Function: createSoftKeyWrap()
createSoftKeyWrap(
options):Promise<KeyWrap>
Defined in: packages/key-wrap/src/soft.ts:69
Builds the software adapter. It wraps with AES-256-GCM under a 32-byte key encryption
key held in the secret store (base64), authenticating the key id as additional data,
so a value wrapped under one id does not unwrap under another. The id is
soft:v<n>:<first 8 bytes of sha256(kek), hex>. It holds one key; a second version
is a rotation, which re-wraps and is not built yet.
It exits under production, naming KeyWrap, the way the file secret store
does: the check precedes any secret read. Under staging it logs one line,
keywrap.software_custody, saying custody is software. The caller must pass the
environment class from validated configuration. It does not zero the key encryption
key held in this process and does not protect against code running in it.
Parameters
options
Returns
Promise<KeyWrap>
The port.
Throws
Under production, naming KeyWrap.
Throws
The reference could not be resolved.
Throws
bad_kek when the secret is not 32 bytes of base64.