Interface IResponseKeySaltStore

Namespace

Tessio.Verifier.AspNetCore

Assembly

Tessio.Verifier.AspNetCore.dll

Keeps the salt each request's response-encryption key was derived from, keyed by that key's kid, so whichever instance receives the wallet's response can derive the key again.

public interface IResponseKeySaltStore

Remarks

A salt is not secret: without the master it derives nothing. Both members are synchronous because the library resolves the key through a synchronous callback inside response decryption.

Methods

Find(string)

The salt stored for kid and its expiry, or null when there is none. The store treats an expired salt as absent, so returning one is allowed.

(byte[] Salt, DateTimeOffset ExpiresAt)? Find(string kid)

Parameters

kid string

Returns

(byte[] Salt, DateTimeOffset ExpiresAt)?

Remarks

kid is the value the wallet's response names. It has the shape of a kid the store issues, 43 base64url characters, and is otherwise unchecked: parameterise the lookup and never build a query from it. Match it exactly; a lookup that ignores case is tolerated, and finds no key for a kid whose case was changed.

Save(string, byte[], DateTimeOffset)

Stores salt for kid until expiresAt. It must be visible to every instance when this returns, because the request naming the key is sent right after.

void Save(string kid, byte[] salt, DateTimeOffset expiresAt)

Parameters

kid string

salt byte[]

expiresAt DateTimeOffset