Struct EncryptionLayer 

pub struct EncryptionLayer { /* private fields */ }

Zero-knowledge encryption layer with per-tenant key derivation.

Holds a derived encryption key (zeroized on drop) and the ZeroKnowledgeEncryptor from cachekit-core for AES-256-GCM operations.

L1 stores ciphertext, not plaintext — the zero-knowledge property is preserved across all cache layers.

Implementations

impl EncryptionLayer

pub fn new( master_key_bytes: &[u8], tenant_id: &str, ) -> Result<Self, CachekitError>

Create a new encryption layer with HKDF-derived tenant keys.

Arguments

• master_key_bytes — Raw master key (minimum 32 bytes for AES-256)
• tenant_id — Tenant identifier for cryptographic isolation

Errors

• Master key too short (< 32 bytes)
• HKDF derivation failure
• Encryptor initialization failure

pub fn encrypt( &self, plaintext: &[u8], cache_key: &str, ) -> Result<Vec<u8>, CachekitError>

Encrypt plaintext with AAD bound to the cache key.

Output format: [nonce(12)][ciphertext + auth_tag(16)]

pub fn decrypt( &self, ciphertext: &[u8], cache_key: &str, ) -> Result<Vec<u8>, CachekitError>

Decrypt ciphertext with AAD bound to the cache key.

Returns the original plaintext. Fails if the cache key does not match the one used during encryption (ciphertext substitution protection).

pub fn tenant_id(&self) -> &str

Return the tenant ID used for key derivation.

pub fn build_aad(&self, cache_key: &str, compressed: bool) -> Vec<u8>

Build AAD v0x03 for a given cache key and compression flag.

Format: [0x03][len][tenant_id][len][cache_key][len]["msgpack"][len]["True"/"False"]

All lengths are 4-byte big-endian u32 to prevent boundary-confusion attacks.

Trait Implementations

impl Debug for EncryptionLayer

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.