Skip to main content

Decryptable

cipherstash_client::zerokms

Trait Decryptable 

pub trait Decryptable: Debug {
    type Error: Error;

    // Required methods
    fn keyset_id(&self) -> Option<Uuid>;
    fn retrieve_key_payload<'a>(
        &'a self,
    ) -> Result<RetrieveKeyPayload<'a>, Self::Error>;
    fn into_encrypted_record(self) -> Result<EncryptedRecord, Self::Error>;

    // Provided methods
    fn nonce_override(&self) -> Option<[u8; 12]> { ... }
    fn aad_selector(&self) -> Option<[u8; 16]> { ... }
}

Required Associated Types§

type Error: Error

Required Methods§

fn keyset_id(&self) -> Option<Uuid>

The keyset ID associated with the record, if any.

fn retrieve_key_payload<'a>( &'a self, ) -> Result<RetrieveKeyPayload<'a>, Self::Error>

The payload used to retrieve the key for decryption.

fn into_encrypted_record(self) -> Result<EncryptedRecord, Self::Error>

Convert the record into an EncryptedRecord.

Provided Methods§

fn nonce_override(&self) -> Option<[u8; 12]>

The explicit AEAD nonce for this record, when the wire format derives it from something other than the data key’s IV. SteVec entries under the envelope wire format derive it from the entry’s stored selector (nonce = selector_bytes[..12]); classic records return None and decrypt with the IV-derived nonce.

fn aad_selector(&self) -> Option<[u8; 16]>

The full 16-byte tokenized selector to bind into the AEAD AAD, when the wire format ties the ciphertext to a selector. The nonce only covers the first 12 selector bytes, so binding all 16 here authenticates the whole selector — a stored selector cannot be mutated (even in its last 4 bytes) without the entry failing to decrypt. SteVec entries return their selector; classic records return None and add nothing to the AAD.

Dyn Compatibility§

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors§