Trait KeyRetriever 

pub trait KeyRetriever: Send + Sync {
    // Required method
    fn retrieve_key(&self, key_metadata: &[u8]) -> Result<Vec<u8>>;
}

Trait for retrieving an encryption key using the key’s metadata

Example

This shows how you might use a KeyRetriever to decrypt a Parquet file if you have a set of known encryption keys with identifiers, but at read time you may not know which columns were encrypted and which keys were used.

In practice, the key metadata might instead store an encrypted key that must be decrypted with a Key Management Server.

// Define known encryption keys
let mut keys = HashMap::new();
keys.insert("kf".to_owned(), b"0123456789012345".to_vec());
keys.insert("kc1".to_owned(), b"1234567890123450".to_vec());
keys.insert("kc2".to_owned(), b"1234567890123451".to_vec());

// Create encryption properties for writing a file,
// and specify the key identifiers as the key metadata.
let encryption_properties = FileEncryptionProperties::builder(keys.get("kf").unwrap().clone())
    .with_footer_key_metadata("kf".into())
    .with_column_key_and_metadata("x", keys.get("kc1").unwrap().clone(), "kc1".as_bytes().into())
    .with_column_key_and_metadata("y", keys.get("kc2").unwrap().clone(), "kc2".as_bytes().into())
    .build()?;

// Write an encrypted file with the properties
// ...

// Define a KeyRetriever that can get encryption keys using their identifiers
struct CustomKeyRetriever {
    keys: Mutex<HashMap<String, Vec<u8>>>,
}

impl KeyRetriever for CustomKeyRetriever {
    fn retrieve_key(&self, key_metadata: &[u8]) -> parquet::errors::Result<Vec<u8>> {
        // Metadata is bytes, so convert it to a string identifier
        let key_metadata = std::str::from_utf8(key_metadata).map_err(|e| {
            ParquetError::General(format!("Could not convert key metadata to string: {e}"))
        })?;
        // Lookup the key
        let keys = self.keys.lock().unwrap();
        match keys.get(key_metadata) {
            Some(key) => Ok(key.clone()),
            None => Err(ParquetError::General(format!(
                "Could not retrieve key for metadata {key_metadata:?}"
            ))),
        }
    }
}

let key_retriever = Arc::new(CustomKeyRetriever {
    keys: Mutex::new(keys),
});

// Create decryption properties for reading an encrypted file.
// Note that we don't need to specify which columns are encrypted,
// this is determined by the file metadata, and the required keys will be retrieved
// dynamically using our key retriever.
let decryption_properties = FileDecryptionProperties::with_key_retriever(key_retriever)
    .build()?;

// Read an encrypted file with the decryption properties
// ...

Required Methods

fn retrieve_key(&self, key_metadata: &[u8]) -> Result<Vec<u8>>

Retrieve a decryption key given the key metadata

Dyn Compatibility

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors