Struct SessionCrypto 

pub struct SessionCrypto { /* private fields */ }

Available on crate features mysql or postgres or sqlite or valkey only.

AES-256-GCM encryption configuration with optional key rotation.

Implementations

impl SessionCrypto

pub fn new(key: [u8; 32]) -> Self

Create a new crypto config with the given 32-byte key. Uses SystemRng for nonce generation; tests under DST should use SessionCrypto::with_rng to inject a deterministic RNG.

pub fn with_rng(self, rng: Arc<dyn SecureRng>) -> Self

Swap the RNG used for nonce generation. Production code keeps the default SystemRng; DST suites pass a seeded MockRng to drive nonce sequences deterministically.

pub fn with_previous_key(self, key: [u8; 32]) -> Self

Enable key rotation: on decrypt, try the current key first, then this previous key as a fallback.

pub fn encrypt(&self, plaintext: &[u8]) -> Result<Vec<u8>, CryptoError>

Encrypt plaintext with AES-256-GCM. Returns nonce || ciphertext.

Each call generates a random 96-bit (12-byte) nonce. The collision probability is negligible (~2^-96 per pair), which is safe for up to ~2^32 encryptions per key, far beyond typical session store volumes. The aes-gcm crate performs constant-time authentication tag comparison internally during decryption.

pub fn decrypt(&self, data: &[u8]) -> Result<Vec<u8>, CryptoError>

Decrypt nonce || ciphertext. Tries the current key first, then the previous key (if configured) for key rotation support.

Trait Implementations

impl Clone for SessionCrypto

fn clone(&self) -> SessionCrypto

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.