Class SealedValue

Namespace

MailFathom.Infrastructure.DataEncryption

Assembly

MailFathom.Infrastructure.dll

A value as it is stored: the ciphertext, and the identifier of the key that sealed it.

public sealed record SealedValue : IEquatable<SealedValue>

Inheritance

object

SealedValue

Implements

IEquatable<SealedValue>

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

Storing the key identifier beside the ciphertext is what makes rotation possible at all. Without it, replacing a key would be a flag day with the service stopped, because nothing could tell which of two keys opens a given row. With it, two keys coexist, a value is re-sealed under the active key the next time it is written, and a key is retired once nothing references it.

The identifier is not a secret and is not authentication on its own: it is authenticated into the ciphertext through the binding, so rewriting it in the database makes the value fail to open rather than making it open under another key.

Constructors

SealedValue(string, ReadOnlyMemory<byte>)

A value as it is stored: the ciphertext, and the identifier of the key that sealed it.

Properties

Ciphertext

The sealed bytes, in the layout AesGcmEnvelope fixes.

KeyId

The key the value was sealed under, stored beside it.