Module encrypting 

Encrypting storage backend — transparent AES-256-GCM encryption layer.

Wraps any StorageBackend to provide transparent encryption and decryption of segment data at rest, using the EncryptionService from chronix_security::auth.

Envelope Format

[4-byte LE key_id_len][key_id bytes][12-byte nonce][AES-256-GCM ciphertext + tag]

The key ID is embedded in each encrypted segment so that key rotation is seamless — segments encrypted with an older key can still be decrypted as long as the key provider retains the retired key.

Thread Safety

EncryptingBackend<B> is Send + Sync whenever B is, making it usable as a drop-in replacement in async contexts.

Structs

EncryptingBackend

Transparent encryption wrapper around any StorageBackend.