Struct TenantKeyedCrypter 

#[non_exhaustive]
pub struct TenantKeyedCrypter { /* private fields */ }

Tenant-keyed AES-256-GCM Crypter. Looks up the current tenant’s key via KeyProvider and encrypts / decrypts under it.

Wire format (v0.6)

nonce[12] || aad_len_u16_le || aad[aad_len] || ct_and_tag

AAD = tenant_bytes || version_byte. The AEAD tag covers the AAD so cross-tenant and wrong-key-version decryptions fail at tag verification. The version byte lives solely inside the AAD trailing byte; there is no redundant leading prefix byte (removed in v0.6).

Implementations

impl TenantKeyedCrypter

pub fn new(keys: Arc<dyn KeyProvider>) -> Self

Build with the provided KeyProvider.

Trait Implementations

impl Crypter for TenantKeyedCrypter

fn encrypt<'life0, 'life1, 'async_trait>( &'life0 self, plaintext: &'life1 [u8], ) -> Pin<Box<dyn Future<Output = Result<Vec<u8>, CrypterError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Encrypt plaintext. The returned bytes carry whatever framing the impl needs for later decryption (e.g. nonce prefix).

fn decrypt<'life0, 'life1, 'async_trait>( &'life0 self, ciphertext: &'life1 [u8], ) -> Pin<Box<dyn Future<Output = Result<Vec<u8>, CrypterError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Decrypt ciphertext previously produced by Crypter::encrypt.