feat(native-rust): encrypt behavior

[lucasmcdonald3]

Implements encrypt behavior per client-apis/encrypt.md.

Scope:

• esdk/src/encrypt.rs — encrypt entry point, default-CMM wrapping, encryption-context validation, body and signature construction, output assembly.
• Tests:
  • esdk/tests/test_encrypt_behavior.rs — top-level encrypt behavior.
  • esdk/tests/test_encrypt_missing_annotations.rs — coverage for spec requirements not directly tied to a sub-routine.
  • esdk/tests/test_construct_the_signature.rs — signature construction.
  • esdk/tests/test_cmm_algorithm_suite_override.rs — algorithm-suite override behavior.
  • esdk/tests/test_post_cmm_validation.rs — post-CMM-call material validation.
  • esdk/tests/test_keyring_to_default_cmm.rs — keyring-to-default-CMM wrapping.
  • esdk/tests/test_required_encryption_context.rs — required encryption context handling.

The public input/output types (EncryptInput, EncryptOutput) and streaming traits used by this entry point are reviewed in #919. Header, body, body-AAD, and footer serialization called from here are reviewed in their own PRs (#909, #918, #900, #898). Decrypt behavior is reviewed separately in a follow-up PR.

---

Note: CI does not run on this PR. This branch is scoped for focused review and intentionally omits test helpers, scaffolding, and other supporting code. Full code — including helpers, test infrastructure, and working tests — lives on the aws-crypto-rust/unreviewed branch.

If you want more context or to actually run the tests, see aws-crypto-rust/unreviewed.

Related spec:

• client-apis/encrypt.md

[Copilot]

Pull request overview

Implements the native Rust encrypt operation behavior per the spec, including CMM/materials acquisition, header/body/footer construction, and streaming support, with targeted behavior-driven tests validating key spec requirements.

Changes:

• Added esdk/src/encrypt.rs implementing the encrypt entry point and its step-wise construction (materials → header → body → optional signature/footer).
• Added tests covering encrypt behavior, signature construction/verification, CMM suite override behavior, post-CMM validation scenarios, keyring→default-CMM wrapping, and required encryption context handling.
• Added cross-compatibility tests to prove keyring inputs are wrapped via the default CMM behaviorally (encrypt/decrypt interchange).

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
esdk/src/encrypt.rs	Implements encrypt/streaming encrypt flow, header/body/footer assembly, and encryption-context validation.
esdk/tests/test_encrypt_behavior.rs	Broad spec-driven tests for encrypt behavior and output structure.
esdk/tests/test_construct_the_signature.rs	Validates signature/footer construction and verification semantics.
esdk/tests/test_cmm_algorithm_suite_override.rs	Ensures encryption uses the suite returned by the CMM even if it differs from input.
esdk/tests/test_post_cmm_validation.rs	Tests commitment-policy validation outcomes and identity-KDF decrypt coverage.
esdk/tests/test_keyring_to_default_cmm.rs	Cross-compat tests proving keyring inputs are wrapped via default CMM behavior.
esdk/tests/test_required_encryption_context.rs	Tests required encryption context filtering/reproduction through CMM and decrypt.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sharmabikram]

Clarification: What will happen if frame length is u32 MAX for a tiny bit of plaintext? We would probably reserve a larger memory space which may not be required in real.

[lucasmcdonald3]

Correct, updated