Method generate_dek

nodedb/src/control/security/encryption.rs:175–215

Generate a new random Data Encryption Key (DEK). Returns the raw DEK (for data encryption) and the encrypted DEK (for storage in the file header). The DEK is encrypted using AES-256-GCM with the master key for authenticated key wrapping.

(&self)

    /// (for storage in the file header). The DEK is encrypted using
    /// AES-256-GCM with the master key for authenticated key wrapping.
    pub fn generate_dek(&self) -> crate::Result<([u8; 32], Vec<u8>)> {
        let master = self
            .master_key
            .as_ref()
            .ok_or_else(|| crate::Error::Encryption {
                detail: "master key not loaded".into(),
            })?;

        let mut dek = [0u8; 32];
        getrandom::fill(&mut dek).map_err(|e| crate::Error::Encryption {
            detail: format!("failed to generate DEK: {e}"),
        })?;

        // Encrypt DEK with master key using AES-256-GCM (authenticated encryption).
        let mut nonce_bytes = [0u8; 12];
        getrandom::fill(&mut nonce_bytes).map_err(|e| crate::Error::Encryption {
            detail: format!("failed to generate nonce: {e}"),
        })?;

        let cipher = Aes256Gcm::new_from_slice(master).map_err(|e| crate::Error::Encryption {
            detail: format!("AES-GCM key init failed: {e}"),
        })?;
        let nonce = Nonce::from(nonce_bytes);

        let ciphertext =
            cipher
                .encrypt(&nonce, dek.as_ref())
                .map_err(|e| crate::Error::Encryption {
                    detail: format!("DEK encryption failed: {e}"),
                })?;

        // Prepend nonce to ciphertext for storage: [nonce:12B][ciphertext+tag]
        let mut encrypted_dek = Vec::with_capacity(12 + ciphertext.len());
        encrypted_dek.extend_from_slice(&nonce_bytes);
        encrypted_dek.extend_from_slice(&ciphertext);

        self.files_encrypted
            .fetch_add(1, std::sync::atomic::Ordering::Relaxed);

        Ok((dek, encrypted_dek))
    }

    /// Decrypt a DEK from a file header using the master key.
    ///