Struct EncryptionService 

pub struct EncryptionService { /* private fields */ }

AES-256-GCM encryption service for data at rest.

Encrypted format: [12-byte nonce][ciphertext + 16-byte tag]

Tracks invocation count per NIST SP 800-38D recommendation to rotate keys before 2^32 encryptions with random nonces.

Implementations

impl EncryptionService

pub fn new(provider: Box<dyn KeyProvider>) -> Self

Create a new encryption service with the given key provider.

pub fn invocation_count(&self) -> u64

Returns the number of encrypt() calls since creation.

pub fn encrypt(&self, plaintext: &[u8]) -> Result<(Vec<u8>, String), AuthError>

Encrypt data using the current key.

Returns (ciphertext_with_nonce, key_id). Format: [12-byte nonce][AES-256-GCM ciphertext + 16-byte auth tag]

pub fn decrypt(&self, data: &[u8], key_id: &str) -> Result<Vec<u8>, AuthError>

Decrypt data using the specified key.

Input format: [12-byte nonce][AES-256-GCM ciphertext + 16-byte auth tag]

pub fn hmac(&self, data: &[u8]) -> Result<Vec<u8>, AuthError>

Compute HMAC-SHA256 over data for integrity verification.

pub fn verify_hmac( &self, data: &[u8], expected: &[u8], key_id: &str, ) -> Result<bool, AuthError>

Verify HMAC-SHA256 integrity.

pub fn current_key_id(&self) -> Result<String, AuthError>

Get the current key ID.

pub fn key_ids(&self) -> Vec<String>

List all available key IDs.

Trait Implementations

impl Debug for EncryptionService

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.