Interface IKmsProvider

Namespace

FishMMO.Auth.Implementation

Assembly

FishMMO-AuthShared.dll

Abstraction over a Key Management Service. Allows operators to plug in AWS KMS, Vault, PKCS#11/HSM, or other backends in place of the local-derive default.

public interface IKmsProvider

Remarks

The TOTP master KEK is currently derived from the LoginServer's HMAC signing key via HMAC-SHA256 with a domain separator. That binds the KEK lifetime to the signing-key lifetime and exposes it in process memory for the lifetime of the server. An external KMS unwrap call should only return the cleartext KEK for the duration of an envelope-decrypt operation; integrating one requires this interface.

Methods

DeriveKey(string)

Derives or unwraps a 32-byte symmetric key for the given context. Callers should zero the returned buffer with ZeroMemory(Span<byte>) as soon as the operation completes.

byte[] DeriveKey(string context)

Parameters

context string

Stable application-defined key identifier (e.g. "totp-master-key-v1").

Returns

byte[]

Cleartext 32-byte key material.