Struct Aead 

pub struct Aead(/* private fields */);

An aead.aead-key: caller-nonce authenticated encryption with associated data.

Nonce reuse under one key is catastrophic, and this type’s seal leaves nonce uniqueness entirely to you: use a deterministic per-key uniqueness scheme (such as a counter).

Implementations

impl Aead

pub fn from_raw(raw: AeadKey) -> Self

Wrap a raw aead-key resource.

pub fn as_raw(&self) -> &AeadKey

Borrow the raw aead-key resource.

pub fn into_raw(self) -> AeadKey

Unwrap into the raw aead-key resource.

impl Aead

pub fn seal<'a>( &'a self, nonce: impl Into<Cow<'a, [u8]>>, aad: impl Into<Cow<'a, [u8]>>, plaintext: impl Into<DataSource<'a>>, ) -> Seal<'a>

Encrypt and authenticate plaintext under nonce and aad, yielding the ciphertext followed by the authentication tag.

Returns a Seal, which starts the operation when awaited.

The caller is responsible for nonce uniqueness per key. Reusing a nonce under one key defeats the algorithm’s confidentiality and authenticity guarantees.

pub fn seal_with_tag_size<'a>( &'a self, nonce: impl Into<Cow<'a, [u8]>>, aad: impl Into<Cow<'a, [u8]>>, tag_size: u8, plaintext: impl Into<DataSource<'a>>, ) -> Seal<'a>

seal with an explicit tag size in bytes, for algorithms whose tag size is a per-call parameter (AES-GCM’s set is 4, 8, 12, 13, 14, 15, or 16; other algorithms fix 16). Short tags weaken the forgery bound; prefer seal, which uses the algorithm default (tag_size).

pub async fn open( &self, nonce: impl Into<Cow<'_, [u8]>>, aad: impl Into<Cow<'_, [u8]>>, ciphertext: impl Into<DataSource<'_>>, ) -> Result<StreamReader<u8>, Error>

Decrypt and verify ciphertext (ciphertext followed by tag, as produced by seal) under nonce and aad.

The stream is handed back only after the whole input is consumed and the tag verified: Ok is the authentication statement, and unverified plaintext is never observable. Fails closed with Error::AuthenticationFailed if verification fails.

pub async fn open_with_tag_size( &self, nonce: impl Into<Cow<'_, [u8]>>, aad: impl Into<Cow<'_, [u8]>>, tag_size: u8, ciphertext: impl Into<DataSource<'_>>, ) -> Result<StreamReader<u8>, Error>

open with an explicit tag size in bytes (the size the message was sealed with — see seal_with_tag_size).

pub fn algorithm_name(&self) -> String

The name of the key’s algorithm family, e.g. "AES-GCM" — WebCrypto’s KeyAlgorithm.name, spelled as the W3C Web Cryptography API algorithm registry spells it.

pub fn algorithm_length(&self) -> u32

The key length in bits, e.g. 256 for AES-256-GCM (WebCrypto’s AesKeyAlgorithm.length).

pub fn nonce_size(&self) -> u32

The algorithm’s standard nonce size in bytes, e.g. 12 for AES-GCM — always accepted by seal/open. Whether other lengths are accepted is the algorithm’s contract (AES-GCM accepts 12 to 128 bytes inclusive).

pub fn tag_size(&self) -> u32

The size in bytes of the tag trailing the ciphertext, e.g. 16 — for framing arithmetic (sealed length = plaintext length + tag_size).

pub fn extractable(&self) -> bool

Whether export_key_raw may return the key material (see Mac::extractable).

pub fn can_seal(&self) -> bool

Whether the key permits seal — the usage recorded at mint. A refused operation fails Error::NotPermitted.

pub fn can_open(&self) -> bool

Whether the key permits open. See can_seal.

pub fn can_wrap(&self) -> bool

Whether the key permits wrap.

pub fn can_unwrap(&self) -> bool

Whether the key permits unwrap. See can_wrap.

pub async fn wrap( &self, nonce: impl Into<Vec<u8>>, aad: impl Into<Vec<u8>>, tag_size: Option<u8>, input: WrapInput, ) -> Result<Vec<u8>, Error>

Encrypt and authenticate serialized key material under nonce with aad, exactly as seal encrypts a message (the WIT aead-key.wrap contract). Consumes the WrapInput.

pub async fn unwrap( &self, nonce: impl Into<Vec<u8>>, aad: impl Into<Vec<u8>>, tag_size: Option<u8>, wrapped: impl Into<Vec<u8>>, ) -> Result<UnwrapInput, Error>

Decrypt and verify wrapped key material into an UnwrapInput for a typed unwrap mint (the WIT aead-key.unwrap contract).

pub async fn to_wrap_input_raw(&self) -> Result<WrapInput, Error>

This key’s raw material as a WrapInput, behind the same extractability gate as export_key_raw.

pub async fn to_wrap_input_jwk(&self) -> Result<WrapInput, Error>

The JWK serialization as a WrapInput, behind the same gate.

pub async fn export_key_raw(&self) -> Result<Vec<u8>, Error>

The raw key material; fails with Error::NotExtractable unless the key was minted extractable (an API property, not a physical one — see Mac::export_key_raw).

pub async fn export_key_jwk(&self) -> Result<String, Error>

The key as an RFC 7517 oct JSON Web Key (JSON text), behind the same extractability gate as export_key_raw. Algorithms with no registered JWK form fail Error::Unsupported.

Trait Implementations

impl Debug for Aead

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl From<AeadKey> for Aead

fn from(raw: AeadKey) -> Self

Converts to this type from the input type.