Crate encipher 

A fast, allocation-conscious session-data cipher for Rust.

Every backend here is a standard, independently-audited AEAD construction — this crate’s own contribution is not a new algorithm, it is a safe, ergonomic, low-allocation interface around one: nonce handling, key formatting, token layout, and expiry all handled for the caller, so the only decision left to make is which backend fits the deployment target.

use encipher::{Encipher, Backend};

let cipher = Encipher::new(Some(42), None, Backend::Aes256Gcm).unwrap();

let token   = cipher.encrypt("{\"id\":1,\"username\":\"shaya\"}", None, None).unwrap();
let decoded = cipher.decrypt(&token).unwrap();

assert_eq!(decoded, "{\"id\":1,\"username\":\"shaya\"}");

Some(42) above is for the example’s sake only — see Encipher::new for what a real key needs to be.

Version 3.0 retains the 2.x token format and key derivation. When upgrading, replace Some(0) with None for no expiry and add a wildcard arm to exhaustive EncipherError matches. Existing 2.x tokens, including non-expiring tokens minted with Some(0), remain readable with the same key and backend. Tokens from the custom 0.x design remain incompatible; see CHANGELOG.md for migration details.

One thing you won’t find here: any notion of “revoke this one token”. Store the token string itself in a revocation list when a caller logs out. Random nonces make collisions unlikely, but do not guarantee uniqueness. This crate stops at proving a token is genuine and unexpired; what a wider session-management layer does with that fact is deliberately none of its business.

Structs

Encipher

A session-data cipher instance. Construct with Encipher::new; the backend is fixed for the instance’s lifetime and is never influenced by anything read from a token — only the code that built this instance decides which algorithm is in play.

Enums

Backend

Selects the internal encryption engine.

EncipherError

An operation failure. Matches must include a fallback for future variants.