Cryptography

Keys: Derived, Generated, and RSA for a Small Secret

WithAlgorithm(CryptoAlgorithm.PBKDF2) derives key bytes from a password rather than using a key directly. WithInputData carries the password bytes, WithSalt the salt to derive against, and WithIterationCount how many rounds to run, where more rounds cost more time for both you and anyone guessing. GenerateKey hands the derived bytes back, which is the key the AES chain then uses with WithKey. RSA encrypts with the public key and decrypts with the private one, and it carries no more than the key size allows. That makes it the wrong tool for a file and the right one for a small secret: encrypt the AES key with RSA, encrypt the file with AES, and the recipient reverses it with their private key.

Examples

GPAL Fluent: High-level fluent C# API

//The salt is not a secret and is stored alongside the encrypted data. The password is what stays out of the workflow, which is what GPAL.CredentialsFor is for. RSA takes no mode or padding setting here; those are AES settings and are ignored.

byte[] derived;


GPAL.Cryptography

.WithAlgorithm(CryptoAlgorithm.PBKDF2)

.WithInputData(Encoding.UTF8.GetBytes(password))

.WithSalt(salt)

.WithIterationCount(100000)

.GenerateKey(out derived);


// the aes key travels under rsa, the file travels under aes

GPAL.Cryptography

.WithAlgorithm(CryptoAlgorithm.RSA)

.WithKey(rsaPublic)

.WithInputData(key)

.Encrypt(out byte[] wrappedKey);

💬 Ask GPAL