#[repr(u8)]pub enum AeadAlg {
XChaCha20Poly1305 = 1,
Aes256Gcm = 2,
Aes256GcmSiv = 3,
}Expand description
Algorithm identifiers covered by the header signature.
Agility uses explicit numbers rather than “the current best choice” because the KEM will change during the product’s lifetime: X25519 will give way to an ML-KEM hybrid, and slots using different KEMs must coexist in one file.
Variants§
XChaCha20Poly1305 = 1
Primary profile. A 192-bit nonce allows storing a random nonce.
Aes256Gcm = 2
Profile for FIPS requirements. A 96-bit nonce requires a counter and makes the container effectively write-once.
Aes256GcmSiv = 3
Nonce-reuse-resistant variant.
This used to say “for editable files”, which was a promise, not a
description: editable files use aead_id = 1, like all
others. The property SIV was meant to provide comes from plaintext-hedged
nonces (aead::seal_chunk_hedged), introduced after
the promise itself and making the second profile unnecessary. See
docs/format.md §6.1.
The member remains to prevent assigning number 3 to another cipher.
Implementations§
Source§impl AeadAlg
impl AeadAlg
Sourcepub fn from_u8(v: u8) -> Result<Self, CryptoError>
pub fn from_u8(v: u8) -> Result<Self, CryptoError>
Parse an identifier from a file. Unknown values cause rejection, not substitution of a default.
Parsing immediately passes the second boundary, aead::ensure_supported,
just as TreeHashAlg::from_u8 already does. The asymmetry was
substantive: a header with aead_id = 2 passed signature verification, slot parsing,
key agreement, and CEK unwrapping before failing on the first chunk. All
that work was done on a file already known, at parsing time,
to be impossible to open.