Struct EncryptionKey 

pub struct EncryptionKey(/* private fields */);

An AES-256-GCM encryption key (256 bits).

This is secret key material that must be protected. Use EncryptionKey::generate to create a new random key, or EncryptionKey::from_bytes to restore from secure storage.

Key material is securely zeroed from memory when dropped via ZeroizeOnDrop.

Security

• Never log or expose the key bytes
• Store encrypted at rest (wrap with a KEK from the key hierarchy)
• Use one key per tenant/segment for isolation

Implementations

impl EncryptionKey

pub fn from_bytes(bytes: &[u8; 32]) -> Self

Restores an encryption key from its 32-byte representation.

Security

Only use bytes from a previously generated key or a secure KDF.

pub fn to_bytes(&self) -> [u8; 32]

Returns the raw 32-byte key material.

Security

Handle with care — this is secret key material.

pub fn generate() -> Self

Generates a new random encryption key using the OS CSPRNG.

This is the imperative shell - it handles IO (randomness) and delegates to a pure internal constructor for the actual construction.

Panics

Panics if the OS CSPRNG fails (catastrophic system error).

Trait Implementations

impl Drop for EncryptionKey

fn drop(&mut self)

Executes the destructor for this type.

impl Zeroize for EncryptionKey

fn zeroize(&mut self)

Zero out this object from memory using Rust intrinsics which ensure the zeroization operation is not “optimized away” by the compiler.