Function seal 

pub fn seal<T, K>(
    value: &T,
    key: Option<K>,
) -> Result<Vec<u8>, SerializationError>
where
    T: Encode,
    K: AsRef<str>,

Encode value to an authenticated, encrypted byte blob sealed with key.

Encryption uses ChaCha20-Poly1305 (IETF) with a freshly generated 12-byte random nonce prepended to the output. Every call produces a different ciphertext even for the same plaintext and key.

If key is None the default key "serialization/deserialization" is used. String literals (Some("key")) and owned Strings are both accepted. The resulting blob can only be decoded by open with the same key.

Errors

Returns SerializationError::Encode if bincode cannot serialise the value.

Examples found in repository

examples/seal_open.rs (line 42)

fn main() {
    let key = "my-secret-key";

    let original = Payload {
        user:  "alice".into(),
        score: 9001,
        tags:  vec!["rust".into(), "crypto".into()],
    };

    println!("Original : {original:?}");

    // ── Seal ──────────────────────────────────────────────────────────────────
    // String literals and &str both work; K: AsRef<str> handles the conversion.
    let blob = seal(&original, Some(key)).expect("seal failed");
    println!("Sealed   : {} bytes  (nonce ‖ ciphertext ‖ Poly1305 tag)", blob.len());

    // ── Semantic security ─────────────────────────────────────────────────────
    // A fresh random 12-byte nonce is generated on every seal call, so identical
    // plaintext + key still produces a different ciphertext each time.
    let blob2 = seal(&original, Some(key)).expect("seal failed");
    assert_ne!(blob, blob2, "ciphertexts should differ (different nonces)");
    println!("Semantic security   : two seals of the same value differ ✓");

    // ── Open ──────────────────────────────────────────────────────────────────
    // Reconstructs Payload from the opaque blob using the same key.
    let recovered: Payload = open(&blob, Some(key)).expect("open failed");
    println!("Recovered: {recovered:?}");

    assert_eq!(original, recovered, "round-trip mismatch!");
    println!("\nRound-trip successful ✓");

    // ── Wrong key rejects ─────────────────────────────────────────────────────
    let bad: Result<Payload, _> = open(&blob, Some("wrong-key"));
    assert!(bad.is_err(), "wrong key should fail to open");
    println!("Wrong-key rejection ✓");

    // ── Default key ───────────────────────────────────────────────────────────
    // Pass None::<&str> to use the built-in default key.
    let blob3 = seal(&original, None::<&str>).expect("seal with default key failed");
    let back3: Payload = open(&blob3, None::<&str>).expect("open with default key failed");
    assert_eq!(original, back3);
    println!("Default-key round-trip ✓");
}