streaming_crypto/core_api/headers/
mod.rs

1// # Rust headers module layout
2
3// Below are production-ready files for src/headers/, designed to be the single source of truth for our envelope header. 
4// They include explicit enums, constants, types, encoding/decoding helpers, validation, and tests. 
5// The header is 80 bytes, fixed-length, future-proof, and aligned with industry practices (AAD binding, key ID, salt, algorithm profile, flags, strategy).
6
7// ## src/headers/mod.rs
8
9//! headers/mod.rs
10//! Public module export for the streaming envelope headers.
11//!
12//! Industry notes:
13//! - Fixed-size header (80 bytes) enables deterministic IO and simple embedding.
14//! - Explicit IDs (cipher, PRF, compression, strategy) avoid silent incompatibilities.
15//! - Key ID and salt align with HSM/KMS practices: stream points to key version, secrets stay external.
16//! - Flags declare presence of optional metadata (totals, CRC, terminator/digest frames).
17//! - AAD domain binds header semantics into per-frame AEAD AAD, preventing cross-protocol confusion.
18
19pub mod types;
20pub mod encode;
21pub mod decode;
22
23pub use types::*;
24pub use encode::*;
25pub use decode::*;
26
27// ## Implementation notes
28// - Endianness: Little-endian across all multi-byte integers; document this in our Python mirror when we clone the Rust project.
29// - Security: The header is authenticated indirectly via AAD in each frame; never trust header fields without AEAD verification. Flags only guide optional behavior.
30// - Extensibility: Use the reserved field for future additions (e.g., signing policy IDs, attestation markers). Bump version when semantics change.
31// - Parity: Keep these files authoritative. Bindings (Python, etc.) should import the constants and replicate binary layouts exactly.
streaming_crypto/core_api/headers/mod.rs

streaming_crypto/core_api/headers/
mod.rs
