WrappedKey

Purpose

A GroupKey in transit — sealed to exactly one recipient, so the swarm that carries it can neither read it nor use it. It is delivered to the recipient alone — the swarm hands it only to them, and how it is addressed on the wire is the relay adapter's concern. The wrapping says why it travels: an invitation brings a new member into their first epoch of a group; a rotation hands a continuing member the next epoch's key. How the material is sealed to the recipient is the boundary's carried concern; what the domain owns is that only the recipient unwraps it.

Attributes

• key id: is Text that identifies the group key inside, such as "k-0150"
• recipient: the sub of the Member the key is sealed to
• sealed material: is Text that carries the wrapped key material, opaque
• wrapping: is one of "invitation", "rotation" that says why the key travels

Invariants

• The wrapping is recognised.

Scenarios

A rotation delivery for a continuing member

Given: key id "k-0264", recipient "sofie.lind", sealed material "sm-0264", and wrapping "rotation" When: a WrappedKey is created Then: it is accepted as a rotation delivery of "k-0264" for "sofie.lind"

An invitation delivery for a new member

Given: key id "k-0150", recipient "sofie.lind", sealed material, and wrapping "invitation" When: a WrappedKey is created Then: it is accepted as an invitation delivery of "k-0150" for "sofie.lind"

An unrecognised wrapping is rejected

Given: key id "k-0150", recipient "sofie.lind", sealed material, and wrapping "gift" When: a WrappedKey is created Then: the creation is rejected because the wrapping is not recognised