Enum DekLifecycle 

pub enum DekLifecycle {
    Ephemeral,
    LongLived,
}

DEK lifetime relative to the process. The distinction is a nonce-reuse safety boundary for the deterministic counter nonce:

• DekLifecycle::Ephemeral — the Dek lives for at most the current process; the in-memory counter is authoritative for its whole life, so the deterministic counter never repeats and plain AES-256-GCM is safe.
• DekLifecycle::LongLived — the Dek was reconstructed from durable wrapped material (a KMS unwrap_dek) and may outlive the process. The counter resets to 0 on every reconstruction, so plain AES-256-GCM would reuse nonces under a fixed key (catastrophic). Such DEKs are admitted only under the nonce-misuse-resistant Aes256GcmSiv.

Variants

Ephemeral

Process-bound; counter is authoritative for the key’s whole life.

LongLived

Reconstructed from durable wrapped material; counter resets on each reconstruction, so plain AES-256-GCM is unsafe (must use SIV).

Trait Implementations

impl Clone for DekLifecycle

fn clone(&self) -> DekLifecycle

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for DekLifecycle

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for DekLifecycle

fn eq(&self, other: &DekLifecycle) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Copy for DekLifecycle

impl Eq for DekLifecycle

impl StructuralPartialEq for DekLifecycle