Struct EncryptionAtRest 

pub struct EncryptionAtRest { /* private fields */ }

Encryption at rest

Implementations

impl EncryptionAtRest

pub fn new() -> Self

pub fn initialize(&mut self) -> Result<(), CryptographicError>

pub fn encrypt_key_data( &self, plaintext: &[u8], ) -> Result<Vec<u8>, CryptographicError>

Encrypt key data using the master KEK via AES-256-GCM. Returns (ciphertext, nonce, tag) tuple flattened into a single Vec with layout: [12-byte nonce | 16-byte tag | ciphertext].

pub fn decrypt_key_data( &self, packed: &[u8], ) -> Result<Vec<u8>, CryptographicError>

Decrypt key data previously encrypted with encrypt_key_data.

pub fn is_enabled(&self) -> bool

Check if encryption at rest is enabled (KEK exists).

pub fn kek_count(&self) -> usize

Number of registered KEKs.

pub fn encryption_algorithm(&self) -> &EncryptionAlgorithm

Get the encryption algorithm used at rest.

pub fn set_encryption_algorithm(&mut self, algorithm: EncryptionAlgorithm)

Set the encryption algorithm used at rest.

pub fn encryption_policy(&self) -> &EncryptionPolicy

Get the encryption policy governing encryption at rest.

pub fn set_encryption_policy(&mut self, policy: EncryptionPolicy)

Set the encryption policy governing encryption at rest.