Struct SealedMessage 

pub struct SealedMessage { /* private fields */ }

A sealed message that can only be decrypted by the intended recipient.

SealedMessage provides a public key encryption mechanism where a message is encrypted with a symmetric key, and that key is then encapsulated using the recipient’s public key. This ensures that only the recipient can decrypt the message by first decapsulating the shared secret using their private key.

Features:

• Anonymous sender: The sender’s identity is not revealed in the sealed message
• Authenticated encryption: Message integrity and authenticity are guaranteed
• Forward secrecy: Each message uses a different ephemeral key
• Post-quantum security options: Can use ML-KEM for quantum-resistant encryption

The structure internally contains:

• An EncryptedMessage containing the actual encrypted data
• An EncapsulationCiphertext containing the encapsulated shared secret

Implementations

impl SealedMessage

pub fn new(plaintext: impl AsRef<[u8]>, recipient: &dyn Encrypter) -> Self

Creates a new SealedMessage from the given plaintext and recipient.

This method performs the following steps:

1. Generates a new shared secret key and encapsulates it for the recipient
2. Encrypts the plaintext using that shared secret

Parameters

• plaintext - The message data to encrypt
• recipient - The recipient who will be able to decrypt the message

Returns

A new SealedMessage containing the encrypted message and encapsulated key

Example

use bc_components::{EncapsulationScheme, SealedMessage};

// Generate a keypair for the recipient
let (recipient_private_key, recipient_public_key) =
    EncapsulationScheme::default().keypair();

// Create a sealed message for the recipient
let plaintext = b"For your eyes only";
let sealed_message = SealedMessage::new(plaintext, &recipient_public_key);

// The recipient can decrypt the message
let decrypted = sealed_message.decrypt(&recipient_private_key).unwrap();
assert_eq!(decrypted, plaintext);

pub fn new_with_aad( plaintext: impl AsRef<[u8]>, recipient: &dyn Encrypter, aad: Option<impl AsRef<[u8]>>, ) -> Self

Creates a new SealedMessage with additional authenticated data (AAD).

AAD is data that is authenticated but not encrypted. It can be used to bind the encrypted message to some context.

Parameters

• plaintext - The message data to encrypt
• recipient - The recipient who will be able to decrypt the message
• aad - Additional authenticated data that will be bound to the encryption

Returns

A new SealedMessage containing the encrypted message and encapsulated key

Example

use bc_components::{EncapsulationScheme, SealedMessage};

// Generate a keypair for the recipient
let (recipient_private_key, recipient_public_key) =
    EncapsulationScheme::default().keypair();

// Create a sealed message with additional authenticated data
let plaintext = b"For your eyes only";
let aad = b"Message ID: 12345";
let sealed_message = SealedMessage::new_with_aad(
    plaintext,
    &recipient_public_key,
    Some(aad),
);

// The recipient can decrypt the message
let decrypted = sealed_message.decrypt(&recipient_private_key).unwrap();
assert_eq!(decrypted, plaintext);

pub fn new_opt( plaintext: impl AsRef<[u8]>, recipient: &dyn Encrypter, aad: Option<impl AsRef<[u8]>>, test_nonce: Option<impl AsRef<Nonce>>, ) -> Self

Creates a new SealedMessage with options for testing.

This method is similar to new_with_aad but allows specifying a test nonce, which is useful for deterministic testing.

Parameters

• plaintext - The message data to encrypt
• recipient - The recipient who will be able to decrypt the message
• aad - Additional authenticated data that will be bound to the encryption
• test_nonce - Optional nonce for deterministic encryption (testing only)

Returns

A new SealedMessage containing the encrypted message and encapsulated key

pub fn decrypt(&self, private_key: &dyn Decrypter) -> Result<Vec<u8>>

Decrypts the message using the recipient’s private key.

