Skip to main content

KeyRotation

secrets_core::barrier

Trait KeyRotation 

Source 
pub trait KeyRotation: Send + Sync {
    // Required methods
    fn rewrap_all<'life0, 'async_trait>(
        &'life0 self,
    ) -> Pin<Box<dyn Future<Output = StorageResult<RewrapReport>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait;
    fn active_key_id(&self) -> String;
}
Expand description

Re-encrypting the whole store under a new master key. Separate from StorageBackend because only the barrier knows about keys, and exposed as a trait so the server can hold it behind an Arc without naming the concrete backend.

Required Methods§

Source

fn rewrap_all<'life0, 'async_trait>( &'life0 self, ) -> Pin<Box<dyn Future<Output = StorageResult<RewrapReport>> + Send + 'async_trait>>
where Self: 'async_trait, 'life0: 'async_trait,

Rewraps every value not already sealed under the active key. Idempotent and safe to re-run: a second pass reports everything as unchanged.

Source

fn active_key_id(&self) -> String

The active key’s derived id, so an operator can confirm which key a replica is actually sealing with.

Dyn Compatibility§

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors§