DKNet.Svc.Encryption 10.1.24

DKNet.Svc.Encryption

Standalone, explicitly-invoked cryptography toolkit: AES-GCM encryption, RSA encrypt/sign, HMAC and SHA hashing, and Base64/Base64URL helpers, all operating on UTF-8 strings. For transparent EF Core column encryption instead, see DKNet.EfCore.Encryption — a different package.

Features

• IAesGcmEncryption — authenticated AES-256-GCM encryption with optional associated data
• IRsaEncryption — RSA encrypt/decrypt (OAEP-SHA256) and sign/verify (PKCS1-SHA256), including public-key-only instances
• IHmacHashing / IShaHashing — HMAC-SHA256/512 and SHA-256/512 compute + constant-time verify
• Base64StringExtensions — Base64 and Base64URL encode/decode helpers

Installation

dotnet add package DKNet.Svc.Encryption

Quick Start

using DKNet.Svc.Encryption;
using DKNet.Svc.Encryption.Ciphers;

builder.Services.AddEncryptionServices();                                       // HMAC + SHA hashing
builder.Services.AddAesGcmEncryption(builder.Configuration["Crypto:AesKey"]!);  // singleton IAesGcmEncryption

public sealed class SecretStore(IAesGcmEncryption aesGcm)
{
    public string Protect(string plainText) => aesGcm.EncryptString(plainText);
    public string Reveal(string cipherPackage) => aesGcm.DecryptString(cipherPackage);
}

Migration — namespace changes in this release

Root types were grouped into concern folders; the namespace of each moved type now ends with its folder name. This is an import-only source break: no type was renamed, removed, resignatured, or had its behaviour changed — update the using line and you're done.

EncryptionSetup (registration point) and Base64StringExtensions (the Base64/Base64URL encoding helpers) stay at DKNet.Svc.Encryption.

Configuration — registration and constructor surface

There is no options type and no IConfiguration binding path. Everything a caller can vary is an argument.

All three are idempotent — a second call registers nothing, so the first call's key is the one the application uses. The two cipher methods throw ArgumentException for a null, empty, or whitespace key.

Fixed, non-configurable choices: AES-GCM uses a fresh 12-byte nonce and a 16-byte tag per call and packages the result as Base64 of base64(nonce):base64(tag):base64(cipher); RSA uses OAEP-SHA256 for encryption and SHA-256 with PKCS#1 v1.5 for signatures; keys are exported as raw PKCS#1 DER in Base64, not PEM; every Verify* compares with CryptographicOperations.FixedTimeEquals.

Documentation

Full feature reference, configuration, and gotchas: https://github.com/baoduy/DKNet/blob/main/docs/Services/DKNet.Svc.Encryption.md