Stratara.Security
4.4.8
Prefix Reserved
See the version list below for details.
dotnet add package Stratara.Security --version 4.4.8
NuGet\Install-Package Stratara.Security -Version 4.4.8
<PackageReference Include="Stratara.Security" Version="4.4.8" />
<PackageVersion Include="Stratara.Security" Version="4.4.8" />
<PackageReference Include="Stratara.Security" />
paket add Stratara.Security --version 4.4.8
#r "nuget: Stratara.Security, 4.4.8"
#:package Stratara.Security@4.4.8
#addin nuget:?package=Stratara.Security&version=4.4.8
#tool nuget:?package=Stratara.Security&version=4.4.8
Stratara.Security
Derived. The behaviour described here is specified under
openspec/specs/. Those specifications are the source; this page explains and illustrates them.
License: MIT.
Dependency-light key store and envelope encryption for Stratara. Provides a production
IKeyStore with KEK-wrapped, versioned per-scope data-encryption keys (rotation, revoke, and
crypto-shred), a file-backed master-key provider, and an AES-GCM blob encryptor — referencing only
Stratara.Abstractions + BCL crypto. No EF Core, RabbitMQ, Redis, or cloud SDKs in the graph.
Quick start
// appsettings / secrets:
// "Stratara": { "KeyStore": { "MasterKeyBase64": "<openssl rand -base64 32>", "StorePath": "/var/run/secrets/keystore.json" } }
builder.Services.AddStrataraFileKeyStore(builder.Configuration);
// Encrypt a blob bound to a tenant scope + purpose:
var scope = new KeyScope(DataSensitivityLevel.TenantScoped, TenantId: "acme-corp");
await using var encrypted = await encryptor.EncryptAsync(plainStream, scope, purpose: "attachment");
await using var plain = await encryptor.DecryptAsync(encrypted, scope);
What's inside
EnvelopeFileKeyStore(IKeyStore) — random 32-byte DEK per scope/version, KEK-wrapped with AES-256-GCM (wrap AAD bound to the key id, so a wrapped DEK can't be moved to another scope). The store file holds only wrapped DEKs + metadata, never plaintext.RotateAsyncadds a version;RevokeAsyncmakes one version undecryptable;EraseScopeAsyncdeletes all versions for a scope (GDPR Art. 17 crypto-shred). DEKs are zeroed after use; the store file is written0600on Unix.FileMasterKeyProvider(IMasterKeyProvider) — KEK fromMasterKeyBase64, validated to decode to exactly 32 bytes (AES-256) at startup. The custody seam: swap for an HSM / KMS / vault provider later without touching the stored data.AesGcmSecureBlobEncryptor(ISecureBlobEncryptor) — AES-GCM stream encryption with apurpose-bound AAD ({tenant}||{purpose}) and a versioned, self-describing format (v2 leading byte). Reads legacy streams without the version byte; setStratara:BlobEncryption:LegacyBlobsCarryPurposeto match the legacy layout.DummyKeyStore— Development-only deterministic fallback (throws outsideDevelopment).
Key id schema
{level}:{tenant}:{user}:v{N} — e.g. TenantScoped:acme-corp::v1. GetOrCreateCurrentKeyAsync
returns the highest non-revoked version (creating v1 if none); RotateAsync creates v{N+1}.
Dependencies
Stratara.AbstractionsStratara.DiagnosticsMicrosoft.Extensions.{Configuration,DependencyInjection,Hosting,Logging}.AbstractionsMicrosoft.Extensions.Options(+Options.ConfigurationExtensions)
| Product | Versions Compatible and additional computed target framework versions. |
|---|---|
| .NET | net10.0 is compatible. net10.0-android was computed. net10.0-browser was computed. net10.0-ios was computed. net10.0-maccatalyst was computed. net10.0-macos was computed. net10.0-tvos was computed. net10.0-windows was computed. |
-
net10.0
- Microsoft.Extensions.Configuration.Abstractions (>= 10.0.13)
- Microsoft.Extensions.DependencyInjection.Abstractions (>= 10.0.13)
- Microsoft.Extensions.Hosting.Abstractions (>= 10.0.13)
- Microsoft.Extensions.Logging.Abstractions (>= 10.0.13)
- Microsoft.Extensions.Options (>= 10.0.13)
- Microsoft.Extensions.Options.ConfigurationExtensions (>= 10.0.13)
- Stratara.Abstractions (>= 4.4.8)
- Stratara.Diagnostics (>= 4.4.8)
NuGet packages (2)
Showing the top 2 NuGet packages that depend on Stratara.Security:
| Package | Downloads |
|---|---|
|
Stratara.Infrastructure
Infrastructure glue for the Stratara framework — authorization decorators, configuration providers, and DI composition helpers that wire Mediator, Outbox, Identity, and EF Core into a hosted app. |
|
|
Stratara.Testing
Test doubles and assertion helpers for applications built on the Stratara framework — an in-memory IKeyStore, an in-memory IMessageBus, in-memory membership/setting/API-key stores, a preset ISessionContextProvider, deterministic tenant ids, and a given/when/then aggregate rehydration harness. Drop the Postgres/RabbitMQ testcontainers for unit tests. |
GitHub repositories
This package is not used by any popular GitHub repositories.
| Version | Downloads | Last Updated |
|---|---|---|
| 4.8.0 | 169 | 11/6/2026 |
| 4.7.1 | 144 | 11/5/2026 |
| 4.7.0 | 611 | 10/30/2026 |
| 4.6.1 | 151 | 10/29/2026 |
| 4.6.0 | 245 | 10/28/2026 |
| 4.5.0 | 317 | 10/28/2026 |
| 4.4.10 | 256 | 10/26/2026 |
| 4.4.9 | 159 | 10/26/2026 |
| 4.4.8 | 301 | 10/24/2026 |
| 4.4.7 | 169 | 10/23/2026 |
| 4.4.6 | 289 | 10/22/2026 |
| 4.4.5 | 719 | 10/14/2026 |
| 4.4.4 | 442 | 10/10/2026 |
| 4.4.3 | 176 | 10/10/2026 |
| 4.4.2 | 527 | 10/2/2026 |
| 4.4.1 | 484 | 9/29/2026 |
| 4.4.0 | 206 | 9/27/2026 |
| 4.3.1 | 277 | 9/25/2026 |
| 4.3.0 | 450 | 9/23/2026 |
| 4.2.0 | 220 | 9/18/2026 |
A fix for hosts on the Orleans execution model. A store reader that catches up a large backlog and a singleton
work that runs long now answer their keep-alive, so neither leaves reminder errors in the silo's log. A silo that
joins while a singleton work runs long on another silo no longer fails its start. No API change, no schema change
and no migration.
### Fixed
- **A busy store reader or singleton work answers its keep-alive.** On the Orleans execution model, a projection or
saga reader that caught up a backlog for longer than the runtime's response timeout made its keep-alive tick wait
behind the catch-up, and Orleans logged `Could not deliver reminder tick` at Error, once per partition and
keep-alive period. A singleton work whose run outlasted the timeout did the same. Nothing was lost, but a large
catch-up left dozens of errors on the silo. The keep-alive and the poll now start a catch-up where none is
running and do not wait for it. A partition is still read by one catch-up at a time, and a commit during a
catch-up is still applied by it. A singleton work's keep-alive interleaves with its run, and runs still never
overlap.
- **A silo starts while a singleton work runs long.** A silo that started while a singleton work it registers ran
longer than the response timeout on another silo waited for that run in its own start. The start then failed
with a `TimeoutException`. The call a starting silo makes to each singleton work and store reader now
interleaves, so the start goes on.
- *Operate the Orleans execution model* says that a durable timer whose handler outlasts the response timeout
still makes Orleans log `Could not deliver reminder tick` for that tick, and that the line says nothing about
the timer. It also says that, outside a deploy, the line now points to an unreachable store reader or singleton
work rather than a busy one.