feat(security): introduce IKekProvider abstraction (Azure prep, Phase 1)

Foundation for the Azure-native KEK provider work: extracts a stable
abstraction over KEK wrap/unwrap so the existing PBKDF2 path and a future
Azure Key Vault path can be selected per slot without changing DataKeyService.

New in Core/Security/:
- IKekProvider: async Wrap/Unwrap with slot AAD binding and KekSecret
  variants (PassphraseSecret, RecoveryEntropySecret); persisted KekSlotMetadata
  carries provider name + (optional) PBKDF2 salt/iter + (future) Key Vault key URI.
- PbKdf2KekProvider: drop-in implementation that delegates to the existing
  DataKeyWrapper + KekDerivation primitives, producing byte-identical wraps
  so existing DB rows continue to unwrap correctly.
- KekProviderRegistry: name lookup for unwrap (provider chosen from persisted
  metadata) and capability-based default selection for new wraps (host DI order
  controls preference; Azure host will put KeyVaultKekProvider first).

DI wiring:
- Worker and Web hosts register PbKdf2KekProvider + KekProviderRegistry.
- DataKeyService is NOT routed through the registry yet — that comes in
  Phase 2 alongside KeyVaultKekProvider so the refactor can be validated
  with both providers in hand.

Tests (+14, total now 64 green):
- Round-trip for both slots
- BACKWARD COMPAT: provider unwraps wraps produced by the legacy static
  helpers (proves no DB migration is needed for existing on-prem installs)
- Wrong passphrase / wrong slot AAD / mismatched provider metadata all
  throw CryptographicException or ArgumentException as appropriate
- Registry: name resolution, default-for-slot selection, duplicate rejection

Build green on both BitLockerKeyMonitor.slnx and BitLockerKeyMonitor.Azure.slnx.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: robgrame

src/BitLockerKeyMonitor.Core/Security/IKekProvider.cs

@@ -0,0 +1,82 @@
+namespace BitLockerKeyMonitor.Core.Security;
+
+/// <summary>
+/// Identifies the slot a wrap is bound to. Re-uses the same enum semantics as
+/// <see cref="DataKeyWrapper.WrapSlot"/> so the slot AAD remains consistent between
+/// the primitive (AES-GCM wrap with slot-bound AAD) and the high-level provider API.
+/// </summary>
+public enum KekWrapSlot
+{
+    Passphrase = 0,
+    Recovery = 1
+}
+
+/// <summary>
+/// Secret material supplied by the caller to a <see cref="IKekProvider"/>. The provider
+/// pattern-matches on the concrete type. Providers MAY support a subset (e.g. the future
+/// KeyVault provider will reject <see cref="PassphraseSecret"/> because the KEK is held
+/// in Key Vault and unwrapped via Managed Identity, not derived from a passphrase).
+/// </summary>
+public abstract record KekSecret;
+
+/// <summary>Operator-supplied passphrase (UTF-8). Used for the operational slot on on-prem.</summary>
+public sealed record PassphraseSecret(string Passphrase) : KekSecret;
+
+/// <summary>256-bit recovery entropy decoded from a BIP39 24-word mnemonic. Used for the recovery slot.</summary>
+public sealed record RecoveryEntropySecret(ReadOnlyMemory<byte> Entropy) : KekSecret;
+
+/// <summary>
+/// Opaque metadata describing how a slot was wrapped, persisted in
+/// <see cref="Models.DbEncryptionState"/> alongside the wrapped bytes. Required to unwrap
+/// later. The provider name disambiguates which <see cref="IKekProvider"/> in the registry
+/// produced the wrap (and therefore knows how to read its metadata).
+///
+/// Phase 1 (PBKDF2): <see cref="Salt"/> + <see cref="Iterations"/> are populated, <see cref="KeyId"/> is null.
+/// Phase 2 (KeyVault): <see cref="KeyId"/> is populated with the versioned key URI, the others may be null.
+/// </summary>
+/// <param name="ProviderName">Stable identifier (e.g. "PBKDF2-SHA256", "AzureKeyVault-RSA-OAEP-256").</param>
+/// <param name="Salt">PBKDF2 salt, or null for non-KDF providers.</param>
+/// <param name="Iterations">PBKDF2 iteration count, or null for non-KDF providers.</param>
+/// <param name="KeyId">Key Vault versioned key identifier URI for KV providers, or null.</param>
+public sealed record KekSlotMetadata(
+    string ProviderName,
+    byte[]? Salt,
+    int? Iterations,
+    string? KeyId);
+
+/// <summary>Result of wrapping a DEK. Both fields MUST be persisted to enable later unwrap.</summary>
+public sealed record KekWrapResult(byte[] WrappedBytes, KekSlotMetadata Metadata);
+
+/// <summary>
+/// Abstraction for KEK-based DEK wrapping/unwrapping. Lets the same
+/// <see cref="Services.DataKeyService"/> orchestrator support multiple KEK custodians:
+///
+/// <list type="bullet">
+///   <item>PBKDF2 provider (on-prem default): derives KEK from passphrase or recovery entropy, AES-GCM wraps the DEK.</item>
+///   <item>Azure Key Vault provider (Azure-native, Phase 2): RSA wrap/unwrap via Managed Identity; KEK never leaves Key Vault.</item>
+/// </list>
+///
+/// The interface is async because Key Vault calls are network-bound; PBKDF2 implementations
+/// MAY return completed tasks synchronously (CPU-bound).
+/// </summary>
+public interface IKekProvider
+{
+    /// <summary>Stable identifier matching <see cref="KekSlotMetadata.ProviderName"/>.</summary>
+    string ProviderName { get; }
+
+    /// <summary>Whether this provider can serve the given slot with the given secret type. The registry uses this to pick the right provider per operation.</summary>
+    bool CanHandle(KekWrapSlot slot, KekSecret secret);
+
+    /// <summary>
+    /// Wrap a freshly-generated DEK. Returns the bytes to persist plus the metadata that
+    /// must also be persisted so a later call to <see cref="UnwrapAsync"/> can succeed.
+    /// </summary>
+    Task<KekWrapResult> WrapAsync(byte[] dek, KekWrapSlot slot, KekSecret secret, CancellationToken ct = default);
+
+    /// <summary>
+    /// Unwrap the DEK using the previously-persisted wrap + metadata + the caller-supplied secret.
+    /// Throws <see cref="System.Security.Cryptography.CryptographicException"/> on tag/MAC failure
+    /// (wrong secret, tampered wrap, wrong slot, wrong provider metadata).
+    /// </summary>
+    Task<byte[]> UnwrapAsync(byte[] wrappedBytes, KekWrapSlot slot, KekSlotMetadata metadata, KekSecret secret, CancellationToken ct = default);
+}

