Namespace Arc4u.Security.Cryptography

Certificate: Extension methods to encrypt and decrypt strings with an X509Certificate2. Short texts are encrypted directly with RSA (OAEP, SHA-256); longer texts are encrypted with a random AES key that is itself encrypted with the certificate. The result is a base64 string, or two base64 parts separated by a dot (key.data) in the AES case, where data is produced by Encrypt(string, byte[]). With an EC certificate the text is encrypted with ECIES: an ephemeral ECDH key agreement with the certificate key, HKDF-SHA256 to derive the AES key, then AES-GCM. The result is ephemeralPublicKey.data, the ephemeral public key being a base64 SubjectPublicKeyInfo. The algorithm is chosen from the certificate key, so a text must be decrypted with the certificate it was encrypted for. Only certificates with an RSA or an EC key are supported.

CypherCodec: Encrypts and decrypts strings with AES-GCM. A random nonce is generated for each value, so the same key can safely protect many values, and any modification of the cypher text (or a wrong key) is detected when decrypting.

IX509CertificateLoaderExtensionMethods: Extension methods for IX509CertificateLoader.

X509CertificateLoader: The default IX509CertificateLoader: it searches the certificate stores of the machine or loads PEM files.

IX509CertificateLoader: Loads X.509 certificates from a certificate store, from PEM files or from a configuration section.