Struct EnvelopeEncryptor 

pub struct EnvelopeEncryptor { /* private fields */ }

Envelope encryptor with key rotation support.

Ciphertext Format

[envelope_version: 1 byte][key_version: 4 bytes][cipher_data: variable]

The cipher_data contains the nonce, ciphertext, and authentication tag as produced by the underlying cipher.

Implementations

impl EnvelopeEncryptor

pub fn new(key: EncryptionKey) -> Self

Create a new envelope encryptor with a single key.

pub fn with_key_ring(key_ring: KeyRing) -> Self

Create from an existing key ring.

pub fn key_ring(&self) -> &KeyRing

Get a reference to the key ring.

pub fn key_ring_mut(&mut self) -> &mut KeyRing

Get a mutable reference to the key ring.

pub fn rotate_key(&mut self, new_key: EncryptionKey) -> u32

Rotate to a new key.

pub fn encrypt( &self, plaintext: &[u8], associated_data: Option<&[u8]>, ) -> CryptoResult<Vec<u8>>

Encrypt data with the active key.

pub fn decrypt( &self, ciphertext: &[u8], associated_data: Option<&[u8]>, ) -> CryptoResult<Vec<u8>>

Decrypt data using the key version from the envelope.

pub fn re_encrypt( &self, ciphertext: &[u8], associated_data: Option<&[u8]>, ) -> CryptoResult<Vec<u8>>

Re-encrypt data with the current active key.

Useful during key rotation to migrate old data to new keys.

pub fn uses_active_key(&self, ciphertext: &[u8]) -> CryptoResult<bool>

Check if ciphertext uses the active key.

pub fn get_key_version(&self, ciphertext: &[u8]) -> CryptoResult<u32>

Get the key version from ciphertext.

Trait Implementations

impl DataEncryptor for EnvelopeEncryptor

Available on crate feature aes only.

fn encrypt_data<T: Serialize>(&self, data: &T) -> CryptoResult<Vec<u8>>

Encrypt a serializable value.

fn decrypt_data<T: DeserializeOwned>( &self, ciphertext: &[u8], ) -> CryptoResult<T>

Decrypt to a deserializable value.