Struct EncryptedPii 

pub struct EncryptedPii<T: PiiType> {
    pub dek_id: DekId,
    pub pii_code: u16,
    pub aead_kind: AeadKind,
    pub nonce: NonceBytes,
    pub ciphertext: Bytes,
    /* private fields */
}

Per-PII-marker ciphertext envelope.

The wire shape is (dek_id, pii_code, aead_kind, nonce, ciphertext_with_tag) — every input to the AEAD AAD is mirrored on the envelope so the receiver can recompute the 19-byte AAD exactly. ciphertext includes the 16-byte Poly1305 / GCM tag appended by the AEAD primitive.

The generic parameter T is a phantom — the wire layout is purely data-bearing, and a manual (de)serialize impl threads around the PhantomData so postcard can round-trip the struct.

Fields

dek_id: DekId

HSM/KMS key reference.

pii_code: u16

Wire tag. Validated against T::PII_CODE at decrypt time.

aead_kind: AeadKind

AEAD family used for the ciphertext.

nonce: NonceBytes

Nonce — length varies per AEAD kind.

ciphertext: Bytes

Ciphertext with the 16-byte AEAD tag appended.

Implementations

impl<T: PiiType> EncryptedPii<T>

pub fn new( dek_id: DekId, aead_kind: AeadKind, nonce: NonceBytes, ciphertext: Bytes, ) -> Self

Construct from components — intended for deserialization paths / tests that need to reassemble a postcard-decoded envelope into its typed form. Encryption path callers use CryptoCoordinator::encrypt.

Trait Implementations

impl<T: PiiType> Clone for EncryptedPii<T>

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<T: Debug + PiiType> Debug for EncryptedPii<T>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de, T: PiiType> Deserialize<'de> for EncryptedPii<T>

fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error>

Deserialize this value from the given Serde deserializer.

impl<T: PartialEq + PiiType> PartialEq for EncryptedPii<T>

fn eq(&self, other: &EncryptedPii<T>) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl<T: PiiType> Serialize for EncryptedPii<T>

fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error>

Serialize this value into the given Serde serializer.

impl<T: Eq + PiiType> Eq for EncryptedPii<T>

impl<T: PiiType> StructuralPartialEq for EncryptedPii<T>