TenantBackupEncryptor
in package
Table of Contents
Constants
- DATA_ALGORITHM : mixed = \App\Services\Backups\BackupStreamCipher::ALGOR...
- LEGACY_DATA_ALGORITHM : mixed = 'AES-256-GCM'
- WRAP_ALGORITHM : mixed = 'AES-256-GCM'
Properties
- $streamCipher : BackupStreamCipher|null
Methods
- __construct() : mixed
- decryptFile() : void
- decryptFileForTest() : string
- Test/support helper to verify a stored encrypted backup can be decrypted.
- encryptFile() : TenantBackupEncryptionResult
- exportDataEncryptionKey() : SensitiveString
- Unwrap the data key for one backup without exposing the reusable tenant KEK.
- aad() : string
- decryptLegacyFile() : void
- normalizeKek() : string
- unwrapDek() : array{0: string, 1: string}
-
wrapDek()
: array{0: string, 1: array
Constants
DATA_ALGORITHM
public
mixed
DATA_ALGORITHM
= \App\Services\Backups\BackupStreamCipher::ALGORITHM
LEGACY_DATA_ALGORITHM
public
mixed
LEGACY_DATA_ALGORITHM
= 'AES-256-GCM'
WRAP_ALGORITHM
private
mixed
WRAP_ALGORITHM
= 'AES-256-GCM'
Properties
$streamCipher read-only
private
BackupStreamCipher|null
$streamCipher
= null
Methods
__construct()
public
__construct([BackupStreamCipher|null $streamCipher = null ]) : mixed
Parameters
- $streamCipher : BackupStreamCipher|null = null
decryptFile()
public
decryptFile(string $encryptedPath, string $outputPath, string $wrappedDek, array<string, mixed> $wrappedDekMetadata, SensitiveString $kek) : void
Parameters
- $encryptedPath : string
- $outputPath : string
- $wrappedDek : string
- $wrappedDekMetadata : array<string, mixed>
- $kek : SensitiveString
decryptFileForTest()
Test/support helper to verify a stored encrypted backup can be decrypted.
public
decryptFileForTest(string $encryptedPath, string $wrappedDek, array<string, mixed> $wrappedDekMetadata, SensitiveString $kek) : string
Parameters
- $encryptedPath : string
- $wrappedDek : string
- $wrappedDekMetadata : array<string, mixed>
- $kek : SensitiveString
Return values
stringencryptFile()
public
encryptFile(string $inputPath, string $outputPath, TenantMetadata $tenant, string $backupId, SensitiveString $kek, string $kekName, string $kekVersion) : TenantBackupEncryptionResult
Parameters
- $inputPath : string
- $outputPath : string
- $tenant : TenantMetadata
- $backupId : string
- $kek : SensitiveString
- $kekName : string
- $kekVersion : string
Return values
TenantBackupEncryptionResultexportDataEncryptionKey()
Unwrap the data key for one backup without exposing the reusable tenant KEK.
public
exportDataEncryptionKey(string $wrappedDek, array<string, mixed> $wrappedDekMetadata, SensitiveString $kek, TenantMetadata $tenant, string $backupId) : SensitiveString
Parameters
- $wrappedDek : string
- $wrappedDekMetadata : array<string, mixed>
-
Key wrapping metadata
- $kek : SensitiveString
- $tenant : TenantMetadata
- $backupId : string
Return values
SensitiveStringaad()
private
aad(TenantMetadata $tenant, string $backupId) : string
Parameters
- $tenant : TenantMetadata
- $backupId : string
Return values
stringdecryptLegacyFile()
private
decryptLegacyFile(string $encryptedPath, string $outputPath, string $dek, string $aad) : void
Parameters
- $encryptedPath : string
- $outputPath : string
- $dek : string
- $aad : string
normalizeKek()
private
normalizeKek(SensitiveString $kek) : string
Parameters
- $kek : SensitiveString
Return values
stringunwrapDek()
private
unwrapDek(string $wrappedDek, array<string, mixed> $metadata, SensitiveString $kek) : array{0: string, 1: string}
Parameters
- $wrappedDek : string
- $metadata : array<string, mixed>
- $kek : SensitiveString
Return values
array{0: string, 1: string}wrapDek()
private
wrapDek(string $dek, string $aad, SensitiveString $kek, string $kekName, string $kekVersion) : array{0: string, 1: array}
Parameters
- $dek : string
- $aad : string
- $kek : SensitiveString
- $kekName : string
- $kekVersion : string