Module crypto 

Structs

CipherOptions

Options for Database::open — key material and how reads behave when a value was written with a key that is not among them. Mirrors the TS CipherOptions.

FieldCipher

Encrypts and decrypts the fields a schema marks cypher, so their values never reach the disk in the clear.

PasswordCheck

The answer of [verify_password]: whether the candidate matches, and whether the stored hash was made with other parameters than the handle’s current ones (so a successful login is a good moment to write the password again).

PasswordHashParams

Argon2id cost of the hashes a handle writes. The default is the OWASP minimum profile (19 MiB, 2 passes, one lane); a weak device may lower it, a server may raise it. A stored hash keeps the parameters it was made with, so changing these never invalidates one — it only makes PasswordCheck::needs_rehash true for the older ones.

Enums

MissingKeyPolicy

What a read does when the key a stored value was written with is not on hand.

Functions

cypher_fields_of

The names of the fields a schema marks cypher, sorted.

is_envelope