Struct AesGcmCipher 

pub struct AesGcmCipher { /* private fields */ }

Available on crate feature encryption only.

AES-256-GCM cipher with a random 12-byte nonce prepended to each ciphertext.

The on-disk payload format is: [12-byte nonce][ciphertext + 16-byte GCM tag]. This is byte-compatible with monitor365’s EncryptionKey segment format, so existing encrypted segments can be read without migration. (The segment file envelope, if present, is stripped before the cipher sees the bytes.)

Implementations

impl AesGcmCipher

pub fn from_slice(key_bytes: &[u8]) -> Result<Self, CipherError>

Create a new cipher from a 32-byte AES-256 key.

Example

use segment_buffer::AesGcmCipher;

let key = [0u8; 32];
let _cipher = AesGcmCipher::from_slice(&key).unwrap();

Errors

Returns CipherError if the key length is not 32 bytes.

pub fn new(key_bytes: &[u8; 32]) -> Self

Create a new cipher from a 32-byte AES-256 key (const-sized input).

Example

use segment_buffer::AesGcmCipher;
use segment_buffer::SegmentCipher;

let cipher = AesGcmCipher::new(&[0u8; 32]);
let ciphertext = cipher.encrypt(b"hello").unwrap();
let plaintext = cipher.decrypt(&ciphertext).unwrap();
assert_eq!(plaintext, b"hello");

Panics

Never in practice — a 32-byte key is always valid for AES-256. The internal .expect() is a defense-in-depth assertion against a future logic bug (e.g. a key-type change); callers passing a correctly-sized key will never hit it.

Trait Implementations

impl SegmentCipher for AesGcmCipher

fn encrypt(&self, plaintext: &[u8]) -> Result<Vec<u8>, CipherError>

Encrypt plaintext, returning self-describing ciphertext.

fn decrypt(&self, ciphertext: &[u8]) -> Result<Vec<u8>, CipherError>

Decrypt previously-produced ciphertext back to the original plaintext.