Module crypto

Structs§

ThrottledReporter: A reporter that only forwards materially different updates.

CHUNK_SIZE: 1 MB chunks — balances memory usage vs per-chunk overhead.
EXTENSION
HEADER_LEN
HEADER_V3_LEN: V3 header: 8 (magic) + 16 (salt) + 7 (stream_nonce) = 31 bytes.
HEADER_V4_LEN: V4 reuses the V3 header layout: 8 (magic) + 16 (salt) + 7 (stream_nonce) = 31 bytes.
MAGIC
MAGIC_V3: VAULTX03 file header layout (31 bytes total):
MAGIC_V4
MAX_ENCRYPTED_FILE_SIZE
MAX_FILE_SIZE
MAX_V3_FILE_SIZE: EncryptorBE32 uses a 4-byte (32-bit) counter, so the maximum number of intermediate chunks is 2^32. At 1 MiB per chunk, the maximum safe file size before counter wraparound is 2^32 * 1 MiB = 2^52 bytes = 4 PiB. Encrypting a file larger than this would cause counter wraparound, reusing (key, nonce, counter) triples and catastrophically breaking GCM-SIV confidentiality and integrity.
MAX_V4_FILE_SIZE: V4 file-size limit is the same as V3 (same BE32 counter constraint).
MIN_PASSWORD_LEN: Minimum passphrase length for security.
NONCE_LEN
SALT_LEN
SALT_V3_LEN: 16-byte salt — 128-bit entropy, recommended minimum for Argon2.
STREAM_NONCE_LEN: EncryptorBE32 uses 5 bytes of the 12-byte nonce (4-byte counter + 1-byte flag).
TAG_LEN

ProgressReporter: Receives best-effort progress updates from long-running crypto operations.

decrypt_bytes
decrypt_file
decrypt_stream: Stream-decrypt from any reader to any writer. Used by the CLI for stdin/stdout piping. Does not create temp files or handle renaming.
default_decrypt_output_name: Return the default decrypted output file name for path.
default_encrypt_output_name: Return the default encrypted output file name for path.
encrypt_bytes
encrypt_file
encrypt_stream: Stream-encrypt from any reader to any writer. Used by the CLI for stdin/stdout piping. Does not create temp files or handle renaming.
parse_header
secure_wipe: Attempts a 3-pass random overwrite, rename, and deletion of path.