Crate grafos_securestore 

Lease-scoped key and ciphertext store for grafOS.

This crate provides epoch-based encryption key management and encrypted blob storage, with keys tied to fabric memory leases. When a lease expires, the key is destroyed and decryption becomes impossible — enforcing fail-closed semantics.

Architecture

• KeyEpochManager manages encryption key epochs. Each epoch has a TTL and stores its key material in a grafos_locator::locator::MemRegionLocator. Key rotation creates a new active epoch and marks the previous one as EpochStatus::Rotating.

• EncryptedBlobStore encrypts and decrypts blobs using the active epoch key from a KeyEpochManager. Ciphertext is stored with its epoch ID, nonce, and AAD so the correct key can be resolved at decryption time.

• Crypto operations are abstracted behind the CryptoBackend trait. A MockCryptoBackend (XOR-based, NOT secure) is provided for testing. Real crypto requires the crypto-aes-gcm feature flag.

Fail-closed semantics

If a key’s epoch is expired or missing, EncryptedBlobStore::get returns an error rather than attempting decryption with stale or unknown key material.

Structs

BlobId

Unique identifier for an encrypted blob.

BlobInfo

Metadata for an encrypted blob, including the epoch used for encryption and the cryptographic parameters needed for decryption.

EncryptedBlobStore

Encrypted blob store that uses epoch-scoped keys for encryption.

EpochId

Unique identifier for a key epoch.

EpochInfo

Metadata for a single key epoch.

KeyEpochManager

Manages encryption key epochs with lease-scoped lifecycle.

MockCryptoBackend

XOR-based mock crypto backend for testing.

Enums

EpochStatus

Lifecycle status of a key epoch.

SecureStoreError

Errors returned by secure store operations.

Traits

CryptoBackend

Trait abstracting symmetric encryption operations.