Crate rainier_crypt 

rainier-crypt

Reversible encryption and message signing — one Crypt value covering both halves, rather than signing being spread across signed URLs and cookie integrity.

use rainier_crypt::{Encryption, Key, KeyRing};

let crypt = Encryption::from_keys(KeyRing::new(Key::generate()));

let sealed = crypt.encrypt("a card number")?;
assert_eq!(crypt.decrypt(&sealed)?, "a card number");

// Signed, not sealed: the value stays readable, but not writable.
let signed = crypt.sign("unsubscribe-42")?;
assert!(signed.starts_with("unsubscribe-42."));
assert_eq!(crypt.verify(&signed)?, "unsubscribe-42");

Encrypt or sign?

	Hidden	Tamper-evident	Use for
encrypt	yes	yes	anything the client must not read
sign	no	yes	anything the client may read but not change

Reach for signing when the value is not a secret. An unsubscribe link, a reset token, a “remember this choice” cookie — encrypting those makes them opaque in your own logs for no gain.

This is not password hashing

Passwords are hashed, never encrypted, and that lives in rainier-auth’s Hasher. If you can get the value back out, it is the wrong tool for a password — see the hashing docs.

Rotation is designed in

Every payload records which key produced it, and a KeyRing holds one current key plus any number of retired ones. Rotating is a deploy:

let crypt = Encryption::from_keys(
    KeyRing::new(Key::generate()).with_previous(retired),
);

// Written with the old key, still readable; anything new uses the new one.
assert_eq!(crypt.decrypt(&sealed)?, "old");

Retrofitting that is painful, which is why it is here from the first release rather than deferred until a key is known to have leaked.

Re-exports

pub use asymmetric::BoxKeyPair;

pub use asymmetric::BoxPublicKey;

pub use asymmetric::Ed25519Signer;

pub use asymmetric::SealedBox;

pub use asymmetric::SigningKeyPair;

pub use asymmetric::VerifyingPublicKey;

pub use cipher::Cipher;

pub use encrypter::AeadEncrypter;

pub use encrypter::Encrypter;

pub use encrypter::EncrypterExt;

pub use key::Key;

pub use key::KeyRing;

pub use key::KEY_LEN;

pub use php::CryptScheme;

pub use php::PhpEncrypter;

pub use signer::HmacSigner;

pub use signer::Signer;

pub use signer::SignerExt;

pub use url::UrlSigner;

Modules

asymmetric

Public-key cryptography: Ed25519 signatures and X25519 sealed boxes.

cipher

The symmetric AEAD algorithms, and the key derivation that feeds them.

encrypter

Authenticated encryption — the Encrypter port and its AEAD implementation.

key

Keys and the KeyRing that holds them.

php

Reading what a PHP application encrypted — PhpEncrypter.

signer

Message signing — the Signer port and its HMAC implementation.

url

Signed URLs — UrlSigner.

Structs

Encryption

The application’s encrypter and signer, as one container-storable value.