@@ -279,11 +279,56 @@ pub struct KeyValue {
279279 #[ prost( int64, tag = "2" ) ]
280280 pub version : i64 ,
281281 /// Object value in bytes which is stored (in put) and fetched (in get).
282- /// Clients must encrypt this blob client-side before sending it over the wire to server in order
283- /// to preserve privacy and security.
282+ /// Clients must encrypt the secret contents of this blob client-side before sending it over the
283+ /// wire to the server in order to preserve privacy and security.
284+ /// Clients may use a `Storable` object, serialize it and set it here.
284285 #[ prost( bytes = "vec" , tag = "3" ) ]
285286 pub value : :: prost:: alloc:: vec:: Vec < u8 > ,
286287}
288+ /// Represents a storable object that can be serialized and stored as `value` in `PutObjectRequest`.
289+ /// Only provided as a helper object for ease of use by clients.
290+ /// Clients MUST encrypt the `PlaintextBlob` before using it as `data` in `Storable`.
291+ /// The server does not use or read anything from `Storable`, Clients may use its fields as
292+ /// required.
293+ #[ allow( clippy:: derive_partial_eq_without_eq) ]
294+ #[ derive( Clone , PartialEq , :: prost:: Message ) ]
295+ pub struct Storable {
296+ /// Represents an encrypted and serialized `PlaintextBlob`. MUST encrypt the whole `PlaintextBlob`
297+ /// using client-side encryption before setting here.
298+ #[ prost( bytes = "vec" , tag = "1" ) ]
299+ pub data : :: prost:: alloc:: vec:: Vec < u8 > ,
300+ /// Represents encryption related metadata
301+ #[ prost( message, optional, tag = "2" ) ]
302+ pub encryption_metadata : :: core:: option:: Option < EncryptionMetadata > ,
303+ }
304+ /// Represents encryption related metadata
305+ #[ allow( clippy:: derive_partial_eq_without_eq) ]
306+ #[ derive( Clone , PartialEq , :: prost:: Message ) ]
307+ pub struct EncryptionMetadata {
308+ /// The encryption algorithm used for encrypting the `PlaintextBlob`.
309+ #[ prost( string, tag = "1" ) ]
310+ pub cipher_format : :: prost:: alloc:: string:: String ,
311+ /// The nonce used for encryption. Nonce is a random or unique value used to ensure that the same
312+ /// plaintext results in different ciphertexts every time it is encrypted.
313+ #[ prost( bytes = "vec" , tag = "2" ) ]
314+ pub nonce : :: prost:: alloc:: vec:: Vec < u8 > ,
315+ /// The authentication tag used for encryption. It provides integrity and authenticity assurance
316+ /// for the encrypted data.
317+ #[ prost( bytes = "vec" , tag = "3" ) ]
318+ pub tag : :: prost:: alloc:: vec:: Vec < u8 > ,
319+ }
320+ /// Represents a data blob, which is encrypted, serialized and later used in `Storable.data`.
321+ /// Since the whole `Storable.data` is client-side encrypted, the server cannot understand this.
322+ #[ allow( clippy:: derive_partial_eq_without_eq) ]
323+ #[ derive( Clone , PartialEq , :: prost:: Message ) ]
324+ pub struct PlaintextBlob {
325+ /// The unencrypted value.
326+ #[ prost( bytes = "vec" , tag = "1" ) ]
327+ pub value : :: prost:: alloc:: vec:: Vec < u8 > ,
328+ /// The version of the value. Can be used by client to verify version integrity.
329+ #[ prost( int64, tag = "2" ) ]
330+ pub version : i64 ,
331+ }
287332/// ErrorCodes to be used in `ErrorResponse`
288333#[ derive( Clone , Copy , Debug , PartialEq , Eq , Hash , PartialOrd , Ord , :: prost:: Enumeration ) ]
289334#[ repr( i32 ) ]
0 commit comments