Struct Cipher 

pub struct Cipher { /* private fields */ }

A field-level-encryption cipher: AES-256-GCM with HKDF-SHA256-derived keys.

Key material is zeroized on drop.

Implementations

impl Cipher

pub fn new(master_key: &[u8]) -> Result<Self>

Create a cipher from a master key (must be at least 32 bytes).

Derives an AES key (HKDF info geode-encrypt) and an HMAC key (HKDF info geode-hmac), both 32 bytes, with an empty salt.

pub fn encrypt(&self, plaintext: &[u8]) -> Result<Vec<u8>>

Encrypt plaintext. Output layout: nonce(12) || ciphertext || tag(16).

The 96-bit nonce is drawn from the operating-system CSPRNG via OsRng, matching the Go driver’s crypto/rand source.

pub fn decrypt(&self, ciphertext: &[u8]) -> Result<Vec<u8>>

Decrypt a nonce(12) || ciphertext || tag(16) buffer.

pub fn encrypt_string(&self, plaintext: &str) -> Result<String>

Encrypt a string and return standard padded base64.

pub fn decrypt_string(&self, encoded: &str) -> Result<String>

Decrypt a standard padded base64 string.

pub fn hmac_hex(&self, data: &str) -> String

Compute the lowercase hex HMAC-SHA256 of data using the HMAC key. Deterministic — used for searchable equality lookups.

Trait Implementations

impl Drop for Cipher

fn drop(&mut self)

Executes the destructor for this type.

fn pin_drop(self: Pin<&mut Self>)

🔬This is a nightly-only experimental API. (pin_ergonomics)

Execute the destructor for this type, but different to Drop::drop, it requires self to be pinned.