Struct LuksVolume 

pub struct LuksVolume;

Namespace for opening a LUKS volume. State lives in DecryptedPayload.

Implementations

impl LuksVolume

pub fn unlock_with_passphrase<R: Read + Seek>( reader: R, passphrase: &[u8], ) -> Result<DecryptedPayload<R>>

Unlock a LUKS1 or LUKS2 container, auto-detecting the version from the header.

Errors

See Self::unlock1_with_passphrase / Self::unlock2_with_passphrase.

pub fn unlock_with_passphrase_within<R: Read + Seek>( reader: R, passphrase: &[u8], budget: Duration, ) -> Result<DecryptedPayload<R>>

Self::unlock_with_passphrase against an explicit TOTAL budget.

The auto-detecting entry point carries the budget too, because the callers that do not know a container’s version up front — the VFS layer, the fuzz target, a triage sweep over an image — are exactly the ones that must not silently lose the bound at the version dispatch.

Errors

LuksError::UnlockBudgetExceeded when the total runs out, plus everything Self::unlock_with_passphrase returns.

pub fn unlock1_with_passphrase_within<R: Read + Seek>( reader: R, passphrase: &[u8], budget: Duration, ) -> Result<DecryptedPayload<R>>

Self::unlock1_with_passphrase against an explicit TOTAL budget.

The budget spans every keyslot the unlock tries, not each derivation. A forensic caller working through a large image may want a tighter bound than the default; a crafted header cannot exceed whichever is given.

Errors

LuksError::UnlockBudgetExceeded when the total runs out, plus everything Self::unlock1_with_passphrase returns.

pub fn unlock1_with_passphrase<R: Read + Seek>( reader: R, passphrase: &[u8], ) -> Result<DecryptedPayload<R>>

Unlock a LUKS1 container from reader with passphrase.

Errors

Header-parse errors, LuksError::NoActiveKeyslot, or LuksError::AuthenticationFailed on a wrong passphrase.

pub fn unlock2_with_passphrase_within<R: Read + Seek>( reader: R, passphrase: &[u8], budget: Duration, ) -> Result<DecryptedPayload<R>>

Self::unlock2_with_passphrase against an explicit TOTAL budget.

Same bound as the LUKS1 twin, and needed for the same reason: recover_master_key2 derives once per keyslot plus once per digest that references it, over a slot count and per-slot cost the header chooses.

Errors

LuksError::UnlockBudgetExceeded when the total runs out, plus everything Self::unlock2_with_passphrase returns.

pub fn unlock2_with_passphrase<R: Read + Seek>( reader: R, passphrase: &[u8], ) -> Result<DecryptedPayload<R>>

Unlock a LUKS2 container from reader with passphrase.

Errors

Header/JSON-parse errors, LuksError::NoActiveKeyslot if there is no crypt segment or keyslot, or LuksError::AuthenticationFailed.