Interface IIdentifierHasher

Namespace

SEBT.Portal.Core.Services

Assembly

SEBT.Portal.Core.dll

Hashes sensitive identifiers (including low-entropy values like SSNs) for secure storage and search. Uses HMAC-SHA256 so the same plaintext produces the same hash for lookup.

public interface IIdentifierHasher

Methods

Hash(string?)

Hashes a plaintext identifier for storage. Input normalization is implementation-specific.

string? Hash(string? plaintext)

Parameters

plaintext string

The plaintext identifier to hash.

Returns

string

The HMAC-SHA256 hash as a 64-character hex string, or null if input is null/whitespace.

HashForAnalytics(string?)

Hashes a value for emission to analytics tools. Skips the storage-side normalization (no trim, no dash/space stripping) and returns lowercase hex so external pipelines can reproduce the digest from a published reference algorithm. Returns null if input is null/whitespace. See docs/analytics/hashed-sebt-app-id.md for the contract.

string? HashForAnalytics(string? plaintext)

Parameters

plaintext string

The plaintext identifier to hash.

Returns

string

The HMAC-SHA256 hash as a 64-character lowercase hex string, or null.

HashForStorage(string?)

Returns the value suitable for storage. If the value is already a stored hash (64 hex chars), returns as-is. Otherwise hashes the plaintext. Use when updating records to avoid double-hashing.

string? HashForStorage(string? value)

Parameters

value string

Returns

string

Matches(string?, string?)

Verifies that the given plaintext produces the stored hash using constant-time comparison.

bool Matches(string? plaintext, string? storedHash)

Parameters

plaintext string

The plaintext identifier to verify.

storedHash string

The hash stored in the database.

Returns

bool

True if the plaintext hashes to the stored hash.