Struct MultiKeyDecryptor 

pub struct MultiKeyDecryptor { /* private fields */ }

An AeadDecryptor that holds multiple keys and applies CipherMatch / KeyMatchStrength selection semantics.

This is the cipher analogue of MultiKeyVerifier.

Key selection

cipher_match follows KeyMatchStrength priority:

• A ByKeyId match (algorithm + kid) is definitive.
• A single ByAlgorithm match is used directly.

decrypt uses the optional CipherMatch to select the correct key when available. When no CipherMatch is provided, keys are tried in order.

Unlike MultiKeyVerifier, which fails closed on ambiguity, trying every candidate is safe here: an AEAD tag self-authenticates, so a wrong key fails decryption rather than risking wrong-key acceptance. Try-all is standard practice for rotated symmetric keys (e.g. cookie-key rotation).

Errors

When no candidate matches the criteria, decryption fails with DecryptError::NoMatchingKey without attempting decryption — this is what lets RetryingDecryptor trigger a key refresh. When candidates were attempted and all failed, the last real failure is returned (non-retryable preferred over retryable), matching the verifier’s dispatch discipline.

Implementations

impl MultiKeyDecryptor

pub fn new(decryptors: Vec<Arc<dyn AeadDecryptor>>) -> Self

Creates a new MultiKeyDecryptor from the given decryptors.

Trait Implementations

impl AeadDecryptor for MultiKeyDecryptor

fn cipher_match(&self, m: &CipherMatch<'_>) -> Option<KeyMatchStrength>

Returns how well this decryptor matches the given selection criteria.

fn decrypt<'a>( &'a self, cipher_match: Option<&'a CipherMatch<'a>>, nonce: &'a [u8], ciphertext: &'a [u8], tag: &'a [u8], aad: &'a [u8], ) -> MaybeSendBoxFuture<'a, Result<Vec<u8>, DecryptError>>

Asynchronously decrypts the given ciphertext with the provided nonce, tag, and associated data.

fn try_refresh(&self) -> MaybeSendBoxFuture<'_, bool>

Requests a best-effort refresh of the decryptor’s key material — the cipher analogue of JwsVerifier::try_refresh.

impl Debug for MultiKeyDecryptor

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.