Trait PayloadCipher 

pub trait PayloadCipher: Send + Sync {
    // Required methods
    fn seal(
        &self,
        plaintext: &[u8],
        aad: &PayloadAad,
    ) -> Result<Vec<u8>, CipherError>;
    fn open(
        &self,
        sealed: &[u8],
        aad: &PayloadAad,
    ) -> Result<Vec<u8>, CipherError>;
}

Encrypts and decrypts opaque journal payloads with an AEAD construction.

A PayloadCipher is the only component permitted to see plaintext payload bytes. It is injected into a backend as Option<Arc<dyn PayloadCipher>>: None disables encryption (a development override permitted only for a single-user local backend, see encryption_gate).

Contract for implementors

• seal MUST draw a fresh CSPRNG nonce for every call (INV-7) and emit the key_id(1) || nonce(24) || ciphertext || tag(16) layout.
• The aad MUST be authenticated via the AEAD’s associated-data channel (not merely prepended), so a tampered or relocated entry fails open.
• Neither method may panic on malformed input; corruption is reported as a CipherError.
• Implementations are Send + Sync so a single cipher can be shared across the writer and replay tasks behind an Arc.

Examples

A minimal (insecure, illustrative) implementation that shows the layout discipline a real cipher must follow:

use std::sync::Arc;
use zeph_durable::cipher::{CipherError, PayloadAad, PayloadCipher};

struct Identity;
impl PayloadCipher for Identity {
    fn seal(&self, plaintext: &[u8], _aad: &PayloadAad) -> Result<Vec<u8>, CipherError> {
        Ok(plaintext.to_vec()) // a real cipher would AEAD-encrypt here
    }
    fn open(&self, sealed: &[u8], _aad: &PayloadAad) -> Result<Vec<u8>, CipherError> {
        Ok(sealed.to_vec())
    }
}

let cipher: Arc<dyn PayloadCipher> = Arc::new(Identity);
assert!(cipher.seal(b"hello", &PayloadAad::detached()).is_ok());

Required Methods

fn seal( &self, plaintext: &[u8], aad: &PayloadAad, ) -> Result<Vec<u8>, CipherError>

Seal plaintext under aad, returning the stored blob (key_id || nonce || ciphertext || tag).

Errors

Returns CipherError::Authentication if the underlying AEAD encryption fails (an unexpected condition for a correctly-sized key and nonce).

fn open(&self, sealed: &[u8], aad: &PayloadAad) -> Result<Vec<u8>, CipherError>

Open a blob previously produced by seal, verifying aad.

Errors

• CipherError::Authentication if the tag does not verify under aad — the entry was forged, moved to a different step, or replayed under a different execution.
• CipherError::Malformed if the blob is too short to contain the framing.
• CipherError::UnknownKeyId if the leading key-id selects no registered key.

Dyn Compatibility

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors