload with that version); decryption looks up the version stored in the payload.

pub fn key_manager(&self) -> &Arc<RwLock<KeyManager>>

Borrow the inner KeyManager handle for callers that want to drive rotation directly.

pub fn encrypt( &self, entry_index: u64, plaintext: &[u8], ) -> RaftResult<EncryptedPayload>

Encrypt plaintext associated with entry_index using the current key version.

The returned EncryptedPayload contains the GCM ciphertext (with auth tag), the nonce that was used, and the KeyVersion of the master key.

Errors

Returns RaftError::StorageError on any cryptographic failure.

pub fn decrypt( &self, entry_index: u64, payload: &EncryptedPayload, ) -> RaftResult<Vec<u8>>

Decrypt payload associated with entry_index.

The AES key is re-derived from the master key whose version is recorded in payload.key_version (looked up in the KeyManager). The nonce stored in the payload is used for decryption.

Errors

Returns RaftError::StorageError when the recorded key version has been pruned from the KeyManager history, when key derivation fails, or when GCM authentication fails (including tampered ciphertext).