#### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index')
### [Abblix\.Jwt\.Encryption](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption 'Abblix\.Jwt\.Encryption')

## IContentKeyDecryptor Interface

The JWE key\-recovery seam: recovers the Content Encryption Key for a recipient key, routed per key to the
backend that owns it\. This is the encryption counterpart of [IDataSigner](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Signing.IDataSigner 'Abblix\.Jwt\.Signing\.IDataSigner') and, like it,
carries ONLY the private operation: recovering the CEK needs the recipient's private/secret half, so a
public\-only key routes to an external custodian\. Producing a JWE \(wrapping the CEK\) uses the recipient's
PUBLIC half for asymmetric algorithms, or a locally held shared secret for symmetric ones, so it never needs
a custodian and never passes through this seam \- it stays in [IJsonWebTokenEncryptor](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IJsonWebTokenEncryptor 'Abblix\.Jwt\.IJsonWebTokenEncryptor'), exactly as
signature verification stays out of [IDataSigner](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Signing.IDataSigner 'Abblix\.Jwt\.Signing\.IDataSigner')\. Backends compose as peers behind
[Abblix\.Jwt\.Encryption\.CompositeDecryptor](https://learn.microsoft.com/en-us/dotnet/api/abblix.jwt.encryption.compositedecryptor 'Abblix\.Jwt\.Encryption\.CompositeDecryptor'): [Abblix\.Jwt\.Encryption\.LocalKeyDecryptor](https://learn.microsoft.com/en-us/dotnet/api/abblix.jwt.encryption.localkeydecryptor 'Abblix\.Jwt\.Encryption\.LocalKeyDecryptor') unwraps in process, an external
custodian backend \([Abblix\.Jwt\.ExternalKeys\.ExternalKeyDecryptor](https://learn.microsoft.com/en-us/dotnet/api/abblix.jwt.externalkeys.externalkeydecryptor 'Abblix\.Jwt\.ExternalKeys\.ExternalKeyDecryptor')\) unwraps against an HSM/KMS/vault\.

```csharp
public interface IContentKeyDecryptor
```
### Methods

## IContentKeyDecryptor\.CanDecrypt\(JsonWebKey\) Method {#Abblix.Jwt.Encryption.IContentKeyDecryptor.CanDecrypt(Abblix.Jwt.JsonWebKey)}

Reports whether this backend owns recovering the CEK for [key](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.IContentKeyDecryptor#Abblix.Jwt.Encryption.IContentKeyDecryptor.CanDecrypt(Abblix.Jwt.JsonWebKey).key 'Abblix\.Jwt\.Encryption\.IContentKeyDecryptor\.CanDecrypt\(Abblix\.Jwt\.JsonWebKey\)\.key')\. The in\-process backend
owns any key that carries its private/secret material; an external custodian backend owns any key
published public\-only, whose private half lives with the custodian\.

```csharp
bool CanDecrypt(Abblix.Jwt.JsonWebKey key);
```
#### Parameters

###### `key` [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') {#Abblix.Jwt.Encryption.IContentKeyDecryptor.CanDecrypt(Abblix.Jwt.JsonWebKey).key}

The recipient decryption key the seam is about to route\.

#### Returns
[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')  
`true` if this backend can recover the CEK for [key](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.IContentKeyDecryptor#Abblix.Jwt.Encryption.IContentKeyDecryptor.CanDecrypt(Abblix.Jwt.JsonWebKey).key 'Abblix\.Jwt\.Encryption\.IContentKeyDecryptor\.CanDecrypt\(Abblix\.Jwt\.JsonWebKey\)\.key')\.

