Skip to main content

WrappedDEKInput

Input shape for one envelope. Carries everything the unwrap path needs except the receiver private key (which is derived in the browser from the passkey PRF output and never leaves the device).

input WrappedDEKInput {
  passkeyEncryptionKeyID: ID!
  ephemeralPubkey: String!
  wrappedDek: String!
  nonce: String!
}

Fields​

WrappedDEKInput.passkeyEncryptionKeyID ● ID! non-null scalar​

The PasskeyEncryptionKey row id this DEK is wrapped to. Must belong to one of the resource owner's active (non-revoked) keys.

WrappedDEKInput.ephemeralPubkey ● String! non-null scalar​

Sender ephemeral X25519 public key from the wrap-time keypair, base64-standard.

WrappedDEKInput.wrappedDek ● String! non-null scalar​

AES-GCM ciphertext of the 32-byte DEK, base64-standard.

WrappedDEKInput.nonce ● String! non-null scalar​

AES-GCM nonce used during the wrap, base64-standard.

Member Of​

SetStrategyWrappedDEKsInput input