#### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index')
### [Abblix\.Jwt\.Encryption](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption 'Abblix\.Jwt\.Encryption')

## DeterministicAeadEncryptor Class

Deterministic authenticated encryption bound to associated data: the same plaintext and associated data always
seal to the same bytes, different inputs seal to unrelated bytes, and tampering or a wrong associated data is
rejected on opening\. This is the property a reversible, stable pseudonym needs \- a value that is opaque and
unlinkable to outsiders yet recoverable by the holder of the key, and identical across sessions and hosts for the
same input\.

```csharp
public sealed class DeterministicAeadEncryptor
```

Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → DeterministicAeadEncryptor

### Remarks
The encryption is AES Key Wrap with Padding \(RFC 5649 / NIST SP 800\-38F KWP\) via [Abblix\.Jwt\.Encryption\.AesKeyWrapPadded](https://learn.microsoft.com/en-us/dotnet/api/abblix.jwt.encryption.aeskeywrappadded 'Abblix\.Jwt\.Encryption\.AesKeyWrapPadded'),
a standardised deterministic authenticated encryption whose integrity check rejects any tampered value on
unwrap\. RFC 5649 has no associated\-data input, so the associated data is bound into the key instead: a distinct
key encryption key is derived per associated\-data value by HKDF, so a value sealed for one context cannot be
opened under another \- its integrity check fails\. The supplied key is the sole secret; HKDF expands it, mixing
the associated data into the context label, into a 256\-bit key encryption key\.
### Constructors

## DeterministicAeadEncryptor\(HashAlgorithmName, byte\[\]\) Constructor {#Abblix.Jwt.Encryption.DeterministicAeadEncryptor.DeterministicAeadEncryptor(System.Security.Cryptography.HashAlgorithmName,byte[])}

Creates an encryptor whose per\-context key encryption keys are derived from [key](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.DeterministicAeadEncryptor#Abblix.Jwt.Encryption.DeterministicAeadEncryptor.DeterministicAeadEncryptor(System.Security.Cryptography.HashAlgorithmName,byte[]).key 'Abblix\.Jwt\.Encryption\.DeterministicAeadEncryptor\.DeterministicAeadEncryptor\(System\.Security\.Cryptography\.HashAlgorithmName, byte\[\]\)\.key') by HKDF\.

```csharp
public DeterministicAeadEncryptor(System.Security.Cryptography.HashAlgorithmName hashAlgorithm, byte[] key);
```
#### Parameters

###### `hashAlgorithm` [System\.Security\.Cryptography\.HashAlgorithmName](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.hashalgorithmname 'System\.Security\.Cryptography\.HashAlgorithmName') {#Abblix.Jwt.Encryption.DeterministicAeadEncryptor.DeterministicAeadEncryptor(System.Security.Cryptography.HashAlgorithmName,byte[]).hashAlgorithm}

The hash used for the HKDF key derivation\. Defaults to SHA\-256 at the call sites;
            a caller honouring host\-configured pairwise settings passes their chosen algorithm\.

###### `key` [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Jwt.Encryption.DeterministicAeadEncryptor.DeterministicAeadEncryptor(System.Security.Cryptography.HashAlgorithmName,byte[]).key}

The key material\. Its secrecy is the whole security of the seal\.
### Methods

## DeterministicAeadEncryptor\.Open\(ReadOnlySpan\<byte\>, ReadOnlySpan\<byte\>\) Method {#Abblix.Jwt.Encryption.DeterministicAeadEncryptor.Open(System.ReadOnlySpan_byte_,System.ReadOnlySpan_byte_)}

