Struct DecryptionContext 

pub struct DecryptionContext { /* private fields */ }

TLS record decryption context.

Holds the AEAD key material and provides methods to decrypt TLS records.

Implementations

impl DecryptionContext

pub fn new_tls12( keys: &Tls12KeyMaterial, algorithm: AeadAlgorithm, direction: Direction, ) -> Result<Self, DecryptionError>

Create a new decryption context for TLS 1.2.

For TLS 1.2 with AEAD:

• The nonce is: implicit_iv (4 bytes) || explicit_nonce (8 bytes from record)
• The explicit_nonce is typically the sequence number

pub fn new_tls13( keys: &Tls13KeyMaterial, algorithm: AeadAlgorithm, ) -> Result<Self, DecryptionError>

Create a new decryption context for TLS 1.3.

For TLS 1.3:

• The nonce is: iv XOR padded_sequence_number
• The IV is derived from the traffic secret via HKDF-Expand-Label

pub fn new( algorithm: AeadAlgorithm, key: &[u8], iv: &[u8], ) -> Result<Self, DecryptionError>

Create a new decryption context from raw key material.

pub fn sequence_number(&self) -> u64

Get the current sequence number.

pub fn set_sequence_number(&mut self, seq: u64)

Set the sequence number (useful for resuming mid-stream).

pub fn decrypt_tls12_record( &mut self, record_type: u8, version: u16, ciphertext: &[u8], ) -> Result<Vec<u8>, DecryptionError>

Decrypt a TLS 1.2 AEAD record in place.

For TLS 1.2 AEAD ciphers:

• Record format: explicit_nonce (8 bytes) || ciphertext || tag (16 bytes)
• Nonce = implicit_iv (4 bytes) || explicit_nonce (8 bytes)
• AAD = seq_num (8 bytes) || type (1) || version (2) || length (2)

Returns the decrypted plaintext.

pub fn decrypt_tls13_record( &mut self, ciphertext: &[u8], record_header: &[u8; 5], ) -> Result<Vec<u8>, DecryptionError>

Decrypt a TLS 1.3 AEAD record in place.

For TLS 1.3:

• Record format: ciphertext || tag (16 bytes)
• Nonce = iv XOR padded_sequence_number
• AAD = record_header (type || legacy_version || length)
• Inner plaintext ends with content_type byte

Returns the decrypted plaintext (including inner content type).

pub fn decrypt_record( &mut self, tls_version: TlsVersion, record_type: u8, protocol_version: u16, ciphertext: &[u8], ) -> Result<Vec<u8>, DecryptionError>

Decrypt a TLS record, auto-detecting the version from context.

This is a convenience wrapper that routes to the appropriate decryption method based on TLS version.