Interface PrivateKeyProvider

All Known Subinterfaces:
CryptoKeyProvider
All Known Implementing Classes:
PemFileKeyProvider
public interface PrivateKeyProvider
Consumer-side SPI: load a private key by name for end-to-end message decryption.

The provider is consulted on every encrypted message the consumer receives. The signature is asynchronous so an implementation backed by a remote KMS (Vault, AWS KMS, GCP KMS, ...) can fetch keys without blocking the client's IO thread. For local key stores, return a completed future.

For a simple file-based provider, see PemFileKeyProvider.

  • Method Details

    • getPrivateKey

      CompletableFuture<EncryptionKey> getPrivateKey(String keyName, Map<String,String> metadata)
      Look up the private key for the given name.

      metadata carries any hints the producer attached when the message was encrypted — typically a key version or rotation marker. Implementations that don't rotate keys can ignore it.

      Parameters:
      keyName - the key identifier the producer used to encrypt
      metadata - producer-supplied hints about the key (never null; empty when the producer didn't attach any)
      Returns:
      a future completing with the private key, or completing exceptionally if the key cannot be found or loaded