kiosk-ops-sdk/com.sarastarquant.kioskops.sdk.crypto

Package-level declarations

Types

class AesGcmKeystoreCryptoProvider(alias: String = "kioskops_aes_gcm_v1") : CryptoProvider

AES-GCM with a hardware-backed key when available.

data class AttestationResponse(val challenge: ByteArray, val attestationChain: List<X509Certificate>, val signature: ByteArray)

Response to an attestation challenge.

ConditionalCryptoProvider

class ConditionalCryptoProvider(enabledProvider: () -> Boolean, delegate: CryptoProvider) : CryptoProvider

Wraps a real crypto provider and turns it into a configuration-driven switch.

CryptoProvider

interface CryptoProvider

DatabaseEncryptionPolicy

data class DatabaseEncryptionPolicy(val enabled: Boolean = false)

Policy for database-at-rest encryption via SQLCipher.

DatabaseEncryptionProvider

object DatabaseEncryptionProvider

Provides SQLCipher SupportSQLiteOpenHelper.Factory for Room database encryption.

DerivedKeyResult

data class DerivedKeyResult(val key: SecretKey, val salt: ByteArray, val algorithm: String, val iterationCount: Int)

Result of a key derivation operation.

FieldEncryptionException

class FieldEncryptionException(message: String, cause: Throwable? = null) : RuntimeException

Thrown when field-level encryption or decryption fails. Callers MUST NOT forward the original plaintext when this is raised; doing so defeats the purpose of field-level encryption. Instead, reject the event or surface the failure to an error listener.

FieldEncryptionPolicy

data class FieldEncryptionPolicy(val enabled: Boolean = false, val encryptedFields: Map<String, Set<String>> = emptyMap(), val defaultEncryptedFields: Set<String> = emptySet())

Policy controlling field-level encryption within event payloads.

FieldLevelEncryptor

class FieldLevelEncryptor(crypto: CryptoProvider)

Encrypts individual JSON fields into envelope format before document encryption.

KeyAttestationReporter

class KeyAttestationReporter(context: Context)

Reports on key attestation status for compliance and security auditing.

KeyAttestationStatus

data class KeyAttestationStatus(val isHardwareBacked: Boolean, val securityLevel: SecurityLevel, val keyCreatedAt: Long?, val attestationChain: List<X509Certificate>?, val keyAlias: String, val keyAlgorithm: String?, val keySize: Int?)

Attestation status for a cryptographic key.

KeyDerivationConfig

data class KeyDerivationConfig(val algorithm: String = "PBKDF2WithHmacSHA256", val iterationCount: Int, val saltLengthBytes: Int = 32, val keyLengthBits: Int = 256)

Configuration for password-based key derivation.

KeyMetadata

@Serializable

data class KeyMetadata(val version: Int, val createdAtMs: Long, val algorithm: String, val keyLengthBits: Int, val rotatedFromVersion: Int? = null, val isHardwareBacked: Boolean? = null)

Metadata for an encryption key version.

KeyMetadataStore

class KeyMetadataStore(context: Context, baseAlias: String)

Persistent storage for key version metadata.

KeyRotationPolicy

data class KeyRotationPolicy(val maxKeyAgeDays: Int = 365, val autoRotateEnabled: Boolean = false, val retainOldKeysForDays: Int = 90, val maxKeyVersions: Int = 5)

Policy for encryption key rotation.

NoopCryptoProvider

object NoopCryptoProvider : CryptoProvider

RotationResult

sealed class RotationResult

Result of a key rotation operation.

SecureKeyDerivation

class SecureKeyDerivation(config: KeyDerivationConfig = KeyDerivationConfig.default())

Secure key derivation using PBKDF2.

SecurityLevel

enum SecurityLevel : Enum<SecurityLevel>

Security level of a cryptographic key.

VersionedCryptoProvider

class VersionedCryptoProvider(context: Context, baseAlias: String = "kioskops_versioned", rotationPolicy: KeyRotationPolicy = KeyRotationPolicy.default(), clock: () -> Long = { System.currentTimeMillis() }) : CryptoProvider

Crypto provider with key versioning and rotation support.