Class PiiAesGcmSymmetricEncryption

Namespace

SEBT.Portal.Infrastructure.Services

Assembly

SEBT.Portal.Infrastructure.dll

AEAD envelopes for reversible PII: AES-GCM / 96-bit nonce / 128-bit tag. Format is stable + versioned (EnvelopePrefix).

public sealed class PiiAesGcmSymmetricEncryption : IPiiSymmetricEncryption

Inheritance

object

PiiAesGcmSymmetricEncryption

Implements

IPiiSymmetricEncryption

Constructors

PiiAesGcmSymmetricEncryption(IOptions<PiiEncryptionSettings>)

public PiiAesGcmSymmetricEncryption(IOptions<PiiEncryptionSettings> options)

Parameters

options IOptions<PiiEncryptionSettings>

Fields

EnvelopePrefix

public const string EnvelopePrefix = "sep-pii:v1:"

Field Value

string

EnvelopeVersion

public const byte EnvelopeVersion = 1

Field Value

byte

Methods

Decrypt(string)

Requires a valid authenticated envelope produced by this service — throws PiiDecryptException on mismatch.

public string Decrypt(string storedValue)

Parameters

storedValue string

Returns

string

DecryptOrPassThroughLegacy(string?)

Converts stored column text to plaintext. Envelopes decrypt; non-envelope values are returned verbatim (migration / legacy plaintext). Throws PiiDecryptException for envelopes that decrypt but fail AEAD verification.

public string? DecryptOrPassThroughLegacy(string? storedValue)

Parameters

storedValue string

Returns

string

Encrypt(string?)

Returns null when plaintext is null or empty.

public string? Encrypt(string? plaintext)

Parameters

plaintext string

Returns

string

IsEnvelope(string?)

True when the stored value was produced by Encrypt(string?) (case-sensitive prefix).

public bool IsEnvelope(string? storedValue)

Parameters

storedValue string

Returns

bool

ReSealWithActiveEncryptor(string)

Decrypts ciphertext (IsEnvelope(string?) true), then seals it again using the configured active encryptor (key rotation / re-pack helper).

public string ReSealWithActiveEncryptor(string envelopeCiphertext)

Parameters

envelopeCiphertext string

Returns

string