Interface IPiiSymmetricEncryption

Namespace

SEBT.Portal.Core.Services

Assembly

SEBT.Portal.Core.dll

Encrypts/decrypts short UTF-8 strings at rest using an authenticated envelope bound to an explicit key id.

public interface IPiiSymmetricEncryption

Methods

Decrypt(string)

Requires a valid authenticated envelope produced by this service — throws PiiDecryptException on mismatch.

string Decrypt(string storedValue)

Parameters

storedValue string

Returns

string

DecryptOrPassThroughLegacy(string?)

Converts stored column text to plaintext. Envelopes decrypt; non-envelope values are returned verbatim (migration / legacy plaintext). Throws PiiDecryptException for envelopes that decrypt but fail AEAD verification.

string? DecryptOrPassThroughLegacy(string? storedValue)

Parameters

storedValue string

Returns

string

Encrypt(string?)

Returns null when plaintext is null or empty.

string? Encrypt(string? plaintext)

Parameters

plaintext string

Returns

string

IsEnvelope(string?)

True when the stored value was produced by Encrypt(string?) (case-sensitive prefix).

bool IsEnvelope(string? storedValue)

Parameters

storedValue string

Returns

bool

ReSealWithActiveEncryptor(string)

Decrypts ciphertext (IsEnvelope(string?) true), then seals it again using the configured active encryptor (key rotation / re-pack helper).

string ReSealWithActiveEncryptor(string envelopeCiphertext)

Parameters

envelopeCiphertext string

Returns

string