PenguinConverters.Keyra.KeyStorageProvider.AesGcm.xml
|
<?xml version="1.0"?>
<doc> <assembly> <name>PenguinConverters.Keyra.KeyStorageProvider.AesGcm</name> </assembly> <members> <member name="T:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.AesGcmKeyProtection"> <summary> Password-based key protection — a thin delegate to the Rust engine's portable password scheme (Argon2id KEK + AES-256-GCM). Cross-platform; the engine owns the cryptography and hands back the parameters (salt, recipe) for the caller to record in the key's provider block. Nothing is embedded in the ciphertext, so nothing here parses a blob. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.AesGcmKeyProtection.ProtectKey(System.Byte[],System.Security.SecureString)"> <summary> Protects an AES key with a password, produced entirely by the native engine (CLAUDE.md Architecture Rule 8 — no managed crypto). Returns the raw ciphertext together with the salt and recipe the caller must record in the key's provider block; without them the key cannot be read back. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.AesGcmKeyProtection.UnprotectKey(System.Byte[],System.Security.SecureString,System.Byte[],System.String)"> <summary> Recovers the AES key from raw <paramref name="ciphertext"/> using the password plus the salt and recipe recorded in the key's provider block. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.AesGcmKeyProtection.ComputeVerificationHash(System.Byte[])"> <summary> Computes a verification hash from an AES key. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.AesGcmKeyProtection.VerifyKey(System.Byte[],System.String)"> <summary> Verifies a decrypted key matches a stored verification hash. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.AesGcmKeyProtection.ToUtf8PasswordBytes(System.Security.SecureString)"> <summary> Extracts the UTF-8 bytes of a <see cref="T:System.Security.SecureString"/> password. The caller owns the returned buffer and must zero it after use. </summary> </member> <member name="T:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Configuration"> <summary> Configuration for the AES-GCM Key Storage Provider. </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Configuration.KeyGeneratorTypeName"> <summary> Optional key generator type name for JSON deserialization. Defaults to RandomKeyGenerator if not specified. </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Configuration.KeyGenerator"> <summary> Key generator instance (not serialized, resolved from type name). </summary> </member> <member name="T:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Generators.RandomKeyGenerator"> <summary> Generates cryptographically secure random AES-256 keys. </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Generators.RandomKeyGenerator.DisplayName"> <inheritdoc/> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Generators.RandomKeyGenerator.Description"> <inheritdoc/> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Generators.RandomKeyGenerator.RequiresUserInput"> <inheritdoc/> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Generators.RandomKeyGenerator.KeySizeBytes"> <inheritdoc/> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Generators.RandomKeyGenerator.Algorithm"> <inheritdoc/> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Generators.RandomKeyGenerator.GenerateKey"> <inheritdoc/> </member> <member name="T:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Key"> <summary> AES-256-GCM key for encrypting/decrypting vault secrets. Uses <see cref="T:PenguinConverters.CandyStore.AesGcmCrypto"/> for all encryption operations. </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Key.Cipher"> <summary> The native cipher holding this key's material, for the provider in this assembly. The raw key never crosses the managed boundary; operations on it run inside the engine. </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Key.KeyNext"> <inheritdoc/> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Key.KeyStorageProvider"> <inheritdoc/> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Key.KeyStorageProviderEscrow"> <inheritdoc/> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Key.MaxSecretSize"> <inheritdoc/> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Key.Algorithm"> <inheritdoc/> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Key.KeyEncipherment"> <inheritdoc/> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Key.Identifier"> <inheritdoc/> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Key.Password"> <summary> Password from authenticator chain (write-only for security). </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Key.#ctor"> <summary> Default constructor. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Key.#ctor(PenguinConverters.CandyStore.KeyraSecretCipher,System.String)"> <summary> Constructor with a native value cipher and identifier. The cipher holds the master key inside the Rust engine; this key takes ownership and disposes it. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Key.Decrypt(System.String)"> <inheritdoc/> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Key.Encrypt(System.Security.SecureString)"> <inheritdoc/> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Key.EncryptBytes(System.Byte[])"> <inheritdoc/> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Key.DecryptBytes(System.String)"> <inheritdoc/> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Key.GetMetadata"> <inheritdoc/> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Key.Delete"> <inheritdoc/> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Key.Export(PenguinConverters.Keyra.Core.Package@,System.String,System.Security.SecureString)"> <summary> Exports the key to a package using the unified <c>.key</c> format. The AES key is re-protected with the supplied password so the export is fully portable (the protection blob is self-describing and embeds its own salt). </summary> <param name="package">Archive to reference for export.</param> <param name="path">Path inside the archive to use for exporting.