Fact.KeyRing (Fact v0.4.0)

Holds the Data Encryption Key (DEK) in memory for a database instance.

The Fact.KeyRing is started as part of the Fact.DatabaseSupervisor when the database is configured with encryption. At startup, it unwraps the DEK using the configured Fact.Encryption.KEKProvider and holds it in memory for the lifetime of the database.

Summary

option()

generate_dek()

Generates a random 256-bit DEK.

Retrieves the DEK for the given database.

Unwraps a DEK using a KEK.

Wraps a DEK with a KEK using AES-256-GCM.

(since 0.4.0)

@type option() ::
  {:database_id, Fact.database_id()}
  | {:wrapped_dek, binary()}
  | {:kek, binary()}
  | {:name, GenServer.name()}

(since 0.4.0)

@spec generate_dek() :: binary()

Generates a random 256-bit DEK.

(since 0.4.0)

@spec get_dek(Fact.database_id()) :: {:ok, binary()} | {:error, term()}

Retrieves the DEK for the given database.

(since 0.4.0)

@spec unwrap_dek(wrapped_dek :: binary(), kek :: binary()) ::
  {:ok, binary()} | {:error, term()}

Unwraps a DEK using a KEK.

Expects the wrapped DEK format: <<nonce::12-bytes, auth_tag::16-bytes, ciphertext::binary>>.

(since 0.4.0)

@spec wrap_dek(dek :: binary(), kek :: binary()) :: binary()

Wraps a DEK with a KEK using AES-256-GCM.

Returns the wrapped DEK as <<nonce::12-bytes, auth_tag::16-bytes, ciphertext::binary>>.