arsenal-crypto · envelope
Declared module signatures, types, configuration, and source documentation.
Source: arsenal/crates/arsenal-crypto/src/envelope.rs. SHA-256: 2ba8cd6bce3f4c7a97f86fab89bb693cfde4907fb8e79f3e3c7f664161551604.
This source reference follows declared modules and preserves feature attributes. It includes public declarations and implementation methods in those modules. Private-module exports and trait resolution still require the compiler; not every declaration is a crate-root import. Function bodies and constant values are omitted. Source comments describe their implementation context and are not a production deployment claim.
envelope::WrappedKey
A wrapped key (DEK encrypted with KEK)
#[derive(Clone, Serialize, Deserialize)]
pub struct WrappedKey {
/// The encrypted DEK
pub encrypted_dek: EncryptedData,
/// Identifier of the KEK used
pub kek_id: String,
/// Algorithm used for the DEK
pub dek_algorithm: EncryptionAlgorithm,
/// When this wrapped key was created
pub created_at: chrono::DateTime<chrono::Utc>,
/// When this wrapped key expires
pub expires_at: chrono::DateTime<chrono::Utc>
}Source line: 44.
envelope::WrappedKey::is_expired
Check if this wrapped key has expired
#[must_use]
pub fn is_expired(&self) -> bool;Source line: 60.
envelope::EnvelopeEncryption
Envelope encryption for protecting secrets
pub struct EnvelopeEncryption {
}Source line: 76.
envelope::EnvelopeEncryption::new
Create a new envelope encryption instance
#[must_use]
pub fn new(kek: SymmetricKey, kek_id: impl Into<String>) -> Self;Source line: 88.
envelope::EnvelopeEncryption::with_ttl
Create with a specific TTL
#[must_use]
pub fn with_ttl(mut self, ttl_seconds: i64) -> Self;Source line: 98.
envelope::EnvelopeEncryption::kek_id
Get the KEK ID
#[must_use]
pub fn kek_id(&self) -> &str;Source line: 105.
envelope::EnvelopeEncryption::encrypt
Encrypt data using envelope encryption
Errors
Returns an error if encryption fails
pub fn encrypt(&self, plaintext: &[u8]) -> ArsenalResult<EnvelopeEncryptedData>;Source line: 113.
envelope::EnvelopeEncryption::encrypt_with_aad
Encrypt data with associated data (AEAD)
Errors
Returns an error if encryption fails
pub fn encrypt_with_aad(
&self,
plaintext: &[u8],
aad: &[u8],
) -> ArsenalResult<EnvelopeEncryptedData>;Source line: 134.
envelope::EnvelopeEncryption::decrypt
Decrypt envelope-encrypted data
Errors
Returns an error if decryption fails
pub fn decrypt(&self, envelope: &EnvelopeEncryptedData) -> ArsenalResult<Vec<u8>>;Source line: 155.
envelope::EnvelopeEncryption::decrypt_with_aad
Decrypt with associated data verification
Errors
Returns an error if decryption fails or AAD doesn't match
pub fn decrypt_with_aad(
&self,
envelope: &EnvelopeEncryptedData,
aad: &[u8],
) -> ArsenalResult<Vec<u8>>;Source line: 176.
envelope::EnvelopeEncryption::rewrap_key
Re-wrap a key with a new KEK (for key rotation)
Errors
Returns an error if re-wrapping fails
pub fn rewrap_key(
&self,
wrapped: &WrappedKey,
new_kek: &EnvelopeEncryption,
) -> ArsenalResult<WrappedKey>;Source line: 236.
envelope::EnvelopeEncryptedData
Data encrypted using envelope encryption
#[derive(Clone, Serialize, Deserialize)]
pub struct EnvelopeEncryptedData {
/// The wrapped DEK
pub wrapped_key: WrappedKey,
/// The encrypted data
pub encrypted_data: EncryptedData
}Source line: 257.
envelope::SessionSecretWrapper
Session-bound secret wrapping
Wraps secrets for delivery to a specific session, ensuring the secret can only be unwrapped within that session.
pub struct SessionSecretWrapper {
}Source line: 277.
envelope::SessionSecretWrapper::new
Create a new session secret wrapper
#[must_use]
pub fn new(session_secret: &[u8; 32], session_id: impl Into<String> + Clone) -> Self;Source line: 287.
envelope::SessionSecretWrapper::wrap
Wrap a secret for this session
Errors
Returns an error if wrapping fails
pub fn wrap(&self, secret: &[u8], ttl_seconds: i64) -> ArsenalResult<SessionWrappedSecret>;Source line: 302.
envelope::SessionSecretWrapper::unwrap
Unwrap a secret
Errors
Returns an error if unwrapping fails
pub fn unwrap(&self, wrapped: &SessionWrappedSecret) -> ArsenalResult<Vec<u8>>;Source line: 322.
envelope::SessionWrappedSecret
A secret wrapped for a specific session
#[derive(Clone, Serialize, Deserialize)]
pub struct SessionWrappedSecret {
}Source line: 361.
envelope::SessionWrappedSecret::is_expired
Check if expired
#[must_use]
pub fn is_expired(&self) -> bool;Source line: 375.
envelope::SessionWrappedSecret::session_id
Get the session ID
#[must_use]
pub fn session_id(&self) -> &str;Source line: 381.
envelope::HybridEncryption
Hybrid encryption using X25519 + XChaCha20-Poly1305
Used for encrypting data to a recipient's public key.
pub struct HybridEncryption;Source line: 398.
envelope::HybridEncryption::encrypt_to
Encrypt data to a recipient's public key
Errors
Returns an error if encryption fails
pub fn encrypt_to(
recipient_public_key: &[u8; 32],
plaintext: &[u8],
) -> ArsenalResult<HybridEncryptedData>;Source line: 405.
envelope::HybridEncryption::decrypt_with
Decrypt data using recipient's private key
Errors
Returns an error if decryption fails
pub fn decrypt_with(
recipient_key_pair: &EncryptionKeyPair,
encrypted: &HybridEncryptedData,
) -> ArsenalResult<Vec<u8>>;Source line: 433.
envelope::HybridEncryptedData
Data encrypted using hybrid encryption
#[derive(Clone, Serialize, Deserialize)]
pub struct HybridEncryptedData {
/// Ephemeral public key
pub ephemeral_public_key: [u8; 32],
/// The encrypted data
pub encrypted: EncryptedData
}Source line: 453.