Class DataEncryptionKey

Namespace

MailFathom.Infrastructure.DataEncryption

Assembly

MailFathom.Infrastructure.dll

An AES-256 key of the ring, owned by the operation that resolved it and erased when that operation ends.

public sealed class DataEncryptionKey : IDisposable

Inheritance

object

DataEncryptionKey

Implements

IDisposable

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

The key exists as decoded bytes for the duration of one seal or open, and the identifier travels with it because the two are used together: the identifier is stored beside the sealed value and is authenticated into it, so handing them around separately would make it possible to seal under one key and record another.

Configuration carries the material as base64 rather than raw bytes because every channel that delivers it — a Compose secret file, a Kubernetes Secret value, a systemd credential — is handled as text by the tools that write it, and a raw 32-byte file acquires a trailing newline the first time anyone edits it. Decoding happens here, once, and every intermediate buffer is erased rather than left for the collector.

Properties

KeyId

Gets the identifier stored beside every value this key seals.

Methods

Decode(string, ResolvedSecret, out DataEncryptionKeyMaterialFailure?)

Decodes configured material into a key.

Dispose()

Performs application-defined tasks associated with freeing, releasing, or resetting unmanaged resources.