Pandatech.Crypto

Unified cryptographic wrapper library for .NET 8+ providing AES encryption, password hashing, compression, and secure random generation.

Installation

dotnet add package Pandatech.Crypto

Quick Start

Configuration (ASP.NET Core)

builder.AddAes256Key("your-base64-encoded-256-bit-key"); // Optional: configure Argon2id (defaults shown) builder.ConfigureArgon2Id(options => { options.SaltSize = 16; options.DegreeOfParallelism = 8; options.Iterations = 5; options.MemorySize = 128 * 1024; // 128 MB });

Core Features

AES-256-GCM (Files & Streams)

Authenticated encryption with associated data. Best for files.

// Encrypt Aes256Gcm.RegisterKey(key); using var input = File.OpenRead("document.pdf"); using var output = File.Create("document.pdf.enc"); Aes256Gcm.Encrypt(input, output); // Decrypt using var encrypted = File.OpenRead("document.pdf.enc"); using var decrypted = File.Create("document.pdf"); Aes256Gcm.Decrypt(encrypted, decrypted);

AES-256-SIV (Deterministic Encryption)

RFC 5297 compliant. Use for PII that needs deterministic matching.

Aes256Siv.RegisterKey(key); byte[] cipher = Aes256Siv.Encrypt("sensitive-data"); string plain = Aes256Siv.Decrypt(cipher);

Argon2id Password Hashing

byte[] hash = Argon2Id.HashPassword("user-password"); bool valid = Argon2Id.VerifyHash("user-password", hash);

JWE (RSA-OAEP-256 + AES-256-GCM)

Envelope encryption with JWK keys and RFC 7638 thumbprints.

var (publicJwk, privateJwk, kid) = JoseJwe.IssueKeys(bits: 2048); var jwe = JoseJwe.Encrypt(publicJwk, payload, kid); if (JoseJwe.TryDecrypt(privateJwk, jwe, out var decrypted)) { // use decrypted bytes }

Secure Random

byte[] randomBytes = Random.GenerateBytes(32); string aesKey = Random.GenerateAes256KeyString(); string token = Random.GenerateSecureToken(); // 256-bit URL-safe

Password Generation & Validation

string pwd = Password.GenerateRandom( length: 16, includeUppercase: true, includeLowercase: true, includeDigits: true, includeSpecialChars: true ); bool valid = Password.Validate(pwd, minLength: 16, requireUppercase: true, requireLowercase: true, requireDigits: true, requireSpecialChars: true);

Hashing

// SHA-2 HMAC byte[] hmac = Sha2.ComputeHmacSha256(key, "message1", "message2"); string hex = Sha2.GetHmacSha256Hex(key, "message"); // SHA-3 byte[] hash = Sha3.Hash("data"); bool valid = Sha3.VerifyHash("data", hash);

GZip Compression

// String byte[] compressed = GZip.Compress("data"); string decompressed = Encoding.UTF8.GetString(GZip.Decompress(compressed)); // Streams GZip.Compress(inputStream, outputStream); GZip.Decompress(inputStream, outputStream);

Data Masking

string masked = "user@example.com".MaskEmail(); // "us****@example.com" string masked = "1234567890".MaskPhoneNumber(); // "******7890"

License

MIT