Struct StorageKey 

pub struct StorageKey {
    pub epoch: u32,
    pub kek_epoch: u32,
    pub algorithm: StorageAlgorithm,
    pub wrapped_dek: Vec<u8>,
    pub created_at_unix_ms: i64,
    pub opened_at_t: u64,
    pub state: StorageKeyState,
    pub live_objects: u64,
}

One storage data key, wrapped under the manifest’s KEK.

Fields

epoch: u32

Epoch this key encrypts under. Stored in every object it produces.

kek_epoch: u32

KEK epoch the material below is wrapped under. Recorded because a KEK rotation retires a KEK epoch while the DEK epoch is unchanged.

algorithm: StorageAlgorithm

AEAD suite this epoch is used with.

wrapped_dek: Vec<u8>

Wrapped data key. Never usable without the KEK.

created_at_unix_ms: i64

When the epoch was opened, as Unix milliseconds.

opened_at_t: u64

Transaction number the epoch was opened at.

This is the log-record nonce budget’s meter. Log records use AES-256-GCM with a random nonce, so the number sealed under one key must stay well below LOG_RECORDS_PER_EPOCH_LIMIT — and that number is exactly the span of t the epoch covers, because the log seals one record per transaction. Recording where an epoch started therefore measures its budget with no counter to maintain and no write amplification: the next epoch’s opened_at_t (or the current basis, for the active epoch) ends the span. See KeyManifest::log_records_sealed.

state: StorageKeyState

Where the epoch sits in its lifecycle.

live_objects: u64

Live objects carrying this epoch as of the last mark pass. An epoch retires only at zero; corium keys status prints it so a drain is a number rather than a guess. This counts stored objects for GC drain, not records sealed — the nonce budget is opened_at_t’s job.

Trait Implementations

impl Clone for StorageKey

fn clone(&self) -> StorageKey

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for StorageKey

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for StorageKey

impl PartialEq for StorageKey

fn eq(&self, other: &StorageKey) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for StorageKey