Crate cratefield_kms 

cratefield-kms — the KMS port (issue #40, ADR 0102, docs/SECRETS-DESIGN.md).

Wrapping and unwrapping a data key is the only thing the KMS does for us, so it is the only thing this trait can ask. Everything else — which cipher seals a secret, what binds a ciphertext to its row, where the wrapped key is stored — belongs to the envelope layer (#39) and to the database, never to the vendor.

The provider name and key reference travel with every wrapped key, so changing vendor is a re-wrap job rather than a schema change.

let kms = LocalFileKms::open("/run/secrets/fz-kek", "development")?;
let dek = Dek::generate()?;
let wrapped = kms.wrap(&dek).await?;
let same = kms.unwrap(&wrapped).await?;
assert_eq!(dek.expose(), same.expose());

Structs

Dek

A 256-bit data key. Zeroised on drop, never Debug-printed, never Cloned: a key that can be copied is a key that can be left behind.

LocalFileKms

A KEK read from a file. See the module docs for why it refuses production.

WorkerSecretKms

A KEK held in Worker secrets, read once at construction. See the module docs for why it does not refuse production.

Enums

KmsError

Why a wrap or unwrap did not happen. The split that matters operationally is unavailable (retry, alarm on duration) against denied (do not retry, alarm immediately): they want different alarms and different retry behaviour, and a single opaque error makes a permissions mistake look like an outage for as long as it takes someone to read the logs.

Constants

DEK_LEN

The only size this port deals in (ADR 0102).

Traits

Kms

Wrap and unwrap a data key under a master key that never leaves the KMS.

Functions

conformance

The conformance every provider passes (issue #40). Kept in the crate rather than in one provider’s tests so a new vendor is one call away from being held to the same behaviour.