Struct TunnelCrypto 

pub struct TunnelCrypto { /* private fields */ }

Provides encryption and decryption using XChaCha20-Poly1305

XChaCha20-Poly1305 is chosen because:

• 24-byte nonce allows safe random nonce generation
• AEAD provides both encryption and authentication
• Fast in software (no hardware AES required)
• Well-audited implementation

Implementations

impl TunnelCrypto

pub fn new(key: &TunnelKey) -> Self

Create a new crypto instance with the given key

pub fn encrypt(&self, plaintext: &[u8]) -> Result<Vec<u8>>

Encrypt data with a random nonce

Returns: [nonce (24 bytes)][ciphertext][auth tag (16 bytes)]

pub fn decrypt(&self, data: &[u8]) -> Result<Vec<u8>>

Decrypt data, extracting nonce from prefix