Struct DataEnvelope 

pub struct DataEnvelope { /* private fields */ }

DataEnvelope allows sealing structs entire structs to encrypted blobs.

Sealing a struct results in an encrypted blob, and a content-encryption-key. The content-encryption-key must be provided again when unsealing the data. A content encryption key allows easy key-rotation of the encrypting-key, as now just the content-encryption-keys need to be re-uploaded, instead of all data.

The content-encryption-key cannot be re-used for encrypting other data.

Note: This is explicitly meant for structured data, not large binary blobs (files).

Implementations

impl DataEnvelope

pub fn seal<Ids: KeySlotIds, T>( data: T, ctx: &mut KeyStoreContext<'_, Ids>, ) -> Result<(Self, Ids::Symmetric), DataEnvelopeError>

where T: Serialize + SealableVersionedData,

Seals a struct into an encrypted blob, and stores the content-encryption-key in the provided context.

pub fn seal_with_wrapping_key<Ids: KeySlotIds, T>( data: T, wrapping_key: &Ids::Symmetric, ctx: &mut KeyStoreContext<'_, Ids>, ) -> Result<(Self, EncString), DataEnvelopeError>

where T: Serialize + SealableVersionedData,

Seals a struct into an encrypted blob. The content encryption key is wrapped with the provided wrapping key

pub fn unseal<Ids: KeySlotIds, T>( &self, cek_keyslot: Ids::Symmetric, ctx: &mut KeyStoreContext<'_, Ids>, ) -> Result<T, DataEnvelopeError>

where T: DeserializeOwned + SealableVersionedData,

Unseals the data from the encrypted blob using a content-encryption-key stored in the context.

pub fn unseal_with_wrapping_key<Ids: KeySlotIds, T>( &self, wrapping_key: &Ids::Symmetric, wrapped_cek: &EncString, ctx: &mut KeyStoreContext<'_, Ids>, ) -> Result<T, DataEnvelopeError>

where T: DeserializeOwned + SealableVersionedData,

Unseals the data from the encrypted blob and wrapped content-encryption-key.

Trait Implementations

impl Clone for DataEnvelope

fn clone(&self) -> DataEnvelope

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for DataEnvelope

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for DataEnvelope

fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>

where D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Display for DataEnvelope

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl From<&DataEnvelope> for Vec<u8>

fn from(val: &DataEnvelope) -> Self

Converts to this type from the input type.

impl From<DataEnvelope> for String

fn from(val: DataEnvelope) -> Self

Converts to this type from the input type.

impl From<Vec<u8>> for DataEnvelope

fn from(data: Vec<u8>) -> Self

Converts to this type from the input type.

impl FromStr for DataEnvelope

type Err = NotB64EncodedError

The associated error which can be returned from parsing.

fn from_str(s: &str) -> Result<Self, Self::Err>

Parses a string s to return a value of this type.

impl Serialize for DataEnvelope

fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>

where S: Serializer,

Serialize this value into the given Serde serializer.