seal: secrets at rest under a chip-derived key; the partition table where the build puts it

Cargo.toml

@@ -43,6 +43,8 @@ rusty_esp_core = { version = "0.1.2", git = "https://github.com/Remade-With-Rust
 # is for rusty_esp_signal's session keys. No `std` here: the core is no_std.
 p256 = { version = "0.13", default-features = false, features = ["ecdsa", "ecdh"] }
 sha2 = { version = "0.10", default-features = false }
+# Sealing secrets at rest (seal.rs): AES-256-GCM, the house cipher.
+aes-gcm = { version = "0.10", default-features = false, features = ["aes"] }
 # The RFC 6979 signing primitive over a bare scalar (round 2, R7): the
 # version p256 0.13 already brings, with the parts `SigningKey` uses.
 ecdsa = { version = "0.16", default-features = false, features = ["hazmat", "rfc6979"] }

crates/rusty_esp_mid-core/Cargo.toml

@@ -56,6 +56,7 @@ p256 = { workspace = true }
 # public key on construction: a scalar multiplication per boot (R7).
 ecdsa = { workspace = true }
 sha2 = { workspace = true }
+aes-gcm = { workspace = true }
 bs58 = { workspace = true }
 base64 = { workspace = true }
 serde = { workspace = true, optional = true }

crates/rusty_esp_mid-core/src/lib.rs

@@ -44,6 +44,7 @@ pub mod key;
 pub mod kms;
 pub mod manifest;
 pub mod nonce;
+pub mod seal;
 pub mod setup;
 pub mod signer;