Struct EntryEncryptor 

pub struct EntryEncryptor { /* private fields */ }

Encrypts and decrypts Raft log entry payloads using AES-256-GCM.

The AES key and nonce for each entry are deterministically derived from the master key and the entry index via HKDF-SHA256, ensuring unique key material per entry without the need for a random nonce.

Implementations

impl EntryEncryptor

pub fn new(key: LogEncryptionKey) -> Self

Create a new EntryEncryptor backed by key.

pub fn encrypt( &self, entry_index: u64, plaintext: &[u8], ) -> RaftResult<EncryptedPayload>

Encrypt plaintext associated with entry_index.

The returned EncryptedPayload contains the GCM ciphertext (with auth tag) and the nonce that was used.

Errors

Returns RaftError::StorageError on any cryptographic failure.

pub fn decrypt( &self, entry_index: u64, payload: &EncryptedPayload, ) -> RaftResult<Vec<u8>>

Decrypt payload associated with entry_index.

The AES key is re-derived from the master key and entry_index. The nonce stored in the payload is used for decryption.

Errors

Returns RaftError::StorageError on key derivation failure or GCM authentication failure (including tampered ciphertext).