Struct WrappedDek 

pub struct WrappedDek {
    pub key_id: String,
    pub ciphertext: Vec<u8>,
}

Wrapped DEK as stored in the S4E4 frame.

key_id identifies which KEK in the backend was used to wrap ciphertext. Both fields are AAD-authenticated by the outer AES-GCM tag in the S4E4 frame, so an attacker can’t substitute a different key_id to make the gateway try a different KEK.

Fields

key_id: String

KEK identifier, caller-meaningful. For LocalKms this is the basename of the .kek file (without extension); for [aws::AwsKms] it is the KMS key ARN or alias.

ciphertext: Vec<u8>

Encrypted DEK bytes. Format is backend-defined — for LocalKms it is nonce(12) || ciphertext(32) || tag(16); for AWS KMS it is the opaque blob returned by GenerateDataKey.

Trait Implementations

impl Clone for WrappedDek

fn clone(&self) -> WrappedDek

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for WrappedDek

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for WrappedDek

fn eq(&self, other: &WrappedDek) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Eq for WrappedDek

impl StructuralPartialEq for WrappedDek