src/BitLockerKeyMonitor.Core/Security/IKekProviderRegistry.cs

@@ -0,0 +1,73 @@
+namespace BitLockerKeyMonitor.Core.Security;
+
+/// <summary>
+/// Registry for the set of <see cref="IKekProvider"/> implementations available in the host.
+/// <see cref="Services.DataKeyService"/> uses it to:
+///
+/// <list type="bullet">
+///   <item>Pick a provider for a NEW wrap (based on slot + secret type, via <see cref="GetDefaultFor"/>).</item>
+///   <item>Resolve the provider that produced an EXISTING wrap from the persisted provider name
+///         (<see cref="Get(string)"/>) so the right metadata interpretation is applied during unwrap.</item>
+/// </list>
+///
+/// Hosts register concrete providers in DI; the registry composes them.
+/// </summary>
+public interface IKekProviderRegistry
+{
+    /// <summary>Resolve a provider by its <see cref="IKekProvider.ProviderName"/>. Throws if unknown.</summary>
+    IKekProvider Get(string providerName);
+
+    /// <summary>
+    /// Pick the provider responsible for wrapping a NEW slot given the supplied secret type.
+    /// On-prem hosts return PbKdf2KekProvider for both slots; Azure hosts return KeyVault for
+    /// the operational slot and PBKDF2 for the recovery slot (BIP39 break-glass preserved).
+    /// </summary>
+    IKekProvider GetDefaultFor(KekWrapSlot slot, KekSecret secret);
+}
+
+/// <summary>
+/// Simple registry built from a fixed sequence of providers (DI list). The FIRST provider in the
+/// sequence whose <see cref="IKekProvider.CanHandle"/> returns true is considered the default
+/// for a (slot, secret) pair — so host startup controls preference order by DI ordering.
+/// </summary>
+public sealed class KekProviderRegistry : IKekProviderRegistry
+{
+    private readonly Dictionary<string, IKekProvider> _byName;
+    private readonly IReadOnlyList<IKekProvider> _ordered;
+
+    public KekProviderRegistry(IEnumerable<IKekProvider> providers)
+    {
+        ArgumentNullException.ThrowIfNull(providers);
+        _ordered = providers.ToList();
+        _byName = new Dictionary<string, IKekProvider>(StringComparer.Ordinal);
+        foreach (var p in _ordered)
+        {
+            if (_byName.ContainsKey(p.ProviderName))
+                throw new InvalidOperationException($"Duplicate IKekProvider registered with name '{p.ProviderName}'.");
+            _byName.Add(p.ProviderName, p);
+        }
+        if (_byName.Count == 0)
+            throw new InvalidOperationException("At least one IKekProvider must be registered.");
+    }
+
+    public IKekProvider Get(string providerName)
+    {
+        ArgumentException.ThrowIfNullOrEmpty(providerName);
+        if (_byName.TryGetValue(providerName, out var provider))
+            return provider;
+        throw new InvalidOperationException(
+            $"No IKekProvider registered for provider name '{providerName}'. Registered providers: {string.Join(", ", _byName.Keys)}.");
+    }
+
+    public IKekProvider GetDefaultFor(KekWrapSlot slot, KekSecret secret)
+    {
+        ArgumentNullException.ThrowIfNull(secret);
+        foreach (var p in _ordered)
+        {
+            if (p.CanHandle(slot, secret))
+                return p;
+        }
+        throw new InvalidOperationException(
+            $"No registered IKekProvider can handle slot={slot} with secret type {secret.GetType().Name}.");
+    }
+}

