Struct ClusterDek 

pub struct ClusterDek { /* private fields */ }

The cluster-wide DEK. 32 bytes of key material.

Held in Zeroizing memory; zeroed on drop. The type does NOT implement Debug / Display to keep accidental disclosure off the table.

Implementations

impl ClusterDek

pub fn generate() -> Self

Generate a fresh DEK from the operating system RNG.

Panics

Panics if the OS random number generator fails.

pub fn from_bytes(bytes: [u8; 32]) -> Self

Construct from raw bytes (e.g. after unwrapping). Bytes are copied into the zeroized buffer; the source is left untouched.

pub fn wrap( &self, recipient: &RecipientPublicKey, ) -> Result<Vec<u8>, SecretsError>

Sealed-box-wrap this DEK to a single recipient.

Returns the raw libsodium sealed-box ciphertext bytes (ephemeral_pubkey || box(dek)), suitable for direct insertion into WrappedDek::wraps.

Errors

Returns SecretsError::Encryption if the sealed-box construction fails.

pub fn rewrap_for_set( &self, recipients: &HashMap<String, RecipientPublicKey>, new_generation: u64, ) -> Result<WrappedDek, SecretsError>

Sealed-box-wrap this DEK to every recipient in a node-id-keyed map and produce a WrappedDek envelope ready to commit through Raft.

Errors

Returns SecretsError::Encryption if any per-recipient wrap fails.

pub fn unwrap( node_priv: &RecipientPrivateKey, wrapped: &[u8], ) -> Result<Self, SecretsError>

Unwrap a sealed-box-encrypted DEK using a node’s X25519 private key.

Errors

Returns SecretsError::Decryption if the sealed-box ciphertext fails authentication, is malformed, or does not decode to exactly 32 bytes of key material.

pub fn encrypt(&self, plaintext: &[u8]) -> Result<Vec<u8>, SecretsError>

Encrypt a plaintext payload under the DEK using XChaCha20-Poly1305. On-wire format: [24-byte nonce][ciphertext + tag].

Errors

Returns SecretsError::Encryption if cipher construction or the AEAD encryption itself fails.

Panics

Panics if the OS random number generator fails to produce nonce bytes.

pub fn decrypt(&self, blob: &[u8]) -> Result<Zeroizing<Vec<u8>>, SecretsError>

Decrypt the inverse of Self::encrypt.

Returns the plaintext wrapped in Zeroizing so it is scrubbed from memory when the caller drops it.

Errors

Returns SecretsError::Decryption if:

• blob is shorter than NONCE_SIZE.
• Cipher construction fails.
• AEAD authentication or decryption fails.