PenguinConverters.CandyStore 3.3.5

PenguinConverters.CandyStore

The native-interop boundary between managed .NET and the Rust engine. CandyStore is the single managed assembly that P/Invokes keyra_ffi (the Rust cdylib); it binds to the crypto implemented in Rust, it does not implement crypto itself.

Overview

┌──────────────────────────────────────────────────────────────┐
│                    CandyStore (net8.0)                        │
│                    platform-agnostic                          │
├──────────────────────────────────────────────────────────────┤
│                                                              │
│  FFI binding + engine facade          BCL helpers           │
│  ┌────────────────────────────┐   ┌──────────────────────┐  │
│  │ KeyraFfiNative  (P/Invoke) │   │ Crypto               │  │
│  │ KeyraNativeCrypto          │   │  (X509 self-signed   │  │
│  │ KeyraEngine (load/ABI gate)│   │   cert creation)     │  │
│  │ KeyraVaultSession (handle) │   │ KeystrokeEntropy-    │  │
│  │ KeyraSecretCipher          │   │  Collector           │  │
│  │ AesGcmCrypto (facade)      │   └──────────────────────┘  │
│  └─────────────┬──────────────┘                             │
└────────────────┼─────────────────────────────────────────────┘
                 │ P/Invoke (single boundary)
                 ▼
        ┌────────────────────────┐
        │  keyra_ffi (Rust cdylib)│   AES-GCM, Argon2id, HMAC,
        │                        │   SHA-256, HKDF, KDF recipes,
        │                        │   keystore, secretstore,
        │                        │   git, hosting, engine
        └────────────────────────┘

Package Information

No Windows-native crypto here. DPAPI-NG / CNG / BCrypt / NCrypt interop lives in the KeyStorageProvider.DpapiNg provider (net8.0-windows), not in CandyStore. CandyStore was previously described as hosting that interop; it no longer does — those files moved to the DpapiNg provider, and CandyStore stays net8.0/agnostic.

Components

FFI binding & engine facade

Cross-platform BCL helpers

Security notes

• One boundary. CandyStore is the only managed assembly with P/Invoke into the engine; keyra-ffi is the only crate exposing extern "C". Nothing else crosses. See docs/interop.md.
• ABI handshake. KeyraEngine calls keyra_ffi_abi_version() right after load and refuses to proceed on mismatch with its compiled-in expectation.
• Secret ownership. Secret buffers are owned and zeroized on the Rust side; the managed side receives opaque handles or writes into fixed-size output buffers it owns — never a raw pointer to live key material on the managed heap.
• Load-time integrity. The cdylib is native (cannot be strong-named); trust comes from code signing plus a constrained load from the install directory.

License

Proprietary — PenguinConverters