Module encryption 

AES-256-GCM authenticated encryption for data at rest.

Provides transparent encryption/decryption of segment data blocks and WAL entries with per-entry nonces. Supports key rotation — new data uses the latest key, old data remains readable with previous keys.

Example

use chronix_security::auth::encryption::{EncryptionService, FileKeyProvider};

let provider = FileKeyProvider::from_hex_key(
    "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
    "key-1",
).unwrap();
let service = EncryptionService::new(Box::new(provider));

let plaintext = b"hello world";
let (ciphertext, key_id) = service.encrypt(plaintext).unwrap();
let decrypted = service.decrypt(&ciphertext, &key_id).unwrap();
assert_eq!(plaintext.as_slice(), &decrypted);

Structs

EncryptionService

AES-256-GCM encryption service for data at rest.

EnvKeyProvider

Key provider that reads from environment variables.

FileKeyProvider

Key provider that reads keys from a file or config.

SecretKey

A secret key that is automatically zeroized when dropped.

Traits

KeyProvider

Trait for providing encryption keys.