cmek split 1/8: encryption primitives and wire format (#4569)

[ti-chi-bot]

This is an automated cherry-pick of #4569

What problem does this PR solve?

Issue Number: ref #3943

This is split PR 1/8 from #3955.

What is changed and how it works?

This PR introduces the foundational encryption primitives used by later CMEK integration PRs:

• Add encryption data model types aligned with TiKV keyspace encryption metadata.
• Add AES-CTR cipher helpers and IV generation/validation.
• Add encrypted payload wire format with version + data key ID header.
• Add 24-bit data key ID encode/decode helpers.
• Add unit tests for cipher and wire format behavior.

This PR is intentionally limited to reusable primitives and does not wire runtime components yet.

Check List

Tests

• Unit test
• Integration test
• Manual test (add detailed scripts or steps below)
• No code

Questions

Will it cause performance regression or break compatibility?

No behavior change for runtime components in this split. It only adds reusable encryption primitives.

Do you need to update user documentation, design documentation or monitoring documentation?

No.

Release note

None

Summary by CodeRabbit

• New Features

  • Added AES-256-CTR encryption/decryption and secure IV generation.
  • Introduced a versioned encrypted data format with 3-byte data key identifiers.
  • Added types and utilities for managing encryption metadata, keys, and epochs.

• Tests

  • Added unit tests for cipher operations and the encryption data format.

• Chores

  • Added normalized encryption-related error types for clearer error reporting.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 9e120da2-0303-4f8a-a59c-d5cb1662349e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: tenfyzhong

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [tenfyzhong]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment