Struct EncryptionConfig 

pub struct EncryptionConfig { /* private fields */ }

Encryption configuration for data at rest.

Holds the encryption algorithm and derived key material. Once created, can encrypt/decrypt arbitrary byte slices.

Security Properties

• Fresh random nonce per encryption (12 bytes, CSPRNG)
• AEAD authentication prevents tampering
• Key derived via HKDF-SHA256 from password or raw key
• Zeroization: key material lives only in this struct

Examples

use dbx_core::storage::encryption::EncryptionConfig;

// From password (most common)
let config = EncryptionConfig::from_password("my-password");

// From raw 256-bit key
let key = [0x42u8; 32];
let config = EncryptionConfig::from_key(key);

// Encrypt → decrypt round-trip
let data = b"hello, encrypted world!";
let enc = config.encrypt(data).unwrap();
let dec = config.decrypt(&enc).unwrap();
assert_eq!(dec, data);

Implementations

impl EncryptionConfig

pub fn from_password(password: &str) -> Self

Create encryption config from a password string.

The password is stretched to a 256-bit key using HKDF-SHA256. Uses the default algorithm (AES-256-GCM-SIV).

pub fn from_password_with_algorithm( password: &str, algorithm: EncryptionAlgorithm, ) -> Self

Create encryption config from a password with a specific algorithm.

pub fn from_key(key: [u8; 32]) -> Self

Create encryption config from a raw 256-bit key.

Uses the default algorithm (AES-256-GCM-SIV).

Panics

Panics if key is not exactly 32 bytes (this is enforced by the type system).

pub fn from_key_with_algorithm( key: [u8; 32], algorithm: EncryptionAlgorithm, ) -> Self

Create encryption config from a raw key with a specific algorithm.

pub fn with_algorithm(self, algorithm: EncryptionAlgorithm) -> Self

Change the algorithm while keeping the same key.

pub fn algorithm(&self) -> EncryptionAlgorithm

Get the configured algorithm.

pub fn encrypt(&self, plaintext: &[u8]) -> DbxResult<Vec<u8>>

Encrypt a plaintext byte slice.

Returns [nonce (12 bytes)] || [ciphertext + auth_tag].

A fresh random nonce is generated for each call, making it safe to encrypt the same plaintext multiple times.

pub fn decrypt(&self, encrypted: &[u8]) -> DbxResult<Vec<u8>>

Decrypt an encrypted byte slice.

Expects [nonce (12 bytes)] || [ciphertext + auth_tag] format (as produced by encrypt).

Returns the original plaintext, or an error if:

• Data is too short (less than nonce size)
• Authentication fails (data tampered)
• Wrong key used

pub fn encrypt_with_aad( &self, plaintext: &[u8], aad: &[u8], ) -> DbxResult<Vec<u8>>

Encrypt data with Associated Data (AAD).

AAD is authenticated but not encrypted — useful for metadata like table names or column IDs that should be verified but remain readable.

pub fn decrypt_with_aad( &self, encrypted: &[u8], aad: &[u8], ) -> DbxResult<Vec<u8>>

Decrypt data with Associated Data (AAD).

The AAD must match exactly what was used during encryption, otherwise authentication will fail.

Trait Implementations

impl Clone for EncryptionConfig

fn clone(&self) -> EncryptionConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for EncryptionConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.