SecretEnvelope class

The encrypted payload one client of an atSign sends to another (addressed to a specific APKAM keypair). The whole envelope is additionally wrapped in an APKAM signature (see EnvelopeSigning) which receivers verify before decrypting.

appNamespace travels inside the signature, so the namespace a receiver files a payload under is one the sender signed rather than whatever the envelope's key name says.

The sealing-suite id (suite) and recipient key id (kid) are explicit for crypto agility: today sealed is an at_chops pqSeal envelope (KEM encapsulation + AEAD over an HKDF key schedule, suite per the envelope's version byte); a future suite changes the id, not the schema.

Constructors

SecretEnvelope({required String fromKpid, required String fromEnrollmentId, required String toKpid, required String appNamespace, required String suite, required String kid, required String sealed, int v = currentVersion})

Properties

appNamespace → String

The application namespace the sender addressed this envelope through.

final

fromEnrollmentId → String

The sender's enrollment (the envelope is APKAM-signed by it).

final

fromKpid → String

The sender's key-package id (KeyPackage.kpid) — so the recipient of a request can seal its reply straight back to this APKAM keypair.

final

hashCode → int

The hash code for this object.

no setter, inherited

kid → String

Which of the recipient's advertised PackageKeys sealed was sealed to. Equals toKpid today (a key package advertises one enc key); kept distinct for crypto agility (a future package may advertise several).

final

runtimeType → Type

A representation of the runtime type of the object.

no setter, inherited

sealed → String

The sealed payload (an at_chops pqSeal wire envelope — KEM encapsulation, AEAD ciphertext and tag), base64.

final

suite → String

Which sealing suite produced sealed; an id from SecretSharingAlgos.suites.

final

toKpid → String

The recipient key-package id (KeyPackage.kpid) this envelope is addressed to. Routes the envelope (it is the <kpid> segment of the envelope key name) and is what the recipient checks against its own kpid.

final

v → int

final

Methods

noSuchMethod(Invocation invocation) → dynamic

Invoked when a nonexistent method or property is accessed.

inherited

toJson() → Map<String, Object?>

toString() → String

A string representation of this object.

inherited

Operators

operator ==(Object other) → bool

The equality operator.

inherited

Static Methods

fromJson(Object? json) → SecretEnvelope

Parses json, refusing any version but currentVersion, the version that names its namespace and binds its sender into the seal.

Constants

currentVersion → const int