dotnet-cryptography

Name: dotnet-cryptography
Author: wshaddix

65stars10forks

How to install dotnet-cryptography?

wshaddix/dotnet-skills/dotnet-cryptography

$npx -y skills add wshaddix/dotnet-skills --skill dotnet-cryptography

Installs into the current project.

Summary

Choosing crypto algorithms, hashing, encryption, or key derivation. AES-GCM, RSA, ECDSA, PQC.

Files · 1

View on GitHub

SKILL.md

1	# dotnet-cryptography
2
3	Modern .NET cryptography covering hashing (SHA-256/384/512), symmetric encryption (AES-GCM), asymmetric cryptography (RSA, ECDSA), key derivation (PBKDF2, Argon2), and post-quantum algorithms (ML-KEM, ML-DSA, SLH-DSA) for .NET 10+. Includes TFM-aware guidance: what's available on net10.0 vs fallback strategies for net8.0/net9.0.
4
5	Out of scope: Secrets management and configuration binding -- see [skill:dotnet-secrets-management]. OWASP vulnerability categories and deprecated security patterns -- see [skill:dotnet-security-owasp]. Authentication/authorization implementation (JWT, OAuth, Identity) -- see [skill:dotnet-api-security] and [skill:dotnet-blazor-auth]. Cloud-specific key management (Azure Key Vault, AWS KMS) -- cloud epics. TLS/HTTPS configuration -- covered by ASP.NET Core middleware.
6
7	Cross-references: [skill:dotnet-security-owasp] for OWASP A02 (Cryptographic Failures) and deprecated pattern warnings, [skill:dotnet-secrets-management] for storing keys and secrets securely.
8
9	---
10
11	## Scope Boundary
12
13	In scope: Algorithm selection, correct usage of `System.Security.Cryptography` APIs, key derivation, hashing for integrity, symmetric/asymmetric encryption, post-quantum cryptography, and deprecated algorithm warnings.
14
15	Not in scope: Key storage (use secrets management), TLS termination (infrastructure), authentication protocols (see [skill:dotnet-api-security]), cloud HSM/KMS services (cloud epics).
16
17	---
18
19	## Prerequisites
20
21	- .NET 8.0+ (LTS baseline for classical algorithms)
22	- .NET 10.0+ for post-quantum algorithms (ML-KEM, ML-DSA, SLH-DSA)
23	- Platform support for PQC: Windows 11 (November 2025+) or OpenSSL 3.5+ on Linux/macOS
24
25	---
26
27	## Hashing (SHA-2 Family)
28
29	Use SHA-256/384/512 for integrity verification, checksums, and content-addressable storage. Never use hashing alone for passwords (see Key Derivation below).
30
31	```csharp
32	using System.Security.Cryptography;
33
34	// Hash a byte array
35	byte[] data = "Hello, world"u8.ToArray();
36	byte[] hash = SHA256.HashData(data);
37
38	// Hash a stream (efficient for large files)
39	await using var stream = File.OpenRead("largefile.bin");
40	byte[] fileHash = await SHA256.HashDataAsync(stream);
41
42	// Compare hashes securely (constant-time comparison prevents timing attacks)
43	bool isEqual = CryptographicOperations.FixedTimeEquals(hash1, hash2);
44	```
45
46	```csharp
47	// HMAC for authenticated hashing (message authentication codes)
48	byte[] key = RandomNumberGenerator.GetBytes(32); // 256-bit key
49	byte[] mac = HMACSHA256.HashData(key, data);
50
51	// Verify HMAC
52	byte[] computedMac = HMACSHA256.HashData(key, receivedData);
53	if (!CryptographicOperations.FixedTimeEquals(mac, computedMac))
54	{
55	throw new CryptographicException("Message authentication failed");
56	}
57	```
58
59	---
60
61	## Symmetric Encryption (AES-GCM)
62
63	AES-GCM is the recommended symmetric encryption for .NET. It provides both confidentiality and authenticity (authenticated encryption with associated data -- AEAD).
64
65	```csharp
66	using System.Security.Cryptography;
67
68	public static class AesGcmEncryptor
69	{
70	private const int NonceSize = 12; // 96-bit nonce (required by GCM)
71	private const int TagSize = 16; // 128-bit authentication tag
72
73	public static byte[] Encrypt(byte[] plaintext, byte[] key)
74	{
75	var nonce = RandomNumberGenerator.GetBytes(NonceSize);
76	var ciphertext = new byte[plaintext.Length];
77	var tag = new byte[TagSize];
78
79	using var aes = new AesGcm(key, TagSize);
80	aes.Encrypt(nonce, plaintext, ciphertext, tag);
81
82	// Prepend nonce + append tag for transport
83	var result = new byte[NonceSize + ciphertext.Length + TagSize];
84	nonce.CopyTo(result, 0);
85	ciphertext.CopyTo(result, NonceSize);
86	tag.CopyTo(result, NonceSize + ciphertext.Length);
87	return result;
88	}
89
90	public static byte[] Decrypt(byte[] encryptedData, byte[] key)
91	{
92	var nonce = encryptedData.AsSpan(0, NonceSize);
93	var ciphertext = encryptedData.AsSpan(NonceSize, encryptedData.Length - NonceSize - TagSize);
94	var tag = encryptedData.AsSpan(encryptedData.Length - TagSize);
95	var plaintext = new byte[ciphertext.Length];
96
97	using var aes = new AesGcm(key, TagSize);
98	aes.Decrypt(nonce, ciphertext, tag, plaintext);
99	return plaintext;
100	}
101	}
102	```
103
104	```csharp
105	// ASP.NET Core Data Protection API -- preferred for web application scenarios
106	// Handles key management, rotation, and storage automatically
107	using Microsoft.AspNetCore.DataProtection;
108
109	public sealed class TokenProtector(IDataProtectionProvider provider)
110	{
111	private readonly IDataProtector _protector =
112	provider.CreateProtector("Tokens.V1");
113
114	public string Protect(string plaintext) => _protector.Protect(plaintext);
115	public string Unprotect(string ciphertext) => _protector.Unprotect(ciphertext);
116	}
117
118	// Registration:
119	builde

wshaddixPublisher · 77 listings

Preview

wshaddix/dotnet-skills

# dotnet-cryptography

Modern .NET cryptography covering hashing (SHA-256/384/512), symmetric encryption (AES-GCM), asymmetric cryptography (RSA, ECDSA), key derivation (PBKDF2, Argon

**Out of scope:** Secrets management and configuration binding -- see [skill:dotnet-secrets-management]. OWASP vulnerability categories and deprecated security

Cross-references: [skill:dotnet-security-owasp] for OWASP A02 (Cryptographic Failures) and deprecated pattern warnings, [skill:dotnet-secrets-management] for st

Repowshaddix/dotnet-skills

License—

TypeSkills

CategorySecurity

UpdatedFeb 2026

Repo stars65

First seenJul 22, 2026

People who liked this also viewed

6 picks

Type

dotnet-cryptography

65stars10forks

View on GitHub

How to install dotnet-cryptography?

wshaddix/dotnet-skills/dotnet-cryptography

$npx -y skills add wshaddix/dotnet-skills --skill dotnet-cryptography

Installs into the current project.

Summary

Choosing crypto algorithms, hashing, encryption, or key derivation. AES-GCM, RSA, ECDSA, PQC.

Files · 1

View on GitHub

SKILL.md

1	# dotnet-cryptography
2
3	Modern .NET cryptography covering hashing (SHA-256/384/512), symmetric encryption (AES-GCM), asymmetric cryptography (RSA, ECDSA), key derivation (PBKDF2, Argon2), and post-quantum algorithms (ML-KEM, ML-DSA, SLH-DSA) for .NET 10+. Includes TFM-aware guidance: what's available on net10.0 vs fallback strategies for net8.0/net9.0.
4
5	Out of scope: Secrets management and configuration binding -- see [skill:dotnet-secrets-management]. OWASP vulnerability categories and deprecated security patterns -- see [skill:dotnet-security-owasp]. Authentication/authorization implementation (JWT, OAuth, Identity) -- see [skill:dotnet-api-security] and [skill:dotnet-blazor-auth]. Cloud-specific key management (Azure Key Vault, AWS KMS) -- cloud epics. TLS/HTTPS configuration -- covered by ASP.NET Core middleware.
6
7	Cross-references: [skill:dotnet-security-owasp] for OWASP A02 (Cryptographic Failures) and deprecated pattern warnings, [skill:dotnet-secrets-management] for storing keys and secrets securely.
8
9	---
10
11	## Scope Boundary
12
13	In scope: Algorithm selection, correct usage of `System.Security.Cryptography` APIs, key derivation, hashing for integrity, symmetric/asymmetric encryption, post-quantum cryptography, and deprecated algorithm warnings.
14
15	Not in scope: Key storage (use secrets management), TLS termination (infrastructure), authentication protocols (see [skill:dotnet-api-security]), cloud HSM/KMS services (cloud epics).
16
17	---
18
19	## Prerequisites
20
21	- .NET 8.0+ (LTS baseline for classical algorithms)
22	- .NET 10.0+ for post-quantum algorithms (ML-KEM, ML-DSA, SLH-DSA)
23	- Platform support for PQC: Windows 11 (November 2025+) or OpenSSL 3.5+ on Linux/macOS
24
25	---
26
27	## Hashing (SHA-2 Family)
28
29	Use SHA-256/384/512 for integrity verification, checksums, and content-addressable storage. Never use hashing alone for passwords (see Key Derivation below).
30
31	```csharp
32	using System.Security.Cryptography;
33
34	// Hash a byte array
35	byte[] data = "Hello, world"u8.ToArray();
36	byte[] hash = SHA256.HashData(data);
37
38	// Hash a stream (efficient for large files)
39	await using var stream = File.OpenRead("largefile.bin");
40	byte[] fileHash = await SHA256.HashDataAsync(stream);
41
42	// Compare hashes securely (constant-time comparison prevents timing attacks)
43	bool isEqual = CryptographicOperations.FixedTimeEquals(hash1, hash2);
44	```
45
46	```csharp
47	// HMAC for authenticated hashing (message authentication codes)
48	byte[] key = RandomNumberGenerator.GetBytes(32); // 256-bit key
49	byte[] mac = HMACSHA256.HashData(key, data);
50
51	// Verify HMAC
52	byte[] computedMac = HMACSHA256.HashData(key, receivedData);
53	if (!CryptographicOperations.FixedTimeEquals(mac, computedMac))
54	{
55	throw new CryptographicException("Message authentication failed");
56	}
57	```
58
59	---
60
61	## Symmetric Encryption (AES-GCM)
62
63	AES-GCM is the recommended symmetric encryption for .NET. It provides both confidentiality and authenticity (authenticated encryption with associated data -- AEAD).
64
65	```csharp
66	using System.Security.Cryptography;
67
68	public static class AesGcmEncryptor
69	{
70	private const int NonceSize = 12; // 96-bit nonce (required by GCM)
71	private const int TagSize = 16; // 128-bit authentication tag
72
73	public static byte[] Encrypt(byte[] plaintext, byte[] key)
74	{
75	var nonce = RandomNumberGenerator.GetBytes(NonceSize);
76	var ciphertext = new byte[plaintext.Length];
77	var tag = new byte[TagSize];
78
79	using var aes = new AesGcm(key, TagSize);
80	aes.Encrypt(nonce, plaintext, ciphertext, tag);
81
82	// Prepend nonce + append tag for transport
83	var result = new byte[NonceSize + ciphertext.Length + TagSize];
84	nonce.CopyTo(result, 0);
85	ciphertext.CopyTo(result, NonceSize);
86	tag.CopyTo(result, NonceSize + ciphertext.Length);
87	return result;
88	}
89
90	public static byte[] Decrypt(byte[] encryptedData, byte[] key)
91	{
92	var nonce = encryptedData.AsSpan(0, NonceSize);
93	var ciphertext = encryptedData.AsSpan(NonceSize, encryptedData.Length - NonceSize - TagSize);
94	var tag = encryptedData.AsSpan(encryptedData.Length - TagSize);
95	var plaintext = new byte[ciphertext.Length];
96
97	using var aes = new AesGcm(key, TagSize);
98	aes.Decrypt(nonce, ciphertext, tag, plaintext);
99	return plaintext;
100	}
101	}
102	```
103
104	```csharp
105	// ASP.NET Core Data Protection API -- preferred for web application scenarios
106	// Handles key management, rotation, and storage automatically
107	using Microsoft.AspNetCore.DataProtection;
108
109	public sealed class TokenProtector(IDataProtectionProvider provider)
110	{
111	private readonly IDataProtector _protector =
112	provider.CreateProtector("Tokens.V1");
113
114	public string Protect(string plaintext) => _protector.Protect(plaintext);
115	public string Unprotect(string ciphertext) => _protector.Unprotect(ciphertext);
116	}
117
118	// Registration:
119	builde

wshaddixPublisher · 77 listings

Preview

wshaddix/dotnet-skills

# dotnet-cryptography

Modern .NET cryptography covering hashing (SHA-256/384/512), symmetric encryption (AES-GCM), asymmetric cryptography (RSA, ECDSA), key derivation (PBKDF2, Argon

**Out of scope:** Secrets management and configuration binding -- see [skill:dotnet-secrets-management]. OWASP vulnerability categories and deprecated security

Cross-references: [skill:dotnet-security-owasp] for OWASP A02 (Cryptographic Failures) and deprecated pattern warnings, [skill:dotnet-secrets-management] for st

Repowshaddix/dotnet-skills

License—

TypeSkills

CategorySecurity

UpdatedFeb 2026

Repo stars65

First seenJul 22, 2026

People who liked this also viewed

6 picks

Type