Struct FileKeyProvider 

pub struct FileKeyProvider { /* private fields */ }

File-based key provider for development and testing.

Keys are stored in the filesystem with the following structure:

keys/
├── kek_v1.key      (32 bytes, 0600 permissions)
├── kek_v2.key      (32 bytes, 0600 permissions)
├── current -> kek_v2.key  (symlink to active KEK)
└── pepper.key      (32 bytes, 0600 permissions)

Example

use sifredb_key_file::FileKeyProvider;
use sifredb::key_provider::KeyProvider;

// Initialize a new key directory
FileKeyProvider::init("./keys").expect("Failed to initialize keys");

// Load the provider
let provider = FileKeyProvider::new("./keys").expect("Failed to load provider");

// Use the provider
let kek_id = provider.current_kek_id().expect("No active KEK");

Implementations

impl FileKeyProvider

pub fn new(key_dir: impl Into<PathBuf>) -> Result<Self, KeyProviderError>

Creates a new FileKeyProvider from an existing key directory.

Arguments

• key_dir - Directory containing key files

Errors

Returns error if:

• Directory doesn’t exist
• No current KEK symlink exists
• File permissions are incorrect (Unix only)

pub fn init(key_dir: impl Into<PathBuf>) -> Result<(), KeyProviderError>

Initializes a new key directory with a fresh KEK and pepper.

This creates:

• A new KEK (kek_v1.key)
• A symlink pointing to the current KEK
• A pepper for blind indexes

Errors

Returns error if directory creation or key generation fails.

Trait Implementations

impl KeyProvider for FileKeyProvider

fn create_kek(&self) -> Result<String, KeyProviderError>

Creates a new Key Encryption Key (KEK) and returns its identifier.

fn current_kek_id(&self) -> Result<String, KeyProviderError>

Returns the identifier of the current (active) KEK.

fn wrap_dek( &self, kek_id: &str, dek: &[u8], ) -> Result<Vec<u8>, KeyProviderError>

Wraps (encrypts) a Data Encryption Key (DEK) with the specified KEK.

fn unwrap_dek( &self, kek_id: &str, wrapped_dek: &[u8], ) -> Result<SecretVec<u8>, KeyProviderError>

Unwraps (decrypts) a Data Encryption Key (DEK) using the specified KEK.

fn get_pepper(&self) -> Result<Option<SecretVec<u8>>, KeyProviderError>

Returns the pepper value for blind index generation.