Struct EncryptionService 

pub struct EncryptionService { /* private fields */ }

Manages encryption keys and provides XChaCha20-Poly1305 encryption/decryption

This implements the security model described in the README:

• Files are encrypted using XChaCha20-Poly1305 for authenticated encryption
• Chunked format enables random-access decryption for efficient range reads

Implementations

impl EncryptionService

pub fn new(stored_key: &str) -> Result<Self, EncryptionError>

Create an encryption service from a serialized keyring.

pub fn from_key(key: [u8; 32]) -> Self

Create a new encryption service from a raw 32-byte key.

pub fn from_key_at_generation(generation: u64, key: [u8; 32]) -> Self

pub fn from_keyring( keys: impl IntoIterator<Item = (u64, [u8; 32])>, ) -> Result<Self, EncryptionError>

pub fn current_generation(&self) -> u64

pub fn key_count(&self) -> usize

How many keys this keyring holds. Two keys at the same generation count as two — the count grows only when a genuinely new key is folded in.

pub fn keyring_entries(&self) -> Vec<(u64, [u8; 32])>

pub fn merged_with( &self, other: &EncryptionService, ) -> Result<EncryptionService, EncryptionError>

Union this keyring with other: every distinct key either holds. Identical entries deduplicate. The same fingerprint naming different key bytes or generations is invalid rather than silently choosing one entry.

pub fn to_keyring_string(&self) -> Result<String, EncryptionError>

pub fn to_keyring_payload(&self) -> Result<Vec<u8>, EncryptionError>

pub fn from_keyring_payload(plaintext: Vec<u8>) -> Result<Self, EncryptionError>

pub fn service_for_fingerprint( &self, fingerprint: &[u8; 32], ) -> Result<EncryptionService, EncryptionError>

pub fn with_appended_generation( &self, generation: u64, key: [u8; 32], ) -> Result<EncryptionService, EncryptionError>

pub fn fingerprint(&self) -> String

Full SHA-256 fingerprint of the seal key, hex-encoded.

pub fn seal_fingerprint(&self) -> [u8; 32]

The seal key’s full SHA-256 fingerprint — what a sealed object records so a later read resolves the exact key, whatever the keyring has become.

pub fn seal_key_fingerprint(&self) -> KeyFingerprint

pub fn key_bytes(&self) -> [u8; 32]

Return the raw 32-byte seal key.

pub fn encrypt(&self, plaintext: &[u8], aad_context: &[u8]) -> Vec<u8>

Seal plaintext whole, under a fresh random base nonce this build stores in the header. The one format: a payload read whole and a blob read by range differ only in where their base nonce comes from.

pub fn decrypt( &self, encrypted_data: &[u8], aad_context: &[u8], ) -> Result<Vec<u8>, EncryptionError>

Open a payload Self::encrypt sealed, reading it whole.

pub fn blob_sealer( &self, header: SealedBlobHeader, policy: &NoncePolicy, aad_context: &[u8], ) -> Result<SealedBlobSealer, SealedBlobError>

A sealer for one payload, framed by header and based on policy. The header travels in the clear ahead of the chunks; every chunk’s AAD binds the header, the payload’s context, and the chunk index.

pub fn blob_opener( &self, header: SealedBlobHeader, policy: &NoncePolicy, aad_context: &[u8], ) -> Result<SealedBlobOpener, SealedBlobError>

The opener for a payload whose header has been read. Random access: any chunk opens without the ones before it.

pub fn derive_scoped(&self, scope_id: &str) -> EncryptionService

Derive a scoped encryption service.

Uses HKDF: master_key + “coven-scope-v1:{scope_id}” -> 32-byte key. Deterministic: same master + scope_id always gives the same key.

pub fn derive_scoped_for_fingerprint( &self, fingerprint: &[u8; 32], scope_id: &str, ) -> Result<EncryptionService, EncryptionError>

pub fn seal_app_data(&self, plaintext: &[u8], aad: &[u8]) -> Vec<u8>

Seal plaintext for storage in a host’s own rows, under this keyring’s seal key: a KeyTag naming that key, then the chunked ciphertext encrypt produces under it.

aad binds the ciphertext to its context (the owning row’s primary key, say) and must be presented unchanged to open it.

The body is the existing chunked format, so a large payload streams the same way a blob does; there is no size cliff and no second cipher.

pub fn open_app_data( &self, sealed: &[u8], aad: &[u8], ) -> Result<Vec<u8>, SealError>

Open a payload Self::seal_app_data produced, under whichever key it names — so a keyring that has rotated or merged a fork since still opens everything it sealed before. A version this build does not read, or a key this keyring does not hold, is a typed error; a wrong aad or a tampered payload surfaces the AEAD failure through SealError::Crypto.

Trait Implementations

impl Clone for EncryptionService

fn clone(&self) -> EncryptionService

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for EncryptionService

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl From<EncryptionService> for MasterKeyring

fn from(service: EncryptionService) -> Self

Converts to this type from the input type.

impl From<MasterKeyring> for EncryptionService

fn from(keyring: MasterKeyring) -> Self

Converts to this type from the input type.