Namespace Stratara.Abstractions.Security
Classes
- EncryptDataAttribute
Marks a property, class, or parameter for transparent encryption by ISecureJsonSerializer. The serializer pulls the matching DEK from IKeyStore using the supplied Level + ambient Subject identifiers.
- KeyMaterial
A resolved data-encryption key: its stable id plus the raw key bytes. Returned by GetOrCreateCurrentKeyAsync(KeyScope, CancellationToken) so callers obtain both the id (to persist alongside the ciphertext) and the key (to perform the encryption) in a single call.
Structs
- EncryptedData
Ciphertext envelope produced by IEncryptionFactory. Carries the three components needed for AES-GCM decryption — none of them are secrets, but the envelope is bound to the original associated-data via the authentication tag.
- KeyScope
Identifies the scope a data-encryption key belongs to: a DataSensitivityLevel optionally narrowed to a tenant and/or user. The IKeyStore derives a stable key id from this scope.
Interfaces
- IEncryptionFactory
Symmetric authenticated-encryption primitive (AES-GCM in the default impl). The associated-data parameter binds ciphertext to a context — typically the Subject tenant id / user id — to prevent ciphertext swapping across tenants.
- IKeyStore
Manages versioned data-encryption keys (DEKs) used by the framework's IEncryptionFactory + ISecureBlobEncryptor + ISecureJsonSerializer. Keys are scoped by KeyScope (DataSensitivityLevel + optional tenant / user) and versioned, so rotation keeps older ciphertext decryptable while RevokeAsync(string, CancellationToken) / EraseScopeAsync(KeyScope, CancellationToken) implement GDPR Art. 17 crypto-shredding.
- IMasterKeyProvider
Supplies the master key-encryption key (KEK) used to wrap and unwrap the data-encryption keys (DEKs) held by an IKeyStore. This is the custody seam: the default file-backed provider can later be swapped for an HSM / KMS / vault provider without changing IKeyStore or the stored (wrapped) DEK data.
- ISecureBlobEncryptor
Streaming AES-GCM wrapper for blob payloads. Encryption + decryption bind the stream to a KeyScope and a
purposevia associated data, so a leaked ciphertext cannot be decrypted against another scope's key or reused under a different purpose.
- ISecureJsonSerializer
JSON serializer that automatically encrypts properties marked with
EncryptDataAttributeusing a key resolved from IKeyStore for the supplied tenant + user scope.
Enums
- DataSensitivityLevel
Sensitivity tier for fields protected by EncryptDataAttribute. Controls key scoping in IKeyStore.