Gapotchenko.FX.Security.Cryptography 2026.8.3

Overview

The module provides an extended set of cryptography primitives and algorithms for .NET.

ARC4

ARC4 (Alleged Rivest Cipher 4 also known as ARCFOUR or RC4) is a stream cipher. While it is remarkable for its simplicity and performance, nowadays its usage is limited due to discovered limitations and vulnerabilities.

Still, ARC4 may be a good enough fit for less sensitive tasks. For example, it can be used for communication with legacy or energy-constrained systems.

Example:

using Gapotchenko.FX.Security.Cryptography;

byte[] messageToEncrypt = ...;
byte[] key = ...;

// Encryption

byte[] encryptedMessage;

using (var arc4 = Arc4.Create())
{
    arc4.Key = key;

    var ms = new MemoryStream();
    using (var cryptoStream = new CryptoStream(ms, arc4.CreateEncryptor(), CryptoStreamMode.Write))
        cryptoStream.Write(messageToEncrypt, 0, messageToEncrypt.Length);

    encryptedMessage = ms.ToArray();
}

// Decryption

byte[] decryptedMessage;

using (var arc4 = Arc4.Create())
{
    arc4.Key = key;

    var ms = new MemoryStream();
    using (var cryptoStream = new CryptoStream(ms, arc4.CreateDecryptor(), CryptoStreamMode.Write))
        cryptoStream.Write(encryptedMessage, 0, encryptedMessage.Length);

    decryptedMessage = ms.ToArray();
}

Unapproved Algorithms

Some cryptographic algorithms are retained for compatibility with legacy systems and data formats even though they are no longer approved for general-purpose cryptographic use. The module provides corresponding Unapproved classes for such cases:

• Arc4Unapproved
• DESUnapproved
• MD5Unapproved
• TripleDESUnapproved

These algorithms are intended for scenarios where old data, protocols, or formats must still be processed. They may be used in FIPS-restricted environments when the user explicitly permits such usage for compatibility purposes.

Cryptography Policy

CryptographyPolicy class provides information about the effective cryptographic policy of the current environment. Its AllowOnlyFipsAlgorithms property indicates whether only FIPS-approved cryptographic algorithms are allowed by the host operating system, runtime environment, cryptographic providers, or by the application itself.

An application can call CryptographyPolicy.EnforceOnlyFipsAlgorithms() to opt into a FIPS-only policy for the lifetime of the current process. This is useful for gradual FIPS conformity: the application can use approved algorithms by default, while still routing explicitly approved legacy compatibility operations through Unapproved algorithm factories.

Example:

using Gapotchenko.FX.Security.Cryptography;
using System.Security.Cryptography;

// The application opts into FIPS-only behavior.
CryptographyPolicy.EnforceOnlyFipsAlgorithms();

byte[] data = ...;
bool userPermitsLegacyMd5 = ...;

byte[] digest;

if (userPermitsLegacyMd5)
{
    // Compatibility path for old data formats that require MD5.
    using var md5 = MD5Unapproved.Create();
    digest = md5.ComputeHash(data);
}
else
{
    // FIPS-approved default path.
    using var sha256 = SHA256.Create();
    digest = sha256.ComputeHash(data);
}

Other Modules

Let's continue with a look at some other modules provided by Gapotchenko.FX:

• Gapotchenko.FX
• Gapotchenko.FX.AppModel.Information
• Gapotchenko.FX.Collections
• Gapotchenko.FX.Console
• Gapotchenko.FX.Data
• Gapotchenko.FX.Diagnostics
• Gapotchenko.FX.IO
• Gapotchenko.FX.Linq
• Gapotchenko.FX.Math
• Gapotchenko.FX.Memory
• ➴ Gapotchenko.FX.Security.Cryptography
• Gapotchenko.FX.Text
• Gapotchenko.FX.Threading
• Gapotchenko.FX.Tuples
• Gapotchenko.FX.Versioning

Or look at the full list of modules.