Kryptic.Encryption 1.0.3

Kryptic.Encryption (.NET)

The C# implementation of Kryptic's open-source (Apache-2.0) encryption engine. This is the package the Kryptic Platform consumes: envelope parsing, Argon2id password hashing, and operational ciphertexts the server itself must read (SSO IdP secrets, directory sync credentials). Customer secret values are end-to-end encrypted on clients; this library is not a decrypt path for those values.

NuGet package id: Kryptic.Encryption (unchanged). This GitHub repository is named Kryptic.Encryption.Net so auditors can tell the three runtimes apart.

Sibling implementations of the same wire formats:

A format change (envelope, sealed box, Argon2id parameters) must land in all three repositories in the same release. The committed files in interop-vectors/ are the contract: every runtime must open and, where the test is deterministic, reproduce those bytes.

No custom primitives. The engine composes established, widely audited implementations exclusively:

• AES-256-GCM via .NET platform cryptography (System.Security.Cryptography.AesGcm)
• Argon2id via Konscious.Security.Cryptography.Argon2
• CSPRNG via System.Security.Cryptography.RandomNumberGenerator

Kryptic's engineering lives in the composition: the envelope format, the key hierarchy, nonce management, context binding, and parameter versioning. Never in the primitives. Read SECURITY.md for the full security architecture before reading code.

Install

dotnet add package Kryptic.Encryption

What's in the box

Usage

Encrypt and decrypt a secret

using Kryptic.Encryption;

byte[] dataKey = DataKeys.GenerateDataKey();
string keyId   = DataKeys.GenerateKeyId();

// Context binds the ciphertext to where it belongs - moving it elsewhere fails decryption.
string context = $"secret:{secretId}:env:{environmentId}";

string stored    = SecretCipher.EncryptString(dataKey, keyId, "postgres://…", context);
string plaintext = SecretCipher.DecryptString(dataKey, stored, context);

Envelope encryption (key hierarchy)

The wrapping key is whoever you pass in. Kryptic secret values are end-to-end encrypted: the org key that opens them exists only on clients (browser, daemon, CI), delivered via SealedBox grants. The platform uses WrapKey/UnwrapKey only for operational ciphertexts it must read itself, such as SSO IdP client secrets, never for your secret values.

// The data key is stored only in wrapped form, never in plaintext.
SecretEnvelope wrapped = DataKeys.WrapKey(wrappingKey, "key_x01", dataKey);
byte[] unwrapped       = DataKeys.UnwrapKey(wrappingKey, wrapped);

Seal a key to a recipient (end-to-end delivery)

// e.g. an admin's browser granting the org key to an approved daemon device.
KeyPair device = SealedBox.GenerateKeyPair();

SealedKey grant  = SealedBox.Seal(device.PublicKey, "device-key-1", orgKey);
byte[] received  = SealedBox.Open(device, grant); // only the device can do this

Derive a key from a passphrase

byte[] salt = Argon2KeyDerivation.GenerateSalt();
byte[] key  = Argon2KeyDerivation.DeriveKey(passphrase, salt); // Argon2id, 64 MiB, 3 passes

Hash a password

string hash = PasswordHasher.Hash(password);
bool ok     = PasswordHasher.Verify(password, hash);

Build & test

dotnet build
dotnet test

Publishing (maintainers)

CI lives in .github/workflows/publish.yml. Pull requests only run tests. A publish on main (or workflow_dispatch) commits the version bump, pushes it as the Kryptic Release Bot, publishes the package, then tags vX.Y.Z and opens a GitHub Release.

GitHub Actions secrets

Add these at the org or on the GitHub repo (Settings > Secrets and variables > Actions):

Trusted publishing setup on nuget.org (one-time):

1. Sign in as the package owner.
2. Open Trusted Publishing for Kryptic.Encryption.
3. Register this GitHub repository (dev-kryptic/Kryptic.Encryption.Net), the Build and publish workflow, and the main branch.

If the GitHub repo was renamed from Kryptic.Encryption, update the trusted-publishing registration to dev-kryptic/Kryptic.Encryption.Net or publishes will fail OIDC. On GitHub: Settings > General > Repository name.

No other secrets are required for git. The Release Bot is a ruleset bypass actor and commits the csproj version, the vX.Y.Z tag, and the GitHub Release.

Versioning

Patch versions auto-increment from the latest nuget.org release when major.minor is unchanged. To ship 1.1.0 or 2.0.0, set <Version> in Kryptic.Encryption/Kryptic.Encryption.csproj (or pass it to workflow_dispatch) and the workflow publishes that version as-is.

Reporting vulnerabilities

Please report security issues to security@kryptic.dev. See SECURITY.md for the disclosure process. Do not open public issues for vulnerabilities.

License

Apache-2.0