Interface IKeyStore

Namespace

Stratara.Abstractions.Security

Assembly

Stratara.Abstractions.dll

Manages versioned data-encryption keys (DEKs) used by the framework's IEncryptionFactory + ISecureBlobEncryptor + ISecureJsonSerializer. Keys are scoped by KeyScope (DataSensitivityLevel + optional tenant / user) and versioned, so rotation keeps older ciphertext decryptable while RevokeAsync(string, CancellationToken) / EraseScopeAsync(KeyScope, CancellationToken) implement GDPR Art. 17 crypto-shredding.

public interface IKeyStore

Extension Methods

FieldChangedEventExtensions.ApplyPropertyChanged<TAggregate>(TAggregate, FieldChangedEvent<TAggregate>)

EventStream.ApplyEvents(object, IReadOnlyList<IEvent>)

Methods

EraseScopeAsync(KeyScope, CancellationToken)

Erase every key version for the scope (GDPR Art. 17). All ciphertext under the scope becomes permanently undecryptable.

ValueTask EraseScopeAsync(KeyScope scope, CancellationToken cancellationToken = default)

Parameters

scope KeyScope

The key scope to erase.

cancellationToken CancellationToken

Propagated to the underlying store.

Returns

ValueTask

GetDataEncryptionKeyAsync(string, CancellationToken)

Return the raw key bytes for the id, or null if revoked / erased / unknown.

ValueTask<byte[]?> GetDataEncryptionKeyAsync(string keyId, CancellationToken cancellationToken = default)

Parameters

keyId string

The key id previously obtained from GetOrCreateCurrentKeyAsync(KeyScope, CancellationToken).

cancellationToken CancellationToken

Propagated to the underlying store.

Returns

ValueTask<byte[]>

GetOrCreateCurrentKeyAsync(KeyScope, CancellationToken)

Return the current (highest non-revoked version) key for the scope, creating a first version if none exists yet.

ValueTask<KeyMaterial> GetOrCreateCurrentKeyAsync(KeyScope scope, CancellationToken cancellationToken = default)

Parameters

scope KeyScope

The key scope to resolve.

cancellationToken CancellationToken

Propagated to the underlying store.

Returns

ValueTask<KeyMaterial>

The resolved KeyMaterial (key id + raw bytes).

RevokeAsync(string, CancellationToken)

Permanently revoke a single key version. After revocation GetDataEncryptionKeyAsync(string, CancellationToken) returns null for that id — the ciphertext encrypted under it becomes undecryptable (crypto-shred of one version).

ValueTask RevokeAsync(string keyId, CancellationToken cancellationToken = default)

Parameters

keyId string

The key id to revoke.

cancellationToken CancellationToken

Propagated to the underlying store.

Returns

ValueTask

RotateAsync(KeyScope, CancellationToken)

Create a new key version for the scope and make it the current one. Older versions remain resolvable via GetDataEncryptionKeyAsync(string, CancellationToken) so existing ciphertext stays readable.

ValueTask<string> RotateAsync(KeyScope scope, CancellationToken cancellationToken = default)

Parameters

scope KeyScope

The key scope to rotate.

cancellationToken CancellationToken

Propagated to the underlying store.

Returns

ValueTask<string>

The id of the newly created current key.