This method performs the following steps:

1. Decapsulates the shared secret using the recipient’s private key
2. Uses the shared secret to decrypt the message

Parameters

• private_key - The private key of the intended recipient

Returns

A Result containing the decrypted message data if successful, or an error if decryption fails

Errors

Returns an error if:

• The private key doesn’t match the one used for encapsulation
• The decapsulation process fails
• The decryption process fails (e.g., message tampering)

Example

use bc_components::{EncapsulationScheme, SealedMessage};

// Generate keypairs for different users
let (alice_private_key, _) = EncapsulationScheme::default().keypair();
let (bob_private_key, bob_public_key) =
    EncapsulationScheme::default().keypair();

// Alice sends a message to Bob
let plaintext = b"Secret message for Bob";
let sealed_message = SealedMessage::new(plaintext, &bob_public_key);

// Bob can decrypt the message
let decrypted = sealed_message.decrypt(&bob_private_key).unwrap();
assert_eq!(decrypted, plaintext);

// Alice cannot decrypt the message she sent
assert!(sealed_message.decrypt(&alice_private_key).is_err());

pub fn encapsulation_scheme(&self) -> EncapsulationScheme

Returns the encapsulation scheme used for this sealed message.

Returns

The encapsulation scheme (X25519, MLKEM512, MLKEM768, or MLKEM1024) that was used to create this sealed message.

Example

use bc_components::{EncapsulationScheme, SealedMessage};

// Generate a keypair using ML-KEM768
let (_, public_key) = EncapsulationScheme::MLKEM768.keypair();

// Create a sealed message
let sealed_message =
    SealedMessage::new(b"Quantum-resistant message", &public_key);

// Check the encapsulation scheme
assert_eq!(
    sealed_message.encapsulation_scheme(),
    EncapsulationScheme::MLKEM768
);

Trait Implementations

impl AsRef<SealedMessage> for SealedMessage

Implementation of AsRef trait for SealedMessage.

fn as_ref(&self) -> &SealedMessage

Converts this type into a shared reference of the (usually inferred) input type.

impl CBORTagged for SealedMessage

Implementation of CBOR tagging for SealedMessage.

fn cbor_tags() -> Vec<Tag>

Returns the CBOR tags associated with this type.

impl CBORTaggedDecodable for SealedMessage

Implementation of CBOR decoding for SealedMessage.

fn from_untagged_cbor(cbor: CBOR) -> Result<Self>

Creates an instance of this type by decoding it from untagged CBOR.

fn from_tagged_cbor(cbor: CBOR) -> Result<Self, Error>

where Self: Sized,

Creates an instance of this type by decoding it from tagged CBOR.

fn from_tagged_cbor_data(data: impl AsRef<[u8]>) -> Result<Self, Error>

where Self: Sized,

Creates an instance of this type by decoding it from binary encoded tagged CBOR.

fn from_untagged_cbor_data(data: impl AsRef<[u8]>) -> Result<Self, Error>

where Self: Sized,

Creates an instance of this type by decoding it from binary encoded untagged CBOR.

impl CBORTaggedEncodable for SealedMessage

Implementation of CBOR encoding for SealedMessage.

fn untagged_cbor(&self) -> CBOR

Returns the untagged CBOR encoding of this instance.

fn tagged_cbor(&self) -> CBOR

Returns the tagged CBOR encoding of this instance.

fn tagged_cbor_data(&self) -> Vec<u8>

Returns the tagged value in CBOR binary representation.

impl Clone for SealedMessage

fn clone(&self) -> SealedMessage

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SealedMessage

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl From<SealedMessage> for CBOR

Conversion from SealedMessage to CBOR for serialization.

fn from(value: SealedMessage) -> Self

Converts to this type from the input type.

impl PartialEq for SealedMessage

fn eq(&self, other: &SealedMessage) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl TryFrom<CBOR> for SealedMessage

Conversion from CBOR to SealedMessage for deserialization.

type Error = Error

The type returned in the event of a conversion error.

fn try_from(cbor: CBOR) -> Result<Self>

Performs the conversion.

impl StructuralPartialEq for SealedMessage