ext

type KeyMaterial struct {

	// encrypted_dek is the wrapped DEK, as produced by whatever wrapping the
	// extension server performs. It is the one field that must be set.
	EncryptedDek []byte `protobuf:"bytes,1,opt,name=encrypted_dek,json=encryptedDek,proto3" json:"encrypted_dek,omitempty"`
	// version identifies which version of the wrapping key sealed
	// encrypted_dek, so a server that rotates key material can select the same
	// version again on decrypt. Empty means the server does not version its
	// keys.
	Version string `protobuf:"bytes,2,opt,name=version,proto3" json:"version,omitempty"`
	// namespace is the pre-translation (local) namespace the DEK belongs to,
	// copied from EncryptRequest.namespace. A server that derives a key per
	// namespace needs it to derive the same key on decrypt, where the request no
	// longer carries it. Empty means the server does not key off the namespace.
	Namespace string `protobuf:"bytes,3,opt,name=namespace,proto3" json:"namespace,omitempty"`
	// opaque belongs to the extension server. Neither the proxy nor this message
	// gives it any meaning: it is round-tripped untouched, so a server that needs
	// more than version and namespace to find its key can put its own encoding
	// here instead of replacing this framing wholesale. Whatever goes in owns its
	// own compatibility, since the proxy cannot migrate what it cannot read.
	Opaque []byte `protobuf:"bytes,4,opt,name=opaque,proto3" json:"opaque,omitempty"`
	// nonce is the per-seal nonce the cipher required. It is in the clear because
	// a nonce is not a secret, only single-use, and it has a field of its own
	// rather than a corner of opaque so that opaque stays entirely the server's.
	// Empty means the server carries its nonce some other way, or needs none.
	Nonce []byte `protobuf:"bytes,5,opt,name=nonce,proto3" json:"nonce,omitempty"`
	// cipher is the AEAD that sealed encrypted_dek. Empty means the server did
	// its own wrapping and this framing cannot describe it.
	Cipher KeyMaterial_Cipher `protobuf:"varint,6,opt,name=cipher,proto3,enum=api.ext.v1.KeyMaterial_Cipher" json:"cipher,omitempty"`
	// contains filtered or unexported fields
}

type KeyMaterial_Cipher int32