Struct StorageEncryptionLayer 

pub struct StorageEncryptionLayer { /* private fields */ }

A pure-Rust encryption layer for block storage.

Manages a key store, an encrypted-block index, a bounded audit log, and exposes encrypt/decrypt/rotate/re-encrypt operations.

Implementations

impl StorageEncryptionLayer

pub fn new() -> Self

Create a new layer with default configuration and a randomly seeded PRNG.

pub fn with_config(config: SelEncryptionConfig) -> Self

Create a new layer with the given configuration.

pub fn generate_key(&mut self, seed: u64) -> KeyId

Generate a new key derived from seed via xorshift64 and add it to the key store. Returns the new KeyId.

pub fn set_active_key(&mut self, key_id: KeyId) -> Result<(), SelError>

Set the active key. Returns an error if key_id is not in the store.

pub fn rotate_key(&mut self, seed: u64) -> KeyId

Generate a new key (from seed) and make it active. The old key remains in the store so existing encrypted blocks can still be decrypted. Returns the new KeyId.

pub fn active_key_id(&self) -> Result<KeyId, SelError>

Return the active KeyId, or an error if none is set.

pub fn get_key(&self, key_id: &KeyId) -> Option<&SelEncryptionKey>

Look up a key by ID.

pub fn encrypt_block( &mut self, cid: BlockCid, plaintext: &[u8], ) -> Result<Vec<u8>, SelError>

Encrypt a block identified by cid.

Stores a record in the encrypted block index so that decrypt_block can look up the key and nonce by CID.

pub fn decrypt_block( &mut self, cid: BlockCid, ciphertext: &[u8], ) -> Result<Vec<u8>, SelError>

Decrypt a block identified by cid.

Looks up the key and nonce from the block index.

pub fn encrypt_batch( &mut self, blocks: &[(BlockCid, Vec<u8>)], ) -> Vec<Result<Vec<u8>, SelError>>

Encrypt multiple blocks in one call. Each entry returns independently; a failure on one block does not abort the rest.

pub fn re_encrypt( &mut self, cid: BlockCid, ciphertext: &[u8], new_key_id: KeyId, ) -> Result<Vec<u8>, SelError>

Re-encrypt a block with a different key.

Decrypts with the key stored in the index, then re-encrypts with new_key_id and updates the index entry.

pub fn verify_mac(&mut self, cid: BlockCid, data: &[u8]) -> bool

Verify a simple FNV-1a-based MAC for a block.

The expected MAC is computed as fnv1a_64(cid || data) and compared against the FNV-1a hash of the block index entry’s encrypted CID. Returns true if and only if the MACs match.

pub fn encryption_stats(&self) -> SelEncryptionStats

Return current aggregate statistics (snapshot).

pub fn audit_log(&self) -> &VecDeque<EncAuditEntry>

Return a reference to the full audit log.

pub fn block_index(&self) -> &HashMap<BlockCid, SelEncryptedBlockRecord>

Return a reference to the block index.

pub fn key_count(&self) -> usize

Return the number of keys in the key store.

pub fn cipher(&self) -> SelCipher

Return the cipher configured for this layer.

pub fn remove_block(&mut self, cid: &BlockCid) -> bool

Remove the block index entry for cid, if present. Returns true if an entry was removed.

pub fn delete_key(&mut self, key_id: KeyId) -> Result<(), SelError>

Delete a key from the store. Active key is cleared if it matches. Returns an error if the key is not found.

pub fn list_key_ids(&self) -> Vec<KeyId>

List all key IDs in the store.

pub fn clear_audit_log(&mut self)

Clear the audit log.

Trait Implementations

impl Default for StorageEncryptionLayer

fn default() -> Self

Returns the “default value” for a type.