## IContentKeyDecryptor\.DecryptKeyAsync\(JsonWebTokenHeader, JsonWebKey, string, byte\[\], CancellationToken\) Method {#Abblix.Jwt.Encryption.IContentKeyDecryptor.DecryptKeyAsync(Abblix.Jwt.JsonWebTokenHeader,Abblix.Jwt.JsonWebKey,string,byte[],System.Threading.CancellationToken)}

Recovers the Content Encryption Key from [encryptedKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.IContentKeyDecryptor#Abblix.Jwt.Encryption.IContentKeyDecryptor.DecryptKeyAsync(Abblix.Jwt.JsonWebTokenHeader,Abblix.Jwt.JsonWebKey,string,byte[],System.Threading.CancellationToken).encryptedKey 'Abblix\.Jwt\.Encryption\.IContentKeyDecryptor\.DecryptKeyAsync\(Abblix\.Jwt\.JsonWebTokenHeader, Abblix\.Jwt\.JsonWebKey, string, byte\[\], System\.Threading\.CancellationToken\)\.encryptedKey'): an RSA decryption, a symmetric
unwrap, or an ECDH\-ES agreement, selected by [algorithm](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.IContentKeyDecryptor#Abblix.Jwt.Encryption.IContentKeyDecryptor.DecryptKeyAsync(Abblix.Jwt.JsonWebTokenHeader,Abblix.Jwt.JsonWebKey,string,byte[],System.Threading.CancellationToken).algorithm 'Abblix\.Jwt\.Encryption\.IContentKeyDecryptor\.DecryptKeyAsync\(Abblix\.Jwt\.JsonWebTokenHeader, Abblix\.Jwt\.JsonWebKey, string, byte\[\], System\.Threading\.CancellationToken\)\.algorithm')\. Returns null on a decryption
failure \- wrong key, bad ciphertext, unsupported algorithm, or a malformed header parameter \- so a wrong
key is indistinguishable from a bad ciphertext \(the RFC 7516 §11\.5 mitigation upstream relies on this\)\. A
key with no decryption path at all \(a public\-only key with no custodian, which a correct configuration
never presents\) fails loud instead\.

```csharp
System.Threading.Tasks.Task<byte[]?> DecryptKeyAsync(Abblix.Jwt.JsonWebTokenHeader header, Abblix.Jwt.JsonWebKey key, string algorithm, byte[] encryptedKey, System.Threading.CancellationToken cancellationToken);
```
#### Parameters

###### `header` [JsonWebTokenHeader](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenHeader 'Abblix\.Jwt\.JsonWebTokenHeader') {#Abblix.Jwt.Encryption.IContentKeyDecryptor.DecryptKeyAsync(Abblix.Jwt.JsonWebTokenHeader,Abblix.Jwt.JsonWebKey,string,byte[],System.Threading.CancellationToken).header}

The JWE header; ECDH\-ES and AES\-GCM key wrap read parameters from it\.

###### `key` [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') {#Abblix.Jwt.Encryption.IContentKeyDecryptor.DecryptKeyAsync(Abblix.Jwt.JsonWebTokenHeader,Abblix.Jwt.JsonWebKey,string,byte[],System.Threading.CancellationToken).key}

The recipient decryption key\. Its `kid` is the custodian's handle when external\.

###### `algorithm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.Encryption.IContentKeyDecryptor.DecryptKeyAsync(Abblix.Jwt.JsonWebTokenHeader,Abblix.Jwt.JsonWebKey,string,byte[],System.Threading.CancellationToken).algorithm}

The JWE `alg` value identifying the key\-management operation\.

###### `encryptedKey` [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Jwt.Encryption.IContentKeyDecryptor.DecryptKeyAsync(Abblix.Jwt.JsonWebTokenHeader,Abblix.Jwt.JsonWebKey,string,byte[],System.Threading.CancellationToken).encryptedKey}

The wrapped or RSA\-encrypted CEK from the JWE Encrypted Key\.

###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Jwt.Encryption.IContentKeyDecryptor.DecryptKeyAsync(Abblix.Jwt.JsonWebTokenHeader,Abblix.Jwt.JsonWebKey,string,byte[],System.Threading.CancellationToken).cancellationToken}

Cancels the operation, including a custodian round\-trip\.

#### Returns
[System\.Threading\.Tasks\.Task&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')  
The recovered CEK, or null on a decryption failure\.