fle-rust

name	fle-rust
summary	Field-Level Encryption is not supported by the Couchbase Rust SDK 1.0 — alternatives and workarounds
description	Field-Level Encryption is not supported by the Couchbase Rust SDK 1.0 — alternatives and workarounds
compatibility	Rust SDK 1.0. FLE not supported.
metadata	{"last_verified":"2026-05","handoff":[{"condition":"user asks about FLE concepts or supported SDKs","skill":"fle"},{"condition":"user asks about server-side encryption at rest","skill":"security"}]}

Field-Level Encryption — Rust

Rust SDK 1.0 does not support Field-Level Encryption. There is no CryptoManager API.

Alternatives

Option 1 — Encrypt in application code before writing:

use aes_gcm::{Aes256Gcm, Key, Nonce};
use aes_gcm::aead::{Aead, NewAead};

// Encrypt the sensitive field value before building the document
let key = Key::from_slice(b"an example very very secret key."); // 32 bytes
let cipher = Aes256Gcm::new(key);
let nonce = Nonce::from_slice(b"unique nonce"); // 12 bytes

let ciphertext = cipher.encrypt(nonce, ssn.as_bytes()).unwrap();
let encrypted_ssn = base64::encode(&ciphertext);

let doc = serde_json::json!({
    "name": "Alice",
    "ssn": encrypted_ssn,  // store ciphertext
});
collection.upsert("user::alice", doc, None).await?;

Option 2 — Server-side encryption at rest (Couchbase Server 8.x):

Couchbase Server 8.x supports transparent encryption at rest for all data. This protects data on disk without SDK changes. See the security skill.

When FLE Support Is Added

Monitor the Couchbase Rust SDK release notes for FLE support in future versions.