IdentityShroud/IdentityShroud.Core/Contracts/IDataEncryptionService.cs

using IdentityShroud.Core.Security;

namespace IdentityShroud.Core.Contracts;

public interface IDataEncryptionService
{
    EncryptedValue Encrypt(ReadOnlySpan<byte> plain);
    byte[] Decrypt(EncryptedValue input);
}
Encrypt realm data with dek which is encrypted with kek. The signing keys are also encrypted with the kek. 2026-02-26 16:53:02 +01:00			`using IdentityShroud.Core.Security;`

Happy flow for creating realms works But needs more validating... 2026-02-08 11:57:57 +01:00			`namespace IdentityShroud.Core.Contracts;`

Encrypt realm data with dek which is encrypted with kek. The signing keys are also encrypted with the kek. 2026-02-26 16:53:02 +01:00			`public interface IDataEncryptionService`
Happy flow for creating realms works But needs more validating... 2026-02-08 11:57:57 +01:00			`{`
Pass Span instead of Memory 2026-02-26 20:39:48 +01:00			`EncryptedValue Encrypt(ReadOnlySpan<byte> plain);`
Support rotation of master key. The EncryptionService now loads a set of keys and uses the active one to encrypt and selects key based on keyid during decryption. Introduced EncryptedValue to hold keyId and encrypted data. (There are no intermeddiate keys yet) 2026-02-24 06:32:58 +01:00			`byte[] Decrypt(EncryptedValue input);`
Happy flow for creating realms works But needs more validating... 2026-02-08 11:57:57 +01:00			`}`