Struct EncryptorHandle 

pub struct EncryptorHandle { /* private fields */ }

Handle to an encryption backend. Supports per-label multi-key operations. Obtained from create_encryptor().

Implementations

impl EncryptorHandle

pub fn generate_key(&self, label: &str, policy: AccessPolicy) -> Result<Vec<u8>>

Generate a new P-256 encryption key with the given label and policy. Returns the uncompressed SEC1 public key (0x04 || X || Y, 65 bytes).

pub fn public_key(&self, label: &str) -> Result<Vec<u8>>

Return the uncompressed SEC1 public key for an existing encryption key.

pub fn encrypt(&self, label: &str, plaintext: &[u8]) -> Result<Vec<u8>>

ECIES encrypt plaintext using the named key.

Wire format: [0x01 version][65B ephemeral pubkey][12B nonce][ciphertext][16B GCM tag].

Errors

• Error::KeyNotFound if no key with this label exists.
• Error::AuthDenied if the keychain ACL denies access to the wrapping key.
• Error::AuthRequired if the device is locked or the GUI session is absent.
• Error::UserCancelled if the user dismissed a biometric prompt.
• Error::EncryptFailed for underlying hardware or crypto failures.

pub fn decrypt( &self, label: &str, ciphertext: &[u8], ) -> Result<Zeroizing<Vec<u8>>>

ECIES decrypt ciphertext using the named key.

Returns plaintext in a Zeroizing wrapper that scrubs the buffer on drop.

Errors

• Error::KeyNotFound if no key with this label exists.
• Error::AuthDenied if the keychain ACL denies access to the wrapping key.
• Error::AuthRequired if the device is locked or the GUI session is absent.
• Error::UserCancelled if the user dismissed a biometric prompt.
• Error::DecryptFailed if the ciphertext is corrupt or has been tampered with.

pub fn list_keys(&self) -> Result<Vec<KeyInfo>>

List all encryption keys managed by this backend.

For each label, fetches the public key. Labels whose public key cannot be retrieved (transient error, key deleted between list and fetch) are silently skipped.

pub fn delete_key(&self, label: &str) -> Result<()>

Delete the encryption key with the given label.

pub fn key_exists(&self, label: &str) -> Result<bool>

Return whether an encryption key with the given label exists.

pub fn rename_key(&self, old_label: &str, new_label: &str) -> Result<()>

Rename (move) an encryption key from old_label to new_label.

pub fn backend_kind(&self) -> BackendKind

Which backend is in use.

Trait Implementations

impl Debug for EncryptorHandle

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.