Removes every cached key handle.
Call this on logout or whenever the authenticated identity changes to avoid leaving usable decryption capability behind.
Returns the cached key handle for the given key, or undefined on a miss.
Stores a key handle under the given key.
Strategy for caching the per-map derived key material handles used by EncryptedMaps.
Deriving key material requires a canister round-trip and threshold cryptography, so it is cached and reused. The cached value is a non-extractable CryptoKey handle: its raw bytes can never be read back (
crypto.subtle.exportKeythrows), but the handle can still be used to decrypt. Where that handle lives therefore matters for security — see the provided implementations.Cache entries are keyed by an opaque string derived from the map owner and map name. Derived key material is per map, not per caller, so the key does not encode the identity. Isolating one identity's cached keys from another's on the same origin is therefore a property of the cache instance: use a fresh cache per identity (the in-memory default is naturally per-instance), or give a persistent cache a per-identity namespace (see IndexedDbDerivedKeyMaterialCache).