Interface SessionProtection

All Known Implementing Classes:

FileSessionProtection

public interface SessionProtection

Workload-owned authenticated encryption. There is deliberately no plaintext or default-key adapter. Implementations must bind every Context component as AAD, use fresh nonces and fail closed on any authentication/key error. Key custody, rotation and physical retention belong to that adapter.

Nested Class Summary

Nested Classes

Modifier and Type	Interface	Description
static final record	SessionProtection.Context
static final record	SessionProtection.SealedValue	Only authenticated ciphertext and a non-secret key version may enter either Model document.

Method Summary

Modifier and Type	Method	Description
SecretValue	open(SessionProtection.Context context, SessionProtection.SealedValue ciphertext)
SessionProtection.SealedValue	seal(SessionProtection.Context context, SecretValue plaintext)

Method Details

seal

SessionProtection.SealedValue seal(SessionProtection.Context context,
 SecretValue plaintext)

open

SecretValue open(SessionProtection.Context context,
 SessionProtection.SealedValue ciphertext)