5. DataHandler.SecretManager

Handles the creation, reading, deletion and overall management of secret vaults.

How the vault key works: every bank operation derives its encryption key from the SharedSecretKey string you pass, using PBKDF2-SHA512 (600,000 iterations) salted with a random per-vault salt that CreateBank generates and stores (in plaintext — salts aren't secret) inside the bank file. There is no motherboard-serial default; the SharedSecretKey is required (null/empty throws), and two different banks never derive the same key from the same shared secret.

Types

PublicKeyFile

Represents a reference to an encrypted secret file.

  • Fields:

    • string SecretName (internal set): Logical name of the secret.
    • string SecretPath (internal set): Encrypted path to the secret file.

  • Constructor:

    PublicKeyFile(string secretName, string secretPath)

PublicKeyFileInit

Used to initialize a new secret entry when creating a bank.

  • Fields:

    • string SecretName (internal set): Logical name of the secret.
    • SecureData Value (internal set): Initial secret value.
    • SecureData? SecretPath (internal set): Optional custom directory path.

  • Constructor:
    PublicKeyFileInit(string secretName, SecureData? secretPath, SecureData value)

Methods

CreateBank(string BankDirectory, string BankName, List? PublicKeys, string? SharedSecretKey)

Creates a “bank” JSON file (with its own random vault salt) listing public secrets, and optionally initializes individual secret files.

  • Parameters:

    • BankDirectory: Folder in which to store the bank JSON.
    • BankName: Name of the bank (JSON filename without extension).
    • PublicKeys: Optional list of initial secrets to create.
    • SharedSecretKey: The shared secret the vault key is derived from. Required.

  • Returns: Task

  • Exceptions:

    • Exception if bank already exists or on any file I/O error.

CheckIfBankExists(string BankDirectory, string BankName)

Checks for the existence of the bank JSON file.

  • Parameters:

    • BankDirectory
    • BankName

  • Returns: Task — true if the bank file exists.

GetPublicSecret(string BankDirectory, string BankName, string PublicSecretName, string SharedSecretKey)

Retrieves and decrypts a public secret value from a bank.

  • Parameters:

    • BankDirectory, BankName
    • PublicSecretName: Logical name of the secret to retrieve.
    • SharedSecretKey: The shared secret the vault key is derived from.

  • Returns: Task — Decrypted secret value.

  • Exceptions:

    • Exception if secret not found or on decryption errors.

GetSecretRound(string BankDirectory, string BankName, string PublicSecretName, string SharedSecretKey)

Reads the “Pneumentations” (rotation count) for a public secret.

  • Parameters: Same as GetPublicSecret.

  • Returns: Task — Current rotation count.

AddPublicSecret(string BankDirectory, string BankName, PublicKeyFileInit PublicSecret, string SharedSecretKey)

Adds a new secret to an existing bank, creating its file and encrypting its initial value.

  • Parameters:

    • PublicSecret: Initialization data for the new secret.
    • Others as in CreateBank.

  • Returns: Task

DeletePublicSecret(string BankDirectory, string BankName, string PublicSecretName, string SharedSecretKey)

Removes a secret entry from both the bank JSON and deletes its file.

  • Parameters:

    • PublicSecretName
    • Others as in GetPublicSecret

  • Returns: Task

GetAllSecretNames(string BankDirectory, string BankName, string SharedSecretKey)

Lists all logical secret names in the bank.

  • Returns: Task<List>

RotateSecret(string BankDirectory, string BankName, string PublicSecretName, string SharedSecretKey, string? salt, string? newSalt)

Rotates (re-hashes) a secret’s value, updates its “Pneumentations” count, and writes back.

  • Parameters:

    • SharedSecretKey: The shared secret the vault key is derived from.
    • salt: Existing salt/key for rotation.
    • newSalt: If provided, resets the salt and count.
    • Others as in GetPublicSecret

  • Returns: Task — New rotated secret.

MigratePublicSecrets(string OldBankDirectory, string OldBankName, string OldSharedSecretKey, string NewBankDirectory, string NewBankName, string NewSharedSecretKey, string NewSecretFileDirectory)

Migrates every secret from one bank into a brand-new bank, re-encrypting each under the new bank’s key (which gets its own fresh random salt). It reuses CreateBank + AddPublicSecret, so the new bank is built exactly like any other. The old bank is left in place (delete it yourself if you want).

  • Parameters:

    • OldBankDirectory, OldBankName, OldSharedSecretKey: The source bank and its shared secret.
    • NewBankDirectory, NewBankName, NewSharedSecretKey: The destination bank and its new shared secret.
    • NewSecretFileDirectory: Where the migrated secret files are written.

  • Returns: Task

  • Notes: Rotation counts (Pneumentations) restart at 0 in the new bank — the current, already-rotated value is carried over as the new base. All secrets are migrated (the old draft’s per-secret passwords/paths were dropped in favour of a clean whole-bank re-key).