Struct LocalKeyCipher 

pub struct LocalKeyCipher { /* private fields */ }

The single-user reference cipher: a local 256-bit ChaCha20-Poly1305 key.

Genuinely linearizable-free confidentiality + integrity for the personal multi-device case. NOT a login-derived or org-distributed key — see the module’s key-distribution follow-up.

Implementations

impl LocalKeyCipher

pub fn from_key(key: [u8; 32]) -> Self

Build a cipher over an explicit 256-bit key.

pub fn generate() -> Self

Mint a fresh random key (OS CSPRNG). Not persisted — pair with Self::key_hex to store it, or use Self::load_or_generate.

pub fn key_hex(&self) -> String

The key as 64 hex chars (for persistence). Handle as a secret.

pub fn from_key_hex(hex: &str) -> Result<Self, CryptoError>

Parse a 64-hex-char key.

pub fn load_or_generate(path: &Path) -> Result<Self, CryptoError>

Load the key from path, or mint + persist a new one there (0600 on unix). The single-user “the key lives on my devices” story — a device gets the key out of band (copy the file / a recovery phrase); this is the local reference, not the login-derived distribution (the follow-up).

Trait Implementations

impl Clone for LocalKeyCipher

fn clone(&self) -> LocalKeyCipher

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for LocalKeyCipher

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Drop for LocalKeyCipher

fn drop(&mut self)

Executes the destructor for this type.

fn pin_drop(self: Pin<&mut Self>)

🔬This is a nightly-only experimental API. (pin_ergonomics)

Execute the destructor for this type, but different to Drop::drop, it requires self to be pinned.

impl PayloadCipher for LocalKeyCipher

fn encrypt(&self, plaintext: &Value) -> Result<Value, CryptoError>

Encrypt a cleartext payload into a ciphertext Envelope (as a Value).

fn decrypt(&self, envelope: &Value) -> Result<Value, CryptoError>

Recover the cleartext payload from a ciphertext Envelope. Fails (CryptoError::Decrypt) on a wrong key or any tamper.