IndexedDB database name. Defaults to "ic-vetkeys". This
is the isolation knob: give each identity its own database name (e.g.
`vetkeys-${principal}`) so one identity's persisted keys are never
served to another. The object store name is fixed, because idb-keyval
supports only a single object store per database.
Removes every cached key handle.
Call this on logout or whenever the authenticated identity changes to avoid leaving usable decryption capability behind.
Returns the cached key handle for the given key, or undefined on a miss.
Stores a key handle under the given key.
Opt-in DerivedKeyMaterialCache that persists key handles in IndexedDB.
Key handles survive page reloads, avoiding repeated key derivation, but this is a deliberate security trade-off: the persisted handle is non-extractable (its raw bytes cannot be stolen), yet any same-origin code — e.g. via XSS, a malicious extension, or a shared browser profile — can read the handle and use it to decrypt the user's data without an authenticated session, for as long as it remains stored.
Prefer InMemoryDerivedKeyMaterialCache (the default) unless you need cross-reload persistence and accept this exposure. When using this cache, be sure to call EncryptedMaps.clearCache on logout or identity change.
Because the cache key does not encode the identity, give the store a per-identity namespace to keep one identity's persisted keys from being served to another on the same origin — e.g. include the caller's principal in the database name:
A dedicated IndexedDB store is used, so clear only removes entries written by this cache and never touches other application data.