pub fn wrap_key(
wrapping_key: &[u8; 32],
key_material: &[u8],
aad: &[u8],
) -> Result<Vec<u8>, SanctuaryAuditError>Expand description
Wrap key_material under wrapping_key (AEAD). Output: nonce(24) ‖ ciphertext ‖ tag(16).
Used for the one-way hierarchy: the real lane key wraps the decoy key + the audit secret.