</param> <param name="password"> Password used to protect the exported key. Required — AES-GCM keys are always password-protected and cannot be exported portably without one. </param> <exception cref="T:System.InvalidOperationException"> Thrown when the key is not initialized (vault locked) or no password is supplied. </exception> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Key.Dispose(System.Boolean)"> <inheritdoc/> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Key.Dispose"> <inheritdoc/> </member> <member name="T:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.KeyMetadata"> <summary> Metadata for stored AES-GCM protected keys. Serialized to .key files as JSON. </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.KeyMetadata.KeyId"> <summary> Unique key identifier (e.g., "keyra.a1b2c3d4..."). </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.KeyMetadata.ProtectedBlob"> <summary> Password-protected key blob (Base64 encoded). </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.KeyMetadata.CreatedUtc"> <summary> Key creation timestamp (UTC). </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.KeyMetadata.Algorithm"> <summary> Encryption algorithm used. </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.KeyMetadata.Version"> <summary> Metadata format version. </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.KeyMetadata.ProviderTypeId"> <summary> Provider type identifier for unified .key format. Used to determine which provider should load this key file. </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.KeyMetadata.KeyVerificationHash"> <summary> Key verification hash (Base64). SHA256(key || "KeyraVerification.v1"). </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.KeyMetadata.Provider"> <summary> How this key is protected: the provider that owns it plus that provider's own parameters (salt and KDF recipe for the portable password scheme). This is the ONLY description of the derivation - there is no second, summarized copy that could drift from the recipe that ran. </summary> </member> <member name="T:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Metadata"> <summary> Metadata for the cross-platform AES-GCM Key Storage Provider. Key protection relies on the authenticator chain (password, YubiKey). No OS-level binding — portable across Windows, macOS, and Linux. </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Metadata.ProviderTypeId"> <inheritdoc/> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Metadata.DisplayName"> <inheritdoc/> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Metadata.Description"> <inheritdoc/> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Metadata.SupportedKeySizes"> <inheritdoc/> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Metadata.DefaultKeySize"> <inheritdoc/> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Metadata.SupportsKeyExpiration"> <inheritdoc/> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Metadata.DefaultExpiration"> <inheritdoc/> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Metadata.SupportsAuthenticatorChain"> <inheritdoc/> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Metadata.SupportedAuthenticators"> <inheritdoc/> </member> <member name="T:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Provider"> <summary> Cross-platform AES-GCM Key Storage Provider. Protects vault master keys using password-derived AES-GCM encryption. No OS-level binding — works on Windows, macOS, and Linux. </summary> </member> <member name="F:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Provider.PROVIDER_TYPE_ID"> <summary>This provider's id - the sole discriminator for the keys it owns.</summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Provider.Configuration"> <summary> Provider configuration. </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Provider.Identifier"> <inheritdoc/> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Provider.MaxSecretSize"> <inheritdoc/> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Provider.Namespace"> <inheritdoc/> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Provider.#ctor"> <summary> Default constructor. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Provider.#ctor(PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Configuration)"> <summary> Constructor with configuration. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Provider.GenerateKey"> <inheritdoc/> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Provider.GenerateKey(System.Security.SecureString)"> <inheritdoc/> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Provider.GenerateKey(System.Security.SecureString,System.Byte[])"> <inheritdoc/> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Provider.FindKeyByIdentifier(System.String,System.Security.SecureString)"> <inheritdoc/> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Provider.OpenCipherViaRust(System.String,System.String,System.Security.SecureString)"> <summary> Rust-only <c>.key</c> load into a native cipher: the engine parses the on-disk metadata JSON, Base64-decodes + unprotects the blob with <paramref name="password"/>, and verifies the stored hash — the recovered key stays inside Rust (throws on bad password / corrupt file / hash mismatch). </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Provider.DeleteKey(System.String)"> <summary> Deletes a key file by identifier. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Provider.Delete"> <inheritdoc/> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Provider.CreateKeyEntry(System.Security.SecureString,System.Byte[])"> <inheritdoc/> <remarks> Nothing is written here: the entry carries the ciphertext plus the salt and recipe needed to read it back, and Core persists the document. </remarks> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Provider.ReprotectKeyEntry(PenguinConverters.Keyra.Core.KeyStorageProvider.IKey,System.Security.SecureString)"> <inheritdoc/> <remarks> The re-protect happens inside the native engine: the raw key stays in Rust and only the new ciphertext, its verification hash and the provider block cross the boundary. The block carries a fresh salt and the recipe used, so the result is portable to any head with this provider. </remarks> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Provider.OpenKeyEntry(PenguinConverters.Keyra.Core.SecretStorageProvider.VaultKeyEntry,System.Security.SecureString)"> <inheritdoc/> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Provider.BuildProviderBlock(PenguinConverters.CandyStore.KeyraNativeCrypto.ProtectedKeyResult)"> <summary> Builds this provider's block for a freshly protected key: the id that routes the key back here, plus the salt and recipe the engine actually used. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Provider.PasswordToUtf8(System.Security.SecureString)"> <summary>Marshals a <see cref="T:System.Security.SecureString"/> to UTF-8 bytes (the encoding the AES-GCM keystore protection uses). Caller must zero the returned buffer.</summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Provider.Dispose(System.Boolean)"> <inheritdoc/> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Provider.Dispose"> <inheritdoc/> </member> <member name="T:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.ProviderBuilder"> <summary> Builder for creating AES-GCM Key Storage Provider instances. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.ProviderBuilder.AddVaultIdentifier(System.String)"> <inheritdoc/> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.ProviderBuilder.AddConfiguration(System.Byte[])"> <inheritdoc/> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.ProviderBuilder.AddConfiguration(PenguinConverters.Keyra.KeyStorageProvider.AesGcm.Configuration)"> <summary> Sets the provider configuration directly. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.AesGcm.ProviderBuilder.Build"> <inheritdoc/> </member> </members> </doc> |