Class SigningKeyKekProvider

Namespace

FishMMO.Server.Implementation

Assembly

FishMMO.Server.dll

Loads the deployment-shared 32-byte AES-256 KEK used by KeyEnvelope to wrap per-LoginServer HMAC signing keys at rest. The KEK MUST be identical across the LoginServer process (which writes wrapped blobs) and every World/Scene server (which unwraps them) for a given deployment.

public static class SigningKeyKekProvider

Inheritance

object

SigningKeyKekProvider

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

Resolution order:

1. deployment_secrets database table with key='signing_key_kek'.

The value must Base64-decode to exactly 32 bytes. A short, missing, or malformed key is a fatal configuration error — the server SHOULD refuse to start. No environment variable or .cfg file fallback is supported.

Fields

DatabaseKey

Database key for the signing key KEK in the deployment_secrets table.

public const string DatabaseKey = "signing_key_kek"

Field Value

string

KekLength

Required KEK byte length (AES-256).

public const int KekLength = 32

Field Value

int

Methods

BuildAad(long)

Builds the 8-byte big-endian AAD bound to wrapped signing-key blobs. AAD = the owning LoginServer's stable row id, so a blob copied between rows fails authentication.

public static byte[] BuildAad(long loginServerId)

Parameters

loginServerId long

Returns

byte[]

LoadFromDatabaseAsync(IDeploymentSecretService, CancellationToken)

Loads the signing-key KEK from the deployment_secrets database table without blocking any thread. This is the preferred entry point — the token-verification path is already asynchronous and must never block a worker on a database round trip.

public static Task<SigningKeyKekProvider.KekLoadResult> LoadFromDatabaseAsync(IDeploymentSecretService secretService, CancellationToken cancellationToken = default)

Parameters

secretService IDeploymentSecretService

Deployment secret service.

cancellationToken CancellationToken

Cancellation token.

Returns

Task<SigningKeyKekProvider.KekLoadResult>

The loaded key, or a failure carrying the reason.