Struct FieldKey 

pub struct FieldKey(/* private fields */);

A key for encrypting a specific field, derived from a tenant key.

Field keys are derived deterministically from the parent key and field name, enabling key hierarchy without storing additional key material.

Security

• Each field gets a unique derived key
• Compromise of one field key doesn’t expose other fields
• Keys are derived using HKDF-like construction with SHA-256

Implementations

impl FieldKey

pub fn from_bytes(bytes: &[u8; 32]) -> FieldKey

Restores a field key from its byte representation.

Use this to restore a field key from secure storage.

pub fn as_bytes(&self) -> &[u8; 32]

Returns the key as a byte slice.

pub fn derive(parent_key: &EncryptionKey, field_name: &str) -> FieldKey

Derives a field key from a parent key and field name.

The derivation is deterministic: the same parent key and field name always produce the same field key.

Arguments

• parent_key - The tenant’s encryption key
• field_name - The name of the field (e.g., patient_ssn)

Security

• Uses HKDF-like construction with SHA-256
• Field names should be consistent across the application
• Consider prefixing field names with schema version for rotation

Trait Implementations

impl Debug for FieldKey

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Drop for FieldKey

fn drop(&mut self)

Executes the destructor for this type.

impl Zeroize for FieldKey

fn zeroize(&mut self)

Zero out this object from memory using Rust intrinsics which ensure the zeroization operation is not “optimized away” by the compiler.