rainier-crypt

Reversible encryption and message signing — Laravel's Crypt, plus the signing half that Laravel spreads across signed URLs and cookie integrity.

use rainier_crypt::{Encryption, Key, KeyRing};

# fn main() -> rainier_support::Result<()> {
let crypt = Encryption::from_keys(KeyRing::new(Key::generate()));

let sealed = crypt.encrypt("a card number")?;
assert_eq!(crypt.decrypt(&sealed)?, "a card number");

// Signed, not sealed: the value stays readable, but not writable.
let signed = crypt.sign("unsubscribe-42")?;
assert!(signed.starts_with("unsubscribe-42."));
assert_eq!(crypt.verify(&signed)?, "unsubscribe-42");
# Ok(()) }

Encrypt or sign?

Reach for signing when the value is not a secret. An unsubscribe link, a reset token, a "remember this choice" cookie — encrypting those makes them opaque in your own logs for no gain.

This is not password hashing

Passwords are hashed, never encrypted, and that lives in rainier-auth's Hasher. If you can get the value back out, it is the wrong tool for a password — see the hashing docs.

Rotation is designed in

Every payload records which key produced it, and a [KeyRing] holds one current key plus any number of retired ones. Rotating is a deploy:

# use rainier_crypt::{Encryption, Key, KeyRing};
# fn main() -> rainier_support::Result<()> {
# let retired = Key::generate();
# let sealed = Encryption::from_keys(KeyRing::new(retired.clone())).encrypt("old")?;
let crypt = Encryption::from_keys(
    KeyRing::new(Key::generate()).with_previous(retired),
);

// Written with the old key, still readable; anything new uses the new one.
assert_eq!(crypt.decrypt(&sealed)?, "old");
# Ok(()) }

Retrofitting that is painful, which is why it is here from the first release rather than deferred until a key is known to have leaked.