ModCrypt 1.2.0

ModCrypt

A lightweight .NET encryption library for protecting application secrets using X.509 certificates or SecretKey.

ModCrypt uses a hybrid encryption approach:

• AES for encrypting the secret data.
• RSA (from an X.509 certificate) for encrypting the AES key.
• Supports secure decryption using the certificate private key.

This makes it suitable for:

• Encrypting configuration values
• Protecting connection strings
• Storing API keys securely

Features

• Hybrid AES + RSA encryption
• X509 certificate-based security
• Supports .NET applications hosted in:
  • IIS
  • Windows Services
  • Console Applications
  • ASP.NET Core
• Configuration provider for encrypted JSON values
• NuGet friendly

Installation

dotnet add package Modulith.ModCrypt

or via NuGet Package Manager:

Install-Package Modulith.ModCrypt

Certificate Requirements

The certificate must:

• Be an X509 certificate with RSA private key
• Supports .pfx and .pem automatically.

How to plugin ModCrypt Library in the Middleware Pipelines inside Program.cs

ProtectedJsonMode

• Auto - Recommended - (check and encrypt automatically)
• Encrypt
• Decrypt

Program.cs

Using Certificate

Example:

using System.Security.Cryptography.X509Certificates;

var cert = X509CertificateLoader.LoadPkcs12FromFile("certificate.pfx", "yourcerticatepassword", X509KeyStorageFlags.PersistKeySet);
var configcrypt = builder.Configuration.AddJsonFile("appsettings.json", optional: false).AddProtectedJsonFile("appsettings.json", new CertificateSecretProtector(cert), ProtectedJsonMode.Auto, encryptedKeyExpressions: new Regex("DBConnectString|EmailUsername|EmailPassword")).Build();

Using Secret-Key

builder.Configuration.AddProtectedJsonFile(path: "appsettings.json",protector: new PasswordSecretProtector("SuperSecret!"),mode: ProtectedJsonMode.Auto,optional: false,reloadOnChange: true,encryptedKeyExpressions: new Regex("DBConnectString|EmailUsername|EmailPassword"));

appsetting.json file

     "DBConnectString" : "Your Connection String",
     "EmailUsername" : "Email Username",
     "EmailPassword" : "Email Password"
}

ASP.NET Core Configuration Encryption

Example:

appsettings.json

{
     "DBConnectString" : "Your Connection String",
     "EmailUsername" : "Email Username",
     "EmailPassword" : "Email Password"
}

Program.cs

var builder = WebApplication.CreateBuilder(args);

//register encrypted configuration provider

var cert = X509CertificateLoader.LoadPkcs12FromFile("certificate.pfx", "yourcerticatepassword", X509KeyStorageFlags.PersistKeySet);
var configcrypt = builder.Configuration.AddJsonFile("appsettings.json", optional: false).AddProtectedJsonFile("appsettings.json", new CertificateSecretProtector(cert), ProtectedJsonMode.Auto, encryptedKeyExpressions: new Regex("DBConnectString|EmailUsername|EmailPassword")).Build();

Read configuration normally:

var conn = builder.Configuration.GetConnectionString("DBConnectString");

The encrypted value is decrypted automatically.

IIS Hosting Requirements

When hosting in IIS:

Application Pool 
  -> Your App Pool
     -> Advanced Settings
        -> Change User Identity to LocalService
            -> Load User Profile = True

Common IIS Error

If you encounter:

System.Security.Cryptography.CryptographicException:

The system cannot find the file specified.

Usually this means:

• Certificate is installed in CurrentUser store
• Private key permissions are missing
• IIS App Pool cannot access the key container
• The PFX was imported without its private key

Example

var cert = new X509Certificate2(
    "mycert.pfx",
    "password",
    X509KeyStorageFlags.MachineKeySet |
    X509KeyStorageFlags.PersistKeySet);

var protector = new CertificateSecretProtector(cert);

var encrypted = protector.Encrypt("Server=db;");

var decrypted = protector.Decrypt(encrypted);

Console.WriteLine(decrypted);

Output:

Server=db;

Security Notes

• Keep the PFX password secure.
• Store certificates in LocalMachine store for IIS applications.
• Limit private key permissions to only required service accounts.
• Never commit certificates or passwords into source control.

Supported Frameworks

• .NET 8
• ASP.NET Core
• IIS
• Windows Server

License

MIT License