src/BitLockerKeyMonitor.Core/Security/PbKdf2KekProvider.cs

@@ -0,0 +1,99 @@
+namespace BitLockerKeyMonitor.Core.Security;
+
+/// <summary>
+/// Default on-prem KEK provider: derives the KEK with PBKDF2-SHA256 from either the operational
+/// passphrase or the 256-bit recovery entropy, then wraps the DEK with AES-256-GCM via
+/// <see cref="DataKeyWrapper"/>. Produces byte-identical output to the pre-refactor implementation
+/// so existing DB rows continue to unwrap correctly without any migration.
+///
+/// <para>
+/// Iteration counts: operational passphrase uses <see cref="KekDerivation.DefaultPassphraseIterations"/>
+/// (600k, OWASP-2024 calibrated to ~200-400 ms on server CPUs). Recovery entropy uses
+/// <see cref="KekDerivation.DefaultRecoveryIterations"/> (100k — the entropy already carries 256
+/// bits so KDF stretching is cosmetic).
+/// </para>
+/// </summary>
+public sealed class PbKdf2KekProvider : IKekProvider
+{
+    public string ProviderName => KekDerivation.PbKdf2Sha256;
+
+    public bool CanHandle(KekWrapSlot slot, KekSecret secret) => secret switch
+    {
+        PassphraseSecret => slot == KekWrapSlot.Passphrase,
+        RecoveryEntropySecret => slot == KekWrapSlot.Recovery,
+        _ => false
+    };
+
+    public Task<KekWrapResult> WrapAsync(byte[] dek, KekWrapSlot slot, KekSecret secret, CancellationToken ct = default)
+    {
+        ct.ThrowIfCancellationRequested();
+        if (dek is null || dek.Length != DataKeyWrapper.DekSize)
+            throw new ArgumentException($"DEK must be {DataKeyWrapper.DekSize} bytes.", nameof(dek));
+
+        var salt = KekDerivation.GenerateSalt();
+        var (kek, iterations) = DeriveKek(secret, salt);
+        try
+        {
+            var wrappedBytes = DataKeyWrapper.Wrap(dek, kek, ToWrapperSlot(slot));
+            var metadata = new KekSlotMetadata(
+                ProviderName: ProviderName,
+                Salt: salt,
+                Iterations: iterations,
+                KeyId: null);
+            return Task.FromResult(new KekWrapResult(wrappedBytes, metadata));
+        }
+        finally
+        {
+            System.Security.Cryptography.CryptographicOperations.ZeroMemory(kek);
+        }
+    }
+
+    public Task<byte[]> UnwrapAsync(byte[] wrappedBytes, KekWrapSlot slot, KekSlotMetadata metadata, KekSecret secret, CancellationToken ct = default)
+    {
+        ct.ThrowIfCancellationRequested();
+        if (wrappedBytes is null) throw new ArgumentNullException(nameof(wrappedBytes));
+        if (metadata is null) throw new ArgumentNullException(nameof(metadata));
+        if (!string.Equals(metadata.ProviderName, ProviderName, StringComparison.Ordinal))
+            throw new ArgumentException($"Metadata provider '{metadata.ProviderName}' does not match this provider '{ProviderName}'.", nameof(metadata));
+        if (metadata.Salt is null || metadata.Salt.Length != KekDerivation.SaltSize)
+            throw new ArgumentException($"PBKDF2 unwrap requires a {KekDerivation.SaltSize}-byte salt in metadata.", nameof(metadata));
+        if (metadata.Iterations is null || metadata.Iterations.Value < 1)
+            throw new ArgumentException("PBKDF2 unwrap requires a positive iteration count in metadata.", nameof(metadata));
+
+        var kek = DeriveKek(secret, metadata.Salt, metadata.Iterations.Value);
+        try
+        {
+            var dek = DataKeyWrapper.Unwrap(wrappedBytes, kek, ToWrapperSlot(slot));
+            return Task.FromResult(dek);
+        }
+        finally
+        {
+            System.Security.Cryptography.CryptographicOperations.ZeroMemory(kek);
+        }
+    }
+
+    private static (byte[] kek, int iterations) DeriveKek(KekSecret secret, byte[] salt) => secret switch
+    {
+        PassphraseSecret p => (
+            KekDerivation.DeriveFromPassphrase(p.Passphrase, salt, KekDerivation.DefaultPassphraseIterations),
+            KekDerivation.DefaultPassphraseIterations),
+        RecoveryEntropySecret r => (
+            KekDerivation.DeriveFromRecoveryEntropy(r.Entropy.Span, salt, KekDerivation.DefaultRecoveryIterations),
+            KekDerivation.DefaultRecoveryIterations),
+        _ => throw new NotSupportedException($"PbKdf2KekProvider does not support secret type '{secret?.GetType().Name ?? "<null>"}'.")
+    };
+
+    private static byte[] DeriveKek(KekSecret secret, byte[] salt, int iterations) => secret switch
+    {
+        PassphraseSecret p => KekDerivation.DeriveFromPassphrase(p.Passphrase, salt, iterations),
+        RecoveryEntropySecret r => KekDerivation.DeriveFromRecoveryEntropy(r.Entropy.Span, salt, iterations),
+        _ => throw new NotSupportedException($"PbKdf2KekProvider does not support secret type '{secret?.GetType().Name ?? "<null>"}'.")
+    };
+
+    private static DataKeyWrapper.WrapSlot ToWrapperSlot(KekWrapSlot slot) => slot switch
+    {
+        KekWrapSlot.Passphrase => DataKeyWrapper.WrapSlot.Passphrase,
+        KekWrapSlot.Recovery => DataKeyWrapper.WrapSlot.Recovery,
+        _ => throw new ArgumentOutOfRangeException(nameof(slot))
+    };
+}

