Joseph Doherty
25 lines
1.0 KiB
C#
25 lines
1.0 KiB
C#
namespace ZB.MOM.WW.Secrets.Abstractions;
|
|
|
|
/// <summary>
|
|
/// Supplies the AES-256 master key (KEK) used to wrap and unwrap per-secret data-encryption
|
|
/// keys. Implementations resolve the key material from a configured source (environment,
|
|
/// file, external KMS) and expose a stable, non-secret identifier for the active key so
|
|
/// rotation can be recorded per row and reasoned about later.
|
|
/// </summary>
|
|
public interface IMasterKeyProvider
|
|
{
|
|
/// <summary>
|
|
/// Returns the 32-byte AES-256 master key material.
|
|
/// </summary>
|
|
/// <returns>The 32-byte master key.</returns>
|
|
/// <exception cref="MasterKeyUnavailableException">The master key cannot be resolved.</exception>
|
|
ReadOnlyMemory<byte> GetMasterKey();
|
|
|
|
/// <summary>
|
|
/// The stable, non-secret identifier of the active key-encryption key (KEK). This value
|
|
/// is recorded on each stored row so that key rotation is legible and rows can be matched
|
|
/// to the KEK that wrapped their DEK.
|
|
/// </summary>
|
|
string KekId { get; }
|
|
}
|