Struct Shield 

pub struct Shield { /* private fields */ }

EXPTIME-secure symmetric encryption.

Uses password-derived keys with PBKDF2 and encrypts using a SHA256-based stream cipher with HMAC-SHA256 authentication. Breaking requires 2^256 operations - no shortcut exists.

Key material is securely zeroized from memory when dropped.

Implementations

impl Shield

pub fn new(password: &str, service: &str) -> Self

Create a new Shield instance from password and service name.

Arguments

• password - User’s password
• service - Service identifier (e.g., “github.com”)

Example

use shield_core::Shield;
let shield = Shield::new("my_password", "example.com");

pub fn with_key(key: [u8; 32]) -> Self

Create Shield with a pre-shared key (no password derivation).

pub fn encrypt(&self, plaintext: &[u8]) -> Result<Vec<u8>>

Encrypt data.

Returns: nonce(16) || ciphertext || mac(16)

Errors

Returns error if random generation fails.

pub fn encrypt_with_key(key: &[u8; 32], plaintext: &[u8]) -> Result<Vec<u8>>

Encrypt with explicit key.

pub fn decrypt(&self, encrypted: &[u8]) -> Result<Vec<u8>>

Decrypt and verify data.

Errors

Returns error if MAC verification fails or ciphertext is malformed.

pub fn decrypt_with_key(key: &[u8; 32], encrypted: &[u8]) -> Result<Vec<u8>>

Decrypt with explicit key.

pub fn key(&self) -> &[u8; 32]

Get the derived key (for testing/debugging).

Trait Implementations

impl Drop for Shield

fn drop(&mut self)

Executes the destructor for this type.

impl Zeroize for Shield

fn zeroize(&mut self)

Zero out this object from memory using Rust intrinsics which ensure the zeroization operation is not “optimized away” by the compiler.