Package com.kingsrook.qqq.backend.core.crypto


package com.kingsrook.qqq.backend.core.crypto
  • Class
    Description
    Base for key providers that look up base64 text by name.
    Key provider that reads base64 keys from AWS Secrets Manager, through SecretsManagerUtils (so it uses the same SECRETS_MANAGER_* environment configuration).
    Key provider that reads base64 keys from environment variables - which is how Infisical-via-ESO and Kubernetes secrets arrive.
    Shared key handling: validating key ids and decoding base64 key text.
    A resolved key: its bytes, the id (the keyRef) that names it, and its version.
    Source of symmetric key-encryption keys, addressed by a key reference.
    Streaming authenticated encryption of large artifacts (e.g., backup files), built on Google Tink's StreamingAead (AES256_GCM_HKDF_1MB), which authenticates every segment and detects truncation.