27 lines
No EOL
1 KiB
C#
27 lines
No EOL
1 KiB
C#
using IdentityShroud.Core.Contracts;
|
|
using IdentityShroud.Core.Model;
|
|
using IdentityShroud.Core.Security;
|
|
|
|
namespace IdentityShroud.Core.Services;
|
|
|
|
public class DataEncryptionService(
|
|
IDekEncryptionService dekCryptor) : IDataEncryptionService
|
|
{
|
|
public EncryptedValue Encrypt(RealmDek dek, ReadOnlySpan<byte> plain)
|
|
{
|
|
var key = dekCryptor.Decrypt(dek.KeyData);
|
|
byte[] cipher = Encryption.Encrypt(plain, key);
|
|
return new (dek.Id, cipher);
|
|
}
|
|
|
|
public byte[] Decrypt(IReadOnlyList<RealmDek> deks, EncryptedValue input)
|
|
{
|
|
// Note a missing key SHOULD not happen. If it does happen something has seriously gone wrong like
|
|
// - Old key removed before migration completed (should not be possible)
|
|
// - Wrong keyset because of programming error.
|
|
var dek = deks.SingleOrDefault(d => d.Id == input.DekId)
|
|
?? throw new InvalidOperationException("Required key not found");
|
|
var key = dekCryptor.Decrypt(dek.KeyData);
|
|
return Encryption.Decrypt(input.Value, key);
|
|
}
|
|
} |