Enