Struct LocalKek 

pub struct LocalKek { /* private fields */ }

AES-256-GCM envelope under a machine-local key-encryption key (KEK).

Implementations

impl LocalKek

pub fn from_bytes(kek: [u8; 32]) -> Self

Build from a raw 32-byte KEK.

pub fn load_or_generate(path: &Path) -> Result<Self, EnvelopeError>

Load the KEK from path (raw 32 bytes), generating + persisting one (0600) if the file does not exist. In a cluster the same file must be present on every node (wrapped certs replicate).

Trait Implementations

impl KeyEnvelope for LocalKek

fn wrap<'life0, 'life1, 'async_trait>( &'life0 self, plaintext: &'life1 [u8], ) -> Pin<Box<dyn Future<Output = Result<Vec<u8>, EnvelopeError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Wrap plaintext, returning an opaque blob to store at rest.

fn unwrap<'life0, 'life1, 'async_trait>( &'life0 self, wrapped: &'life1 [u8], ) -> Pin<Box<dyn Future<Output = Result<Vec<u8>, EnvelopeError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Unwrap a blob produced by wrap, returning the plaintext.