Struct EmbedPipeline 

pub struct EmbedPipeline<KDF, AEAD, COST> { /* private fields */ }

The orchestrator of layers 1 to 4.

Generic over the three components that have a choice of implementation, so that a test can substitute a cheap key deriver or a stub cost model without any of the code below knowing. The production instantiation is built by EmbedPipeline::default_secure.

Implementations

impl<KDF, AEAD, COST> EmbedPipeline<KDF, AEAD, COST>

pub fn new(kdf: KDF, aead: AEAD, cost: COST) -> Self

Assembles a pipeline from its three components.

Unconstrained on purpose: the bounds belong on the operations, not on construction, so that a caller can hold a pipeline built from anything and only meet the requirements when it embeds or extracts.

impl EmbedPipeline<Argon2Kdf, XChaCha20Poly1305Cipher, HillCostProvider>

pub fn default_secure() -> Self

Builds the pipeline this project considers secure: Argon2id at 128 MiB and four passes, XChaCha20-Poly1305, and the HILL cost model.

There is no constructor that weakens any of the three. A pipeline whose components were chosen at run time would look identical at the API surface to this one and behave nothing like it.

impl<KDF, AEAD, COST> EmbedPipeline<KDF, AEAD, COST>

where KDF: KeyDeriver, AEAD: AEADCipher, COST: CostProvider<Error = CostError>,

pub fn embed( &self, image_path: &Path, plaintext: Zeroizing<Vec<u8>>, password: Zeroizing<Vec<u8>>, output_path: &Path, ) -> Result<EmbedReport, PipelineError>

Hides plaintext in the container at image_path and writes the result to output_path.

Both secrets are taken by value in a Zeroizing wrapper: the pipeline becomes their owner and wipes them at the point in the chain where they stop being needed, which a borrow could not guarantee.

Errors

Returns a PipelineError wrapping the error of whichever layer refused the operation: an unusable container, an unstable perceptual hash, a smooth image, a payload that does not fit, a failure of the coder, or a file that could not be written.

pub fn extract( &self, stego_path: &Path, password: Zeroizing<Vec<u8>>, ) -> Result<(Zeroizing<Vec<u8>>, ExtractReport), PipelineError>

Recovers the message hidden in the stego image at stego_path.

Why extraction needs no cost map

STC decoding operates on the syndrome H x stego (mod 2) taken over all the positions of a region. The receiver does not need to know which pixels were modified, and there is no position list to transmit or store: it only has to reproduce the permutation, which follows from the same stc_seed derived from the same MasterKey derived from the same password and the same image. That is the whole reason the container carries no metadata at all — and the reason the expensive half of embedding, the HILL analysis, has no counterpart here.

Errors

Returns a PipelineError wrapping the error of whichever layer refused: an unusable file, a hash too unstable to reproduce, a coder failure, or AEADError::AuthenticationFailed — which collapses a wrong password, a wrong image and a damaged payload into one answer on purpose.