Struct EncryptionKey 

pub struct EncryptionKey { /* private fields */ }

Encryption key with secure memory handling.

The key bytes are wrapped in Zeroizing to ensure they are zeroed from memory when dropped.

Implementations

impl EncryptionKey

pub fn derive_from_password(password: &str, salt: &[u8]) -> Result<Self>

Derives an encryption key from a password using Argon2id.

Arguments

• password - The password to derive the key from
• salt - Salt bytes (should be at least 16 bytes, randomly generated per-key)

Errors

Returns SecretsError::Encryption if key derivation fails.

pub fn generate() -> Self

Generates a random 32-byte encryption key.

Uses the operating system’s cryptographically secure random number generator.

Panics

Panics if the OS random number generator fails.

pub fn from_bytes(bytes: &[u8]) -> Result<Self>

Creates an encryption key from raw bytes.

Arguments

• bytes - The key bytes (must be exactly 32 bytes)

Errors

Returns SecretsError::Encryption if the byte slice is not exactly 32 bytes.

pub fn as_bytes(&self) -> &[u8]

Returns the raw key bytes.

Use with caution - only for persisting the key securely.

pub fn encrypt(&self, plaintext: &[u8]) -> Result<Vec<u8>>

Encrypts plaintext using XChaCha20-Poly1305.

The returned ciphertext has the 24-byte nonce prepended: [nonce (24 bytes)][ciphertext + auth tag]

Arguments

• plaintext - The data to encrypt

Errors

Returns SecretsError::Encryption if encryption fails.

Panics

Panics if the OS random number generator fails to produce nonce bytes.

pub fn decrypt(&self, data: &[u8]) -> Result<Vec<u8>>

Decrypts data that was encrypted with Self::encrypt.

Expects the input format: [nonce (24 bytes)][ciphertext + auth tag]

Arguments

• data - The encrypted data with prepended nonce

Errors

Returns SecretsError::Decryption if:

• The data is too short (less than nonce size)
• Decryption or authentication fails

Trait Implementations

impl Clone for EncryptionKey

fn clone(&self) -> EncryptionKey

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.