Struct KeyHeader 

pub struct KeyHeader {
    pub iv: Iv,
    pub tag: Vec<u8>,
    pub descriptor: String,
    pub keyset_id: Option<Uuid>,
    pub decryption_policy: Option<DecryptionPolicy>,
}

The per-document key header of the SteVec envelope wire format.

A SteVec document encrypts all of its entries under ONE data key, so the key-retrieval material — everything an EncryptedRecord carries besides the ciphertext itself — is stored once at the document envelope (the h field) instead of being repeated inside every entry’s c. Entries carry only their raw AEAD output; their nonces are derived from their stored selectors (nonce = selector_bytes[..12]), so no per-entry nonce is stored either.

Deliberately a dedicated struct rather than an EncryptedRecord with an empty ciphertext: the header is a distinct wire concept and the blob is opaque to SQL, so the field set can evolve independently under serde.

Fields

iv: Iv

tag: Vec<u8>

descriptor: String

keyset_id: Option<Uuid>

decryption_policy: Option<DecryptionPolicy>

Decryption policy with server-generated MAC (tag_version=1 only).

Implementations

impl KeyHeader

pub fn new( key: &DataKeyWithTag, descriptor: impl Into<String>, keyset_id: Option<Uuid>, ) -> Self

Build the header for a document encrypted under key.

pub fn retrieve_key_payload(&self) -> RetrieveKeyPayload<'_>

The ZeroKMS key-retrieval payload for the document’s data key — the same (iv, descriptor, tag) triple a self-contained record produces.

pub fn record_with_selector( &self, ciphertext: Vec<u8>, selector: [u8; 16], ) -> RecordWithNonce

Reassemble a decryptable record for one entry of the document: the header’s key material + the entry’s raw AEAD ciphertext + the entry’s 16-byte tokenized selector. The selector is the source of both AEAD bindings — the nonce is its first 12 bytes and the full 16 bytes are bound into the AAD (see RecordWithNonce).

pub fn to_mp_bytes(&self) -> Result<Vec<u8>, DecryptError>

Serialize the header to a Vec<u8> using MessagePack encoding.

pub fn to_mp_base85(&self) -> Result<String, DecryptError>

Serialize the header using MessagePack and convert to a base85-encoded string — the on-the-wire form of the envelope h field.

pub fn from_mp_bytes(bytes: &[u8]) -> Result<Self, DecryptError>

Deserialize a header from a slice of MessagePack-encoded bytes.

pub fn from_mp_base85(base85str: &str) -> Result<Self, DecryptError>

Deserialize a header from a base85-encoded string of MessagePack-encoded bytes (the envelope h field).

Trait Implementations

impl Clone for KeyHeader

fn clone(&self) -> KeyHeader

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for KeyHeader

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for KeyHeader

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for KeyHeader

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.