Struct DataKey 

pub struct DataKey { /* private fields */ }

A content-encryption key in the two forms envelope encryption needs.

The plaintext is for the caller to encrypt with and drop. The wrapped copy is what the container carries, and only the key-encryption key that produced it opens that again.

This is what every key-protection device offers instead of a cipher: AWS KMS calls it GenerateDataKey, PKCS#11 reaches it with C_GenerateKey followed by C_WrapKey. The content never crosses the boundary, so a device that protects a key it will not export does not also have to be fast enough to encrypt a file.

Implementations

impl DataKey

pub fn new( plaintext: Zeroizing<Vec<u8>>, wrapped: Vec<u8>, protection: KeyProtection, ) -> Self

Pair a fresh data key with the copy its protector can open, and with what protected it.

pub fn plaintext(&self) -> &[u8]

The key itself, to encrypt content with.

pub fn wrapped(&self) -> &[u8]

The same key, protected. This is what goes into the container.

pub fn protection(&self) -> KeyProtection

What protected it, which is what a container has to declare and what opening it again needs.

Trait Implementations

impl Debug for DataKey

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Names the shape and never the key. A data key is a secret with a short life, and a debug print is the way such a thing ends up in a log.