Struct Aes256GcmAead 

pub struct Aes256GcmAead { /* private fields */ }

AES-256-GCM in the pre-rotation layout: nonce || ciphertext || tag, with no key id. Retained because it is what every value written before 1.0 looks like, and KeyRing still reads that form — new deployments should use KeyRing, which is what the server wires up.

Implementations

impl Aes256GcmAead

pub fn new(key: &[u8; 32]) -> Self

Trait Implementations

impl Aead for Aes256GcmAead

fn seal(&self, plaintext: &[u8]) -> Result<Vec<u8>, CryptoError>

fn open(&self, blob: &[u8]) -> Result<Vec<u8>, CryptoError>

fn is_current(&self, _blob: &[u8]) -> bool

Whether this blob is already sealed under the key seal would use. Rewrapping asks this so it can skip values that need no work; a single-key implementation has nothing to rotate to, hence the default.

fn active_key_id(&self) -> String

A short, stable label for the key seal is using, so an operator can confirm which key a replica actually holds.