Struct EncryptionEngine 

pub struct EncryptionEngine { /* private fields */ }

Data-at-rest encryption engine.

Wraps AES-256-GCM-SIV with random nonces. Thread-safe (the cipher is Send + Sync and nonce generation uses OS randomness).

Implementations

impl EncryptionEngine

pub fn new(key: &[u8; 32]) -> Self

Create an encryption engine with the given 256-bit key.

The key must be exactly 32 bytes. Typically loaded from Kubernetes Secrets or the SOCHDB_ENCRYPTION_KEY env var.

pub fn disabled() -> Self

Create a disabled (passthrough) encryption engine.

encrypt() and decrypt() are identity operations when disabled.

pub fn is_enabled(&self) -> bool

Whether encryption is active.

pub fn encrypt(&self, plaintext: &[u8]) -> Result<Vec<u8>, EncryptionError>

Encrypt a plaintext block.

Returns [version(1) | nonce(12) | ciphertext+tag(N+16)].

Performance

~4 GB/s on x86_64 with AES-NI. The overhead is the 13-byte header plus 16-byte auth tag per block.

pub fn decrypt(&self, encrypted: &[u8]) -> Result<Vec<u8>, EncryptionError>

Decrypt an encrypted block produced by encrypt().

Validates the version byte and authentication tag.

pub fn encrypt_in_place( &self, buffer: &mut Vec<u8>, ) -> Result<(), EncryptionError>

Encrypt in-place for zero-copy WAL append.

Prepends the header to the buffer and encrypts the payload region. The buffer is resized to accommodate the header + auth tag.