key-vault 1.0.0

Enterprise-grade key management vault for Rust. 9-layer defense-in-depth: fragmentation, decoy bytes, codex transform, mlock + zeroize, constant-time ops, security monitoring. Pluggable key fetchers (TPM, keychain, file, env). Sub-microsecond access. REPS-compliant.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56

# clippy configuration for key-vault
avoid-breaking-exported-api = true
msrv = "1.85"
cognitive-complexity-threshold = 30
type-complexity-threshold = 250
too-many-arguments-threshold = 7
trivial-copy-size-limit = 128
single-char-binding-names-threshold = 5

# Domain terms that legitimately appear in rustdoc without backticks.
# Adding them here suppresses the (often noisy) `clippy::doc_markdown` lint
# for these specific identifiers, while still catching genuinely missed
# backticks elsewhere.
doc-valid-idents = [
    "..",
    # ISA / arch
    "x86_64",
    "aarch64",
    "ARMv8",
    "ARMv9",
    # TEE / hardware
    "TrustZone",
    "IntelTDX",
    "TDX",
    "SGX",
    "SEV",
    "SEV-SNP",
    "SNP",
    "DPAPI",
    # Crypto / standards
    "BLAKE3",
    "ChaCha20",
    "ChaCha20-Poly1305",
    "Poly1305",
    "AES-GCM",
    "AEAD",
    "DER",
    "PEM",
    "PROT_NONE",
    "PROT_READ",
    "VirtualLock",
    "VirtualUnlock",
    "VirtualProtect",
    # Org / product
    "KeyVault",
    "HashiCorp",
    "HiveDB",
    "CSPRNG",
    "OSes",
    # OS-level disk encryption + credential stores
    "FileVault",
    "BitLocker",
    "KWallet",
    "TrustZone",
    "IntelSGX",
]