Struct CryptoSession 

pub struct CryptoSession { /* private fields */ }

Unified crypto session — works with any supported cipher suite.

Drop-in replacement for AesSession with auto cipher selection. Unified crypto session — works with any supported cipher suite.

Drop-in replacement for AesSession with auto cipher selection.

Implementations

impl CryptoSession

pub fn from_shared_secret(shared_secret: &[u8; 32]) -> Result<Self, CoreError>

Auto-detect best cipher and create session from shared secret. Initiator side.

pub fn from_shared_secret_peer( shared_secret: &[u8; 32], ) -> Result<Self, CoreError>

Auto-detect, peer (responder) side — keys swapped.

pub fn with_suite( shared_secret: &[u8; 32], suite: CipherSuite, ) -> Result<Self, CoreError>

Create with explicit cipher suite (for negotiation scenarios). Initiator side.

Under --features fips, requesting CipherSuite::ChaCha20Poly1305 returns CoreError::CipherSuiteUnavailable — the wire-format variant is preserved (enum stable across feature configurations) but the primitive is not FIPS-approved.

pub fn with_suite_peer( shared_secret: &[u8; 32], suite: CipherSuite, ) -> Result<Self, CoreError>

Create with explicit cipher suite. Peer side.

Mirrors the fips guard of Self::with_suite.

pub fn cipher_suite(&self) -> CipherSuite

Which cipher suite is active

pub fn encrypt_in_place( &self, aad: &[u8], buf: &mut Vec<u8>, ) -> Result<(), CryptoError>

Encrypt in place: appends 16-byte tag.

pub fn encrypt_in_place_offset( &self, aad: &[u8], buf: &mut Vec<u8>, offset: usize, ) -> Result<usize, CryptoError>

Encrypt in place with offset: leaves offset bytes untouched at the start (for prepending frame headers). Encrypts buf[offset..] in place, appends tag. Returns ciphertext length (data + tag).

pub fn encrypt( &self, aad: &[u8], plaintext: &[u8], ) -> Result<Vec<u8>, CryptoError>

Encrypt: allocates a new Vec.

pub fn decrypt_in_place<'a>( &self, aad: &[u8], buf: &'a mut [u8], ) -> Result<&'a mut [u8], CryptoError>

Decrypt in place: verifies tag and returns plaintext slice.

pub fn send_invocations(&self) -> u64

Number of encryptions performed on this session (per-direction send counter). Useful for emitting aead_invocations_total metrics and for rekey-trigger logic when mid-session key rotation lands.

pub fn recv_invocations(&self) -> u64

Number of decryptions performed on this session (per-direction recv counter).

pub fn decrypt( &self, aad: &[u8], ciphertext: &[u8], ) -> Result<Vec<u8>, CryptoError>

Decrypt: allocates a new Vec.

pub fn encrypt_with_nonce( &self, nonce_bytes: [u8; 12], aad: &[u8], plaintext: &[u8], ) -> Result<Vec<u8>, CryptoError>

Encrypt with an explicit caller-supplied nonce. The caller MUST ensure uniqueness of (key, nonce) — the V2 path derives the nonce from (nonce_prefix, epoch, stream_id, sequence) so uniqueness follows from the wire-format invariant that sender never reuses (stream_id, sequence) within an epoch.

pub fn decrypt_with_nonce( &self, nonce_bytes: [u8; 12], aad: &[u8], ciphertext: &[u8], ) -> Result<Vec<u8>, CryptoError>

Decrypt with an explicit caller-supplied nonce. Unlike Self::decrypt, a tag-check failure does NOT advance the internal counter — only the bounded telemetry counter increments.

pub fn nonce_prefix(&self) -> [u8; 4]

Expose the 4-byte nonce prefix for the V2 nonce construction (prefix || epoch || stream_id_be || sequence_be).

Trait Implementations

impl Clone for CryptoSession

fn clone(&self) -> CryptoSession

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.