Net4x.Configuration.Crypt 2.5.0.26287

Net4x.Configuration.Crypt

Adds encryption of configuration values to Net4x.Configuration.Library. After encryption, values are stored AES-encrypted. They are decrypted as you read them, so application code keeps using ArgumentGetter.Instance["Key"] unchanged.

Installation

dotnet add package Net4x.Configuration.Crypt

Target frameworks: net35, net40, net45, net461, netstandard2.0.

Encrypting and decrypting the configuration

using ConfigurationLibrary.Crypt;

// Encrypt every value of ArgumentGetter.Instance.BaseConfig and save it.
ConfigurationCipher.CreateInstance().EncryptConfiguration();

// Reads now return plain text.
var password = ArgumentGetter.Instance["Pwd"];

// Turn it back into plain text on disk.
ConfigurationCipher.CreateInstance().DecryptConfiguration();

How it works:

• The active configuration is wrapped, so values are decrypted on read and encrypted on write.
• The key Encrypted records the current state (true / false). Calling either method a second time does nothing.
• The result is written with Save(), which writes the per-user copy described in Net4x.Configuration.Library, not the file shipped with the application.

An encrypted appSettings section looks like this:

<appSettings>
  <add key="User"      value="Nd+mtOnETi7InTNPi0/H/g==" />
  <add key="Encrypted" value="gBiKnFXC+d9/ZfOSD50w7g==" />
</appSettings>

Encrypting single strings

var cipher = new StringCipher();
string encrypted = cipher.Encrypt("secret", "my-key");
string plain     = cipher.Decrypt(encrypted, "my-key");   // null if the key or data is wrong

The AES key and IV are derived from the key string with SHA-256. Decrypt returns null instead of throwing when the data is not valid ciphertext for that key.

Security note

EncryptConfiguration uses the file name of the Net4x.Configuration.Crypt assembly as its key. Anyone with the package can decrypt the values. Treat this as a way to keep values from being read at a glance, not as protection of secrets. For real secrets, use DPAPI, a key vault, or StringCipher with a key you manage yourself.

Related packages

• Net4x.Configuration.Library: the configuration being encrypted
• Net4x.Configuration.Interfaces: shared contracts

Copyright (c) Piero Viano. All rights reserved. Authors: Piero Viano