Trait EncryptionProvider 

pub trait EncryptionProvider:
    Send
    + Sync
    + UnwindSafe
    + RefUnwindSafe {
    // Required methods
    fn encrypt(&self, plaintext: &[u8]) -> Result<Vec<u8>>;
    fn max_overhead(&self) -> u32;
    fn decrypt(&self, ciphertext: &[u8]) -> Result<Vec<u8>>;

    // Provided methods
    fn supports_aad_block_path(&self) -> bool { ... }
    fn encrypt_vec(&self, plaintext: Vec<u8>) -> Result<Vec<u8>> { ... }
    fn decrypt_vec(&self, ciphertext: Vec<u8>) -> Result<Vec<u8>> { ... }
    fn encrypt_block_aad(
        &self,
        _plaintext: &[u8],
        _identity: &BlockIdentity,
        _compression_type: u8,
        _block_flags: u8,
    ) -> Result<Vec<u8>> { ... }
    fn decrypt_block_aad(
        &self,
        _ciphertext: &[u8],
        _identity: &BlockIdentity,
    ) -> Result<Vec<u8>> { ... }
}

Block encryption provider.

Implementors handle key management, nonce generation, and algorithm selection. The trait is object-safe so it can be stored as Arc<dyn EncryptionProvider>.

Contract

• encrypt must be deterministic in output format (but not value — nonces should be random or unique).
• decrypt must accept the exact byte sequence returned by encrypt and recover the original plaintext.
• Both methods must be safe to call concurrently from multiple threads.

Required Methods

fn encrypt(&self, plaintext: &[u8]) -> Result<Vec<u8>>

Encrypt plaintext, returning an opaque ciphertext blob.

The returned bytes may include a nonce/IV prefix and an authentication tag — the layout is provider-defined.

Errors

Returns crate::Error::Encrypt if the encryption operation fails.

fn max_overhead(&self) -> u32

Maximum number of bytes that encryption adds to a plaintext payload.

Used by block I/O to account for encryption overhead in size validation. For AES-256-GCM this is 28 (12-byte nonce + 16-byte tag).

Returns u32 because block sizes are u32-bounded on disk.

fn decrypt(&self, ciphertext: &[u8]) -> Result<Vec<u8>>

Decrypt ciphertext previously produced by encrypt.

Errors

Returns crate::Error::Decrypt if the ciphertext is invalid, tampered, or encrypted with a different key.

Provided Methods

fn supports_aad_block_path(&self) -> bool

Whether this provider implements the AAD-bound block path (encrypt_block_aad / decrypt_block_aad).

On a zstd build the live block I/O path routes encrypted blocks through the AAD-bound envelope, so a provider that only implements the opaque encrypt / decrypt surface would fail on the first encrypted read/write. The store validates this capability when an encryption provider is configured (see Config::open) and rejects an unsupported provider up front rather than failing mid-I/O. Defaults to false; AAD-capable providers (e.g. Aes256GcmProvider) override it to true.

fn encrypt_vec(&self, plaintext: Vec<u8>) -> Result<Vec<u8>>

Encrypt an owned plaintext buffer, reusing its allocation when possible.

The default implementation delegates to encrypt. Providers may override this to avoid an extra allocation by prepending the nonce and appending the tag in-place.

Errors

Returns crate::Error::Encrypt if the encryption operation fails.

fn decrypt_vec(&self, ciphertext: Vec<u8>) -> Result<Vec<u8>>

Decrypt an owned ciphertext buffer, reusing its allocation when possible.

The default implementation delegates to decrypt. Providers may override this to decrypt in-place, stripping the nonce prefix and tag suffix without a second allocation.

Errors

Returns crate::Error::Decrypt if the ciphertext is invalid, tampered, or encrypted with a different key.

fn encrypt_block_aad( &self, _plaintext: &[u8], _identity: &BlockIdentity, _compression_type: u8, _block_flags: u8, ) -> Result<Vec<u8>>

AAD-bound block encryption: seal plaintext into a MetadataFrame ‖ BodyFrame blob whose AEAD tag binds the block’s identity and transform stack (anti-swap / anti-relabel), per docs/aad-block-format.md. The per-block AAD inputs (identity, compression_type, block_flags) come from the block layer; the provider supplies the key material (key chain + active epoch + suite). This is the live block-I/O encryption path (BlockTransform), distinct from the opaque encrypt the manifest subsystem still uses.

Errors

The default returns crate::Error::Encrypt: a provider that cannot bind AAD must not serve the block path. AAD-capable providers (e.g. Aes256GcmProvider) override this.

fn decrypt_block_aad( &self, _ciphertext: &[u8], _identity: &BlockIdentity, ) -> Result<Vec<u8>>

Inverse of encrypt_block_aad: verify the AAD binding and recover the plaintext. The transform fields the writer bound (compression_type, block_flags, key_epoch, suite_id) are read back from the frame’s MetadataFrame; the reader supplies only identity (the out-of-band tree/table + dict/window context, from the per-SST descriptor + block handle). Any mismatch fails AEAD verification.

Errors

crate::Error::Decrypt on tag-verify failure / malformed frame, or for providers that do not bind AAD (the default).

Dyn Compatibility

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors

impl EncryptionProvider for Aes256GcmProvider

Available on crate feature encryption only.