Encrypt realm data with dek which is encrypted with kek. The signing keys are also encrypted with the kek.

IdentityShroud.Core/Contracts/IDataEncryptionService.cs

@@ -1,6 +1,8 @@
+using IdentityShroud.Core.Security;
+
 namespace IdentityShroud.Core.Contracts;
 
-public interface IEncryptionService
+public interface IDataEncryptionService
 {
     EncryptedValue Encrypt(ReadOnlyMemory<byte> plain);
     byte[] Decrypt(EncryptedValue input);

IdentityShroud.Core/Contracts/IDekEncryptionService.cs

@@ -0,0 +1,11 @@
+using IdentityShroud.Core.Security;
+
+namespace IdentityShroud.Core.Contracts;
+
+
+
+public interface IDekEncryptionService
+{
+    EncryptedDek Encrypt(ReadOnlyMemory<byte> plain);
+    byte[] Decrypt(EncryptedDek input);
+}

IdentityShroud.Core/Contracts/IRealmContext.cs

@@ -0,0 +1,9 @@
+using IdentityShroud.Core.Model;
+
+namespace IdentityShroud.Core.Contracts;
+
+public interface IRealmContext
+{
+    public Realm GetRealm();
+    Task<IList<RealmDek>> GetDeks(CancellationToken ct = default);
+}

IdentityShroud.Core/Contracts/IRealmService.cs

@@ -11,4 +11,5 @@ public interface IRealmService
         
     Task<Result<RealmCreateResponse>> Create(RealmCreateRequest request, CancellationToken ct = default);
     Task LoadActiveKeys(Realm realm);
+    Task LoadDeks(Realm realm);
 }

IdentityShroud.Core/Contracts/ISecretProvider.cs

@@ -1,3 +1,5 @@
+using IdentityShroud.Core.Security;
+
 namespace IdentityShroud.Core.Contracts;
 
 public interface ISecretProvider
@@ -8,5 +10,5 @@ public interface ISecretProvider
     /// Should return one active key, might return inactive keys.
     /// </summary>
     /// <returns></returns>
-    EncryptionKey[] GetKeys(string name);
+    KeyEncryptionKey[] GetKeys(string name);
 }