Struct SealedSecret 

pub struct SealedSecret {
    pub kek_id: String,
    pub nonce: [u8; 12],
    pub ciphertext: Vec<u8>,
}

An encrypted secret, exactly as it is persisted.

This is the only shape that crosses the storage boundary. It carries no plaintext and no key material — kek_id names which KEK to open it with, it is not itself secret.

Serialisable so a durable store can persist it verbatim. The byte fields are hex rather than JSON number arrays: a credential file is something an operator will open during an incident, and "a3f1…" is inspectable where [163,241,…] is not. Hex also keeps the file a third of the size.

Fields

kek_id: String

Which key-encryption key sealed this. Clear-text by design (rotation).

nonce: [u8; 12]

Random per-seal nonce.

ciphertext: Vec<u8>

Ciphertext with the AEAD tag appended.

Trait Implementations

impl Clone for SealedSecret

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SealedSecret

Never print ciphertext or nonce: a Debug on a request-scoped struct is how secrets reach logs. The id and a length are enough to debug with.

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for SealedSecret

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for SealedSecret

impl PartialEq for SealedSecret

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for SealedSecret

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for SealedSecret