Struct EncryptionService 

pub struct EncryptionService { /* private fields */ }

Manages encryption keys and provides XChaCha20-Poly1305 encryption/decryption

This implements the security model described in the README:

• Files are encrypted using XChaCha20-Poly1305 for authenticated encryption
• Chunked format enables random-access decryption for efficient range reads

Implementations

impl EncryptionService

pub fn new(key_hex: &str) -> Result<Self, EncryptionError>

Create a new encryption service from a hex-encoded key string

pub fn from_key(key: [u8; 32]) -> Self

Create a new encryption service from a raw 32-byte key.

pub fn fingerprint(&self) -> String

SHA-256 fingerprint of the key, first 8 bytes hex-encoded (16 hex chars). Short enough to display in UI, long enough to detect wrong keys.

pub fn new_with_key(key_bytes: &[u8]) -> Self

Create an encryption service with a raw key (for testing)

pub fn key_bytes(&self) -> [u8; 32]

Return the raw 32-byte key.

pub fn encrypt(&self, plaintext: &[u8]) -> Vec<u8>

Encrypt data using chunked XChaCha20-Poly1305 format. Returns: [base_nonce: 24 bytes][ciphertext with auth tags] For small data (single chunk), this is equivalent to standard AEAD. For large data, each chunk is independently encrypted for random-access.

pub fn decrypt(&self, encrypted_data: &[u8]) -> Result<Vec<u8>, EncryptionError>

Decrypt data in chunked format: [nonce (24 bytes)][ciphertext chunks…]

pub fn encrypt_chunked(&self, plaintext: &[u8]) -> Vec<u8>

Encrypt data using chunked XChaCha20-Poly1305 format. Returns: [base_nonce: 24 bytes][chunk_0][chunk_1]... Each chunk is independently encrypted, enabling random-access decryption.

pub fn decrypt_chunk( &self, ciphertext: &[u8], chunk_index: usize, ) -> Result<Vec<u8>, EncryptionError>

Decrypt a specific chunk from chunked encrypted data. Enables random-access decryption without reading preceding chunks.

pub fn decrypt_chunked( &self, ciphertext: &[u8], ) -> Result<Vec<u8>, EncryptionError>

Decrypt all chunks from chunked encrypted data.

pub fn decrypt_range( &self, ciphertext: &[u8], plaintext_start: u64, plaintext_end: u64, ) -> Result<Vec<u8>, EncryptionError>

Decrypt a specific plaintext byte range from encrypted data.

The ciphertext must start with the nonce (first 24 bytes) but may be truncated after the chunks needed for the requested range.

Returns exactly the plaintext bytes from plaintext_start to plaintext_end.

pub fn decrypt_range_with_offset( &self, nonce: &[u8], encrypted_chunks: &[u8], first_chunk_index: u64, plaintext_start: u64, plaintext_end: u64, ) -> Result<Vec<u8>, EncryptionError>

Decrypt a plaintext byte range using nonce from DB and partial chunk data.

This is the efficient method for encrypted range requests:

• nonce: 24-byte nonce stored in DB at import time
• encrypted_chunks: Raw encrypted chunk bytes (NO nonce prefix)
• first_chunk_index: Which chunk index the encrypted_chunks starts at
• plaintext_start, plaintext_end: Absolute byte positions in original file

Example: To read plaintext bytes 500,000-600,000:

1. Calculate needed chunks: encrypted_chunk_range(500000, 600000) -> chunks 7-9
2. Fetch encrypted bytes from cloud at those positions
3. Call decrypt_range_with_offset(nonce, chunks, 7, 500000, 600000)

pub fn derive_scoped(&self, release_id: &str) -> EncryptionService

Derive a per-release encryption service.

Uses HKDF: master_key + “bae-release-v1:{release_id}” -> 32-byte key. Deterministic: same master + release_id always gives the same key.

pub fn derive_key(&self, info: &str) -> [u8; 32]

Derive a 32-byte key using HKDF-SHA256 with the given info label.

The derivation is deterministic: same master key + same info string always produces the same derived key.

• Salt: HMAC-SHA256(master_key, "bae-hkdf-salt-v1")
• IKM: master key
• Info: caller-provided label

Trait Implementations

impl Clone for EncryptionService

fn clone(&self) -> EncryptionService

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for EncryptionService

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.