combs_mesh/blocks/
encryption.rs

1//! `enc` — encryption-at-rest directive.
2//!
3//! The block itself is never encrypted (it carries the policy); the binary
4//! writer encrypts the payloads of every block type listed in `apply_to`
5//! when a keyring is supplied.
6
7use serde::{Deserialize, Serialize};
8
9use super::BlockTag;
10
11/// Encryption directive block.
12#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
13pub struct EncryptionBlock {
14    /// The AEAD algorithm to use.
15    pub algorithm: EncryptionAlgorithm,
16    /// Block types to encrypt at rest. Empty = encrypt nothing.
17    #[serde(default)]
18    pub apply_to: Vec<BlockTag>,
19}
20
21/// Supported AEAD algorithms (RustCrypto implementations, matching the
22/// WebCrypto algorithms used by `@combs/zerotrust`).
23#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
24#[serde(rename_all = "lowercase")]
25pub enum EncryptionAlgorithm {
26    /// AES-256-GCM.
27    Aes256Gcm,
28    /// ChaCha20-Poly1305.
29    ChaCha20Poly1305,
30}
combs_mesh/blocks/encryption.rs

combs_mesh/blocks/
encryption.rs
