Source: arsenal/crates/arsenal-store/src/key_wrapper.rs. SHA-256: dfd726b12e16e9c9fe04621c2784e80f7aa16ac08a0076fe2817c195ca0b6259.

This source reference follows declared modules and preserves feature attributes. It includes public declarations and implementation methods in those modules. Private-module exports and trait resolution still require the compiler; not every declaration is a crate-root import. Function bodies and constant values are omitted. Source comments describe their implementation context and are not a production deployment claim.

key_wrapper::KeyWrapper

Trait for key wrapping operations

Implementations can use software encryption, HSM, KMS, etc.

pub trait KeyWrapper: Send + Sync {
    /// Wrap a key
    fn wrap<'a>(
        &'a self,
        key_id: &'a str,
        plaintext_key: &'a [u8],
    ) -> Pin<Box<dyn Future<Output = Result<WrappedKeyData, SecretStoreError>> + Send + 'a>>;

    /// Unwrap a key
    fn unwrap<'a>(
        &'a self,
        wrapped: &'a WrappedKeyData,
    ) -> Pin<Box<dyn Future<Output = Result<Vec<u8>, SecretStoreError>> + Send + 'a>>;

    /// Get the wrapper's key ID
    fn key_id(&self) -> &str;

    /// Check if this wrapper can unwrap data wrapped by the given key ID
    fn can_unwrap(&self, key_id: &str) -> bool ;
}

Source line: 21.

key_wrapper::WrappedKeyData

Wrapped key data

#[derive(Clone, serde::Serialize, serde::Deserialize)]
pub struct WrappedKeyData {
/// The encrypted key

pub ciphertext: Vec<u8>,
/// Nonce used for encryption

pub nonce: Vec<u8>,
/// ID of the wrapping key

pub wrapper_key_id: String,
/// Algorithm used

pub algorithm: String
}

Source line: 46.

key_wrapper::SoftwareKeyWrapper

Software-based key wrapper using XChaCha20-Poly1305

pub struct SoftwareKeyWrapper {

}

Source line: 68.

key_wrapper::SoftwareKeyWrapper::new

Create a new software key wrapper

pub fn new(kek_bytes: [u8; 32], key_id: impl Into<String>) -> Self;

Source line: 77.

key_wrapper::SoftwareKeyWrapper::generate

Create with a randomly generated KEK

Errors

Returns an error if random generation fails

pub fn generate(key_id: impl Into<String>) -> Result<Self, SecretStoreError>;

Source line: 88.

key_wrapper::SoftwareKeyWrapper::export_kek

Export the KEK (for backup - handle with extreme care!)

#[must_use]
pub fn export_kek(&self) -> [u8; 32];

Source line: 95.

key_wrapper::MultiKeyWrapper

Multi-key wrapper that supports multiple KEKs for rotation

pub struct MultiKeyWrapper {

}

Source line: 148.

key_wrapper::MultiKeyWrapper::new

Create a new multi-key wrapper

pub fn new(current: Arc<dyn KeyWrapper>) -> Self;

Source line: 157.

key_wrapper::MultiKeyWrapper::add_previous

Add a previous wrapper (for key rotation)

pub fn add_previous(&mut self, wrapper: Arc<dyn KeyWrapper>);

Source line: 165.

key_wrapper::MultiKeyWrapper::rotate

Rotate to a new primary wrapper

pub fn rotate(&mut self, new_wrapper: Arc<dyn KeyWrapper>);

Source line: 170.

key_wrapper::MultiKeyWrapper::current_key_id

Get the current wrapper's key ID

#[must_use]
pub fn current_key_id(&self) -> &str;

Source line: 182.

key_wrapper::DerivedKeyWrapper

Derived key wrapper that derives KEKs from a master key

pub struct DerivedKeyWrapper {

}

Source line: 231.

key_wrapper::DerivedKeyWrapper::new

Create a new derived key wrapper

pub fn new(master_key: [u8; 32], key_id_prefix: impl Into<String>) -> Self;

Source line: 240.

arsenal-store · key_wrapper