GuardianGatedEscrowVaultOperations

Interface for guardian-gated escrow vault operations.

The vault stores escrowed KEKs and returns them on request. Currently supports NoGate (direct escrow + retrieve with no authentication). Future gated variants will extend this interface.

Note: The Portable Recovery Kit always lives in user-controlled storage. If the user loses the bundle, recovery is irrecoverable.

Inheritors

Functions

Link copied to clipboard
abstract suspend fun escrowKek(recoveryId: String, kekId: String, kekPlaintext: ByteArray)

Escrow a KEK during backup creation.

Link copied to clipboard
abstract suspend fun retrieveKek(recoveryId: String, kekId: String): ByteArray

Retrieve an escrowed KEK during restore.