Opens a value produced by [Seal\(ReadOnlySpan&lt;byte&gt;, ReadOnlySpan&lt;byte&gt;\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.DeterministicAeadEncryptor#Abblix.Jwt.Encryption.DeterministicAeadEncryptor.Seal(System.ReadOnlySpan_byte_,System.ReadOnlySpan_byte_) 'Abblix\.Jwt\.Encryption\.DeterministicAeadEncryptor\.Seal\(System\.ReadOnlySpan\<byte\>, System\.ReadOnlySpan\<byte\>\)') under the same [associatedData](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.DeterministicAeadEncryptor#Abblix.Jwt.Encryption.DeterministicAeadEncryptor.Open(System.ReadOnlySpan_byte_,System.ReadOnlySpan_byte_).associatedData 'Abblix\.Jwt\.Encryption\.DeterministicAeadEncryptor\.Open\(System\.ReadOnlySpan\<byte\>, System\.ReadOnlySpan\<byte\>\)\.associatedData')\.

```csharp
public byte[]? Open(System.ReadOnlySpan<byte> sealedData, System.ReadOnlySpan<byte> associatedData);
```
#### Parameters

###### `sealedData` [System\.ReadOnlySpan&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.readonlyspan-1 'System\.ReadOnlySpan\`1')[System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.readonlyspan-1 'System\.ReadOnlySpan\`1') {#Abblix.Jwt.Encryption.DeterministicAeadEncryptor.Open(System.ReadOnlySpan_byte_,System.ReadOnlySpan_byte_).sealedData}

###### `associatedData` [System\.ReadOnlySpan&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.readonlyspan-1 'System\.ReadOnlySpan\`1')[System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.readonlyspan-1 'System\.ReadOnlySpan\`1') {#Abblix.Jwt.Encryption.DeterministicAeadEncryptor.Open(System.ReadOnlySpan_byte_,System.ReadOnlySpan_byte_).associatedData}

#### Returns
[System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')  
The recovered plaintext, or `null` when the value is malformed, tampered, or bound to
            different associated data\.

## DeterministicAeadEncryptor\.Seal\(ReadOnlySpan\<byte\>, ReadOnlySpan\<byte\>\) Method {#Abblix.Jwt.Encryption.DeterministicAeadEncryptor.Seal(System.ReadOnlySpan_byte_,System.ReadOnlySpan_byte_)}

Seals [plaintext](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.DeterministicAeadEncryptor#Abblix.Jwt.Encryption.DeterministicAeadEncryptor.Seal(System.ReadOnlySpan_byte_,System.ReadOnlySpan_byte_).plaintext 'Abblix\.Jwt\.Encryption\.DeterministicAeadEncryptor\.Seal\(System\.ReadOnlySpan\<byte\>, System\.ReadOnlySpan\<byte\>\)\.plaintext') bound to [associatedData](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.DeterministicAeadEncryptor#Abblix.Jwt.Encryption.DeterministicAeadEncryptor.Seal(System.ReadOnlySpan_byte_,System.ReadOnlySpan_byte_).associatedData 'Abblix\.Jwt\.Encryption\.DeterministicAeadEncryptor\.Seal\(System\.ReadOnlySpan\<byte\>, System\.ReadOnlySpan\<byte\>\)\.associatedData')\. Deterministic: the same
inputs always return the same bytes\.

```csharp
public byte[] Seal(System.ReadOnlySpan<byte> plaintext, System.ReadOnlySpan<byte> associatedData);
```
#### Parameters

###### `plaintext` [System\.ReadOnlySpan&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.readonlyspan-1 'System\.ReadOnlySpan\`1')[System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.readonlyspan-1 'System\.ReadOnlySpan\`1') {#Abblix.Jwt.Encryption.DeterministicAeadEncryptor.Seal(System.ReadOnlySpan_byte_,System.ReadOnlySpan_byte_).plaintext}

###### `associatedData` [System\.ReadOnlySpan&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.readonlyspan-1 'System\.ReadOnlySpan\`1')[System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.readonlyspan-1 'System\.ReadOnlySpan\`1') {#Abblix.Jwt.Encryption.DeterministicAeadEncryptor.Seal(System.ReadOnlySpan_byte_,System.ReadOnlySpan_byte_).associatedData}

#### Returns
[System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')