Interface ISecureBlobEncryptor

Namespace

Stratara.Abstractions.Security

Assembly

Stratara.Abstractions.dll

Streaming AES-GCM wrapper for blob payloads. Encryption + decryption bind the stream to a KeyScope and a purpose via associated data, so a leaked ciphertext cannot be decrypted against another scope's key or reused under a different purpose.

public interface ISecureBlobEncryptor

Extension Methods

FieldChangedEventExtensions.ApplyPropertyChanged<TAggregate>(TAggregate, FieldChangedEvent<TAggregate>)

EventStream.ApplyEvents(object, IReadOnlyList<IEvent>)

Methods

DecryptAsync(Stream, KeyScope, CancellationToken)

Decrypt encryptedStream for scope. The embedded key id and purpose are read from the stream; an associated-data mismatch throws.

Task<Stream> DecryptAsync(Stream encryptedStream, KeyScope scope, CancellationToken cancellationToken = default)

Parameters

encryptedStream Stream

The encrypted stream produced by EncryptAsync(Stream, KeyScope, string, CancellationToken) (or a supported legacy format).

scope KeyScope

The key scope the ciphertext was bound to.

cancellationToken CancellationToken

Propagated to the key store and stream operations.

Returns

Task<Stream>

The decrypted plaintext stream.

EncryptAsync(Stream, KeyScope, string, CancellationToken)

Encrypt plainStream under the current key for scope, binding the ciphertext to purpose.

Task<Stream> EncryptAsync(Stream plainStream, KeyScope scope, string purpose, CancellationToken cancellationToken = default)

Parameters

plainStream Stream

The plaintext to encrypt.

scope KeyScope

The key scope whose current key encrypts the payload.

purpose string

A caller-defined label folded into the associated data (e.g. "blob", "attachment").

cancellationToken CancellationToken

Propagated to the key store and stream operations.

Returns

Task<Stream>

A self-describing encrypted stream (version byte + nonce + tag + key id + purpose + ciphertext).