src/BitLockerKeyMonitor.Web/Program.cs

@@ -151,6 +151,13 @@
     builder.Services.AddSingleton<BitLockerKeyMonitor.Core.Services.Interfaces.IDataKeyService,
         BitLockerKeyMonitor.Core.Services.DataKeyService>();
 
+    // KEK provider registry (mirror Worker registration so Web/Worker behave identically
+    // for any future wrap/unwrap operation initiated from the portal).
+    builder.Services.AddSingleton<BitLockerKeyMonitor.Core.Security.IKekProvider,
+        BitLockerKeyMonitor.Core.Security.PbKdf2KekProvider>();
+    builder.Services.AddSingleton<BitLockerKeyMonitor.Core.Security.IKekProviderRegistry,
+        BitLockerKeyMonitor.Core.Security.KekProviderRegistry>();
+
     // Blazor
     builder.Services.AddCascadingAuthenticationState();
     builder.Services.AddRazorComponents()

src/BitLockerKeyMonitor.Worker/Program.cs

@@ -78,6 +78,15 @@
     builder.Services.AddSingleton<BitLockerKeyMonitor.Core.Services.Interfaces.IDataKeyService,
         BitLockerKeyMonitor.Core.Services.DataKeyService>();
 
+    // KEK provider registry. On-prem hosts (Worker, Web) only register the PBKDF2 provider;
+    // the Azure-native Functions host will additionally register KeyVaultKekProvider so the
+    // operational slot can be wrapped by an HSM-backed key. The registry is consumed by
+    // DataKeyService when the slot wrap/unwrap codepaths are routed through IKekProvider.
+    builder.Services.AddSingleton<BitLockerKeyMonitor.Core.Security.IKekProvider,
+        BitLockerKeyMonitor.Core.Security.PbKdf2KekProvider>();
+    builder.Services.AddSingleton<BitLockerKeyMonitor.Core.Security.IKekProviderRegistry,
+        BitLockerKeyMonitor.Core.Security.KekProviderRegistry>();
+
     // HttpClient + Polly v8 resilience pipeline for Microsoft Graph.
     //
     // NOTE on retry settings source-of-truth: