encryption

type DEKBlock struct {
	Nonce        [NonceSize]byte // Nonce for DEK encryption
	EncryptedDEK [KeySize]byte   // Encrypted data encryption key
	Tag          [TagSize]byte   // Authentication tag
	Reserved     [196]byte       // Reserved for future use
}

type DataBlock struct {
	Nonce [NonceSize]byte // Unique nonce for this block
	Data  []byte          // Encrypted data + authentication tag
}

type Decrypter interface {
	// Decrypt decrypts ciphertext and returns plaintext.
	// Returns ErrAuthenticationFailed if the data has been tampered with.
	Decrypt(ciphertext []byte) ([]byte, error)
}

type EncryptDecrypter interface {
	Encrypter
	Decrypter
}

type Encrypter interface {
	// Encrypt encrypts plaintext and returns ciphertext.
	// The returned ciphertext includes any necessary metadata (nonce, tag, etc.)
	Encrypt(plaintext []byte) ([]byte, error)
}

type Engine struct {
	// contains filtered or unexported fields
}

type FileHeader struct {
	Magic      [8]byte  // Magic number
	Version    uint32   // File format version
	Algorithm  uint32   // Encryption algorithm identifier
	KeyVersion uint32   // Key version for rotation
	Reserved   [44]byte // Reserved for future use
}

type KeyEntry struct {
	Metadata     KeyMetadata `json:"metadata"`
	EncryptedKey []byte      `json:"encrypted_key"` // KEK encrypted with MEK
}

type KeyManager struct {
	// contains filtered or unexported fields
}

type KeyManagerConfig struct {
	KeyDir      string        // Directory to store key metadata
	MasterKey   []byte        // Master encryption key (MEK)
	AutoRotate  bool          // Enable automatic key rotation
	RotateAfter time.Duration // Rotate keys after this duration
}

type KeyManagerStatistics struct {
	TotalKeys      int           `json:"total_keys"`
	ActiveKeys     int           `json:"active_keys"`
	RotatedKeys    int           `json:"rotated_keys"`
	DeprecatedKeys int           `json:"deprecated_keys"`
	RevokedKeys    int           `json:"revoked_keys"`
	ActiveVersion  uint32        `json:"active_version"`
	ActiveKeyAge   time.Duration `json:"active_key_age"`
	OldestKeyAge   time.Duration `json:"oldest_key_age"`
	NewestKeyAge   time.Duration `json:"newest_key_age"`
}

type KeyMetadata struct {
	Version     uint32    `json:"version"`
	CreatedAt   time.Time `json:"created_at"`
	ActivatedAt time.Time `json:"activated_at,omitempty"`
	RotatedAt   time.Time `json:"rotated_at,omitempty"`
	Status      KeyStatus `json:"status"`
	Algorithm   string    `json:"algorithm"`
	Purpose     string    `json:"purpose"` // "KEK" or "DEK"
}

type KeyProvider interface {
	// GetActiveKEK retrieves the currently active Key Encryption Key.
	// Returns the key, its version number, and any error.
	GetActiveKEK() ([]byte, uint32, error)

	// GetKEK retrieves a Key Encryption Key by version number.
	// Used for decrypting data encrypted with older key versions.
	GetKEK(version uint32) ([]byte, error)

	// GetActiveVersion returns the current active key version number.
	GetActiveVersion() uint32
}

type KeyStatus string

type StreamDecryptor struct {
	// contains filtered or unexported fields
}

type StreamEncryptor struct {
	// contains filtered or unexported fields
}