Ozcorps.Security 1.0.0

Ozcorps.Security

Ozcorps.Security is a security utility library for ASP.NET Core applications. It provides password hashing, symmetric/asymmetric encryption, and file encryption with a clean DI-friendly API.

Target Frameworks

• net8.0 (compatible with net9.0 and net10.0)

Installation

dotnet add package Ozcorps.Security

What's Included

• IPasswordHasher — Argon2id-based password hasher with pepper support
• IEncryptor + RsaEncryptor — RSA asymmetric encryption
• IEncryptor + TripleDesEncryptor — TripleDES legacy encryption (deprecated, backward compat only)
• IFileEncryptor + FileEncryptor — AES-GCM file encryption with PBKDF2 key derivation

Password Hashing (Argon2id)

Register the hasher:

builder.Services.AddArgon2PasswordHasher();

Inject and use:

public class UserService(IPasswordHasher hasher)
{
    public string CreateHash(string password) => hasher.Hash(password);
    public bool CheckPassword(string password, string stored) => hasher.Verify(password, stored);
}

Configuration

{
  "Security": {
    "Argon2": {
      "Pepper": ""
    }
  }
}

Important: In production, set Pepper via an environment variable or a secrets manager — never commit it to source control.

# .NET User Secrets (development)
dotnet user-secrets set "Security:Argon2:Pepper" "your-secret-pepper"

# Environment variable (production)
Security__Argon2__Pepper=your-secret-pepper

Hash Format

{base64-salt}:{base64-hash}

Each call produces a unique output because the salt is randomly generated per hash.

RSA Encryption

Generate a key pair (run once, store securely):

var keys = RsaEncryptor.GenerateKeys(); // keys[0] = public, keys[1] = private

Register:

builder.Services.AddRsaEncryptor();

Configuration:

{
  "Security": {
    "Rsa": {
      "Public": "base64-xml-public-key",
      "Private": "base64-xml-private-key"
    }
  }
}

Usage:

public class SecretService(IEncryptor encryptor)
{
    public string Protect(string value) => encryptor.Encrypt(value);
    public string Reveal(string value) => encryptor.Decrypt(value);
}

File Encryption (AES-GCM)

Register:

builder.Services.AddFileEncryptor();

Usage:

public class FileService(IFileEncryptor fileEncryptor)
{
    public void EncryptUpload(IFormFile file, string outputPath, string password)
        => fileEncryptor.Encrypt(file, outputPath, password);

    public string DecryptFile(string encryptedPath, string password)
        => fileEncryptor.Decrypt(encryptedPath, password); // returns output file path
}

Binary format: [32-byte salt][12-byte nonce][ciphertext][16-byte tag]

Key derivation: PBKDF2-SHA256, 100 000 iterations.

TripleDES (Deprecated)

TripleDES was deprecated by NIST in 2023. Provided for backward compatibility only — use RsaEncryptor or FileEncryptor instead.

#pragma warning disable CS0618
builder.Services.AddTripleDesEncryptor();
#pragma warning restore CS0618

Configuration:

{
  "Md5Key": "your-key"
}

Migration from Ozcorps.Core

The following types from Ozcorps.Core have been moved here and are [Obsolete] in Core:

License

MIT