Function encrypt_segment_envelope

nodedb-wal/src/crypto.rs:395–408

Encrypt `plaintext` into a self-describing segment envelope. Returns `preamble || AES-256-GCM(plaintext) || auth_tag`. The caller supplies the 4-byte `magic` that identifies its envelope variant (`SEGA`, `SEGC`, `SEGT`, `SEGV`, …).

(
    key: &WalEncryptionKey,
    magic: &[u8; 4],
    plaintext: &[u8],
)

/// supplies the 4-byte `magic` that identifies its envelope variant
/// (`SEGA`, `SEGC`, `SEGT`, `SEGV`, …).
pub fn encrypt_segment_envelope(
    key: &WalEncryptionKey,
    magic: &[u8; 4],
    plaintext: &[u8],
) -> Result<Vec<u8>> {
    let fresh_key = key.with_fresh_epoch()?;
    let epoch = *fresh_key.epoch();
    let preamble = encode_envelope_preamble(magic, &epoch);
    let ciphertext = fresh_key.encrypt_aad(SEGMENT_ENVELOPE_NONCE_LSN, &preamble, plaintext)?;
    let mut out = Vec::with_capacity(SEGMENT_ENVELOPE_PREAMBLE_SIZE + ciphertext.len());
    out.extend_from_slice(&preamble);
    out.extend_from_slice(&ciphertext);
    Ok(out)
}

/// Decrypt a segment envelope produced by [`encrypt_segment_envelope`].
///