eelke/IdentityShroud
1
0
Fork 0
Code Issues 4 Pull requests Projects Releases Packages Wiki Activity Actions

5-improve-encrypted-storage (#6)

Browse source 
Added the use of DEK's for encryption of secrets. Both the KEK's and DEK's are stored in a way that you can have multiple key of which one is active. But the others are still available for decrypting. This allows for implementing key rotation.

Co-authored-by: eelke <eelke@eelkeklein.nl>
Co-authored-by: Eelke76 <31384324+Eelke76@users.noreply.github.com>
Reviewed-on: #6
This commit is contained in:
eelke 2026-02-27 17:57:42 +00:00
parent 138f335af0
commit 07393f57fc
87 changed files with 1903 additions and 533 deletions
Download patch file Download diff file Expand all files Collapse all files

18
IdentityShroud.TestUtils/Substitutes/EncryptionServiceSubstitute.cs
View file

@ -1,18 +0,0 @@
using IdentityShroud.Core.Contracts;
namespace IdentityShroud.TestUtils.Substitutes;
public static class EncryptionServiceSubstitute
{
public static IEncryptionService CreatePassthrough()
{
var encryptionService = Substitute.For<IEncryptionService>();
encryptionService
.Encrypt(Arg.Any<byte[]>())
.Returns(x => x.ArgAt<byte[]>(0));
encryptionService
.Decrypt(Arg.Any<byte[]>())
.Returns(x => x.ArgAt<byte[]>(0));
return encryptionService;
}
}

18
IdentityShroud.TestUtils/Substitutes/NullDataEncryptionService.cs Normal file
View file

@ -0,0 +1,18 @@
using IdentityShroud.Core.Contracts;
using IdentityShroud.Core.Security;
namespace IdentityShroud.TestUtils.Substitutes;
public class NullDataEncryptionService : IDataEncryptionService
{
public DekId KeyId { get; } = DekId.NewId();
public EncryptedValue Encrypt(ReadOnlySpan<byte> plain)
{
return new(KeyId, plain.ToArray());
}
public byte[] Decrypt(EncryptedValue input)
{
return input.Value;
}
}

18
IdentityShroud.TestUtils/Substitutes/NullDekEncryptionService.cs Normal file
View file

@ -0,0 +1,18 @@
using IdentityShroud.Core.Contracts;
using IdentityShroud.Core.Security;
namespace IdentityShroud.TestUtils.Substitutes;
public class NullDekEncryptionService : IDekEncryptionService
{
public KekId KeyId { get; } = KekId.NewId();
public EncryptedDek Encrypt(ReadOnlySpan<byte> plain)
{
return new(KeyId, plain.ToArray());
}
public byte[] Decrypt(EncryptedDek input)
{
return input.Value;
}
}