DeterministicAeadEncryptor Class
Deterministic authenticated encryption bound to associated data: the same plaintext and associated data always seal to the same bytes, different inputs seal to unrelated bytes, and tampering or a wrong associated data is rejected on opening. This is the property a reversible, stable pseudonym needs - a value that is opaque and unlinkable to outsiders yet recoverable by the holder of the key, and identical across sessions and hosts for the same input.
public sealed class DeterministicAeadEncryptorInheritance System.Object → DeterministicAeadEncryptor
Remarks
The encryption is AES Key Wrap with Padding (RFC 5649 / NIST SP 800-38F KWP) via Abblix.Jwt.Encryption.AesKeyWrapPadded, a standardised deterministic authenticated encryption whose integrity check rejects any tampered value on unwrap. RFC 5649 has no associated-data input, so the associated data is bound into the key instead: a distinct key encryption key is derived per associated-data value by HKDF, so a value sealed for one context cannot be opened under another - its integrity check fails. The supplied key is the sole secret; HKDF expands it, mixing the associated data into the context label, into a 256-bit key encryption key.
Constructors
DeterministicAeadEncryptor(HashAlgorithmName, byte[]) Constructor
Creates an encryptor whose per-context key encryption keys are derived from key by HKDF.
public DeterministicAeadEncryptor(System.Security.Cryptography.HashAlgorithmName hashAlgorithm, byte[] key);Parameters
hashAlgorithm System.Security.Cryptography.HashAlgorithmName
The hash used for the HKDF key derivation. Defaults to SHA-256 at the call sites; a caller honouring host-configured pairwise settings passes their chosen algorithm.
key System.Byte[]
The key material. Its secrecy is the whole security of the seal.
Methods
DeterministicAeadEncryptor.Open(ReadOnlySpan<byte>, ReadOnlySpan<byte>) Method
Opens a value produced by Seal(ReadOnlySpan<byte>, ReadOnlySpan<byte>) under the same associatedData.
public byte[]? Open(System.ReadOnlySpan<byte> sealedData, System.ReadOnlySpan<byte> associatedData);Parameters
sealedData System.ReadOnlySpan<System.Byte>
associatedData System.ReadOnlySpan<System.Byte>
Returns
System.Byte[]
The recovered plaintext, or null when the value is malformed, tampered, or bound to
different associated data.
DeterministicAeadEncryptor.Seal(ReadOnlySpan<byte>, ReadOnlySpan<byte>) Method
Seals plaintext bound to associatedData. Deterministic: the same inputs always return the same bytes.
public byte[] Seal(System.ReadOnlySpan<byte> plaintext, System.ReadOnlySpan<byte> associatedData);