Skip to main content

KeyProvider

klieo_ops::crypter

Trait KeyProvider 

Source 
pub trait KeyProvider: Send + Sync {
    // Required method
    fn lookup(&self, tenant: &Option<TenantId>) -> Option<[u8; 32]>;

    // Provided method
    fn lookup_versioned(&self, tenant: &Option<TenantId>) -> Option<KeyMaterial> { ... }
}
Expand description

Resolve a tenant tag to an encryption key. Implementations include StaticKeyProvider (in-memory map for dev) and operator HSM-backed adapters.

Returning None from lookup is the crypto-shred signal: past ciphertext written under this tenant is now unreadable.

Required Methods§

Source

fn lookup(&self, tenant: &Option<TenantId>) -> Option<[u8; 32]>

Resolve the tenant to a 32-byte AES-256 key. None means “key destroyed or unconfigured” — TenantKeyedCrypter raises CrypterError::KeyDestroyed.

Provided Methods§

Source

fn lookup_versioned(&self, tenant: &Option<TenantId>) -> Option<KeyMaterial>

Versioned lookup. Returns key bytes and a monotonic version counter that will be embedded in the ciphertext AAD.

The default implementation delegates to lookup and reports version 0. Version-aware providers override this method to supply the current key version.

Dyn Compatibility§

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors§