Module stream 

Chunked (streaming) content encryption. Chunked (streaming) content encryption for the v3 format.

The content is a sequence of AEAD chunks of chunk_size plaintext bytes (the final chunk may be shorter, including empty). Each chunk’s 24-byte nonce is nonce_prefix (16) || counter (7, little endian) || final flag (1), and every chunk authenticates the header binding under the content domain. The counter makes reordering fail authentication, and the final flag makes truncation at a chunk boundary fail: the last present chunk was not sealed as final, so opening it as final does not authenticate.

An empty file is one final chunk with empty plaintext, so every content stream contains at least one chunk.

Structs

StreamOpener

Incremental decryption of one file’s content stream.

StreamSealer

Incremental encryption of one file’s content stream.

Constants

CHUNK_SIZE

Plaintext bytes per chunk written by this implementation. Reading accepts any chunk size the header declares, within the parse-time bound.

TAG_SIZE

AEAD authentication tag length appended to every chunk.