Struct FieldEncryption

pub struct FieldEncryption { /* private fields */ }

Main encryption service for field-level encryption

Implementations

impl FieldEncryption

pub fn new() -> Result<Self, EncryptionError>

Creates a new FieldEncryption instance using a key from environment variables

Environment Variables

• STORAGE_ENCRYPTION_KEY: Base64-encoded 32-byte encryption key

pub fn new_with_key(key: &[u8; 32]) -> Result<Self, EncryptionError>

Creates a new FieldEncryption instance with a provided key (for testing)

pub fn encrypt( &self, plaintext: &[u8], ) -> Result<EncryptedData, EncryptionError>

Encrypts plaintext data and returns an EncryptedData structure

pub fn decrypt( &self, encrypted_data: &EncryptedData, ) -> Result<Vec<u8>, EncryptionError>

Decrypts an EncryptedData structure and returns the plaintext (v1, no AAD)

pub fn encrypt_with_aad( &self, plaintext: &[u8], aad: &[u8], ) -> Result<EncryptedData, EncryptionError>

Encrypts plaintext data with AAD and returns an EncryptedData structure (version 2)

AAD (Additional Authenticated Data) binds the ciphertext to a specific context, preventing ciphertext swap attacks where encrypted data could be moved between different storage locations.

pub fn decrypt_with_aad( &self, encrypted_data: &EncryptedData, aad: &[u8], ) -> Result<Vec<u8>, EncryptionError>

Decrypts an EncryptedData structure with AAD and returns the plaintext (version 2)

The AAD must match what was used during encryption, otherwise decryption will fail. This prevents ciphertext swap attacks.

pub fn decrypt_auto( &self, encrypted_data: &EncryptedData, aad: Option<&[u8]>, ) -> Result<Vec<u8>, EncryptionError>

Auto-detect version and decrypt accordingly

• Version 1: Decrypts without AAD (legacy)
• Version 2: Decrypts with AAD (requires aad parameter)

This enables backwards compatibility with existing v1 encrypted data while supporting the new v2 format with AAD.

pub fn encrypt_string(&self, plaintext: &str) -> Result<String, EncryptionError>

Encrypts a string and returns base64-encoded encrypted data (opaque format)

pub fn decrypt_string( &self, encrypted_base64: &str, ) -> Result<String, EncryptionError>

Decrypts a base64-encoded encrypted string

pub fn generate_key() -> String

Utility function to generate a new encryption key for setup

pub fn is_configured() -> bool

Checks if encryption is properly configured

Trait Implementations

impl Clone for FieldEncryption

fn clone(&self) -> FieldEncryption

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.