IContentKeyDecryptor Interface

The JWE key-recovery seam: recovers the Content Encryption Key for a recipient key, routed per key to the backend that owns it. This is the encryption counterpart of IDataSigner and, like it, carries ONLY the private operation: recovering the CEK needs the recipient's private/secret half, so a public-only key routes to an external custodian. Producing a JWE (wrapping the CEK) uses the recipient's PUBLIC half for asymmetric algorithms, or a locally held shared secret for symmetric ones, so it never needs a custodian and never passes through this seam - it stays in IJsonWebTokenEncryptor, exactly as signature verification stays out of IDataSigner. Backends compose as peers behind Abblix.Jwt.Encryption.CompositeDecryptor: Abblix.Jwt.Encryption.LocalKeyDecryptor unwraps in process, an external custodian backend (Abblix.Jwt.ExternalKeys.ExternalKeyDecryptor) unwraps against an HSM/KMS/vault.

public interface IContentKeyDecryptor

Methods

IContentKeyDecryptor.CanDecrypt(JsonWebKey) Method

Reports whether this backend owns recovering the CEK for key. The in-process backend owns any key that carries its private/secret material; an external custodian backend owns any key published public-only, whose private half lives with the custodian.

bool CanDecrypt(Abblix.Jwt.JsonWebKey key);

Parameters

`key` JsonWebKey

The recipient decryption key the seam is about to route.

Returns

System.Boolean
true if this backend can recover the CEK for key.

IContentKeyDecryptor.DecryptKeyAsync(JsonWebTokenHeader, JsonWebKey, string, byte[], CancellationToken) Method

Recovers the Content Encryption Key from encryptedKey: an RSA decryption, a symmetric unwrap, or an ECDH-ES agreement, selected by algorithm. Returns null on a decryption failure - wrong key, bad ciphertext, unsupported algorithm, or a malformed header parameter - so a wrong key is indistinguishable from a bad ciphertext (the RFC 7516 §11.5 mitigation upstream relies on this). A key with no decryption path at all (a public-only key with no custodian, which a correct configuration never presents) fails loud instead.

System.Threading.Tasks.Task<byte[]?> DecryptKeyAsync(Abblix.Jwt.JsonWebTokenHeader header, Abblix.Jwt.JsonWebKey key, string algorithm, byte[] encryptedKey, System.Threading.CancellationToken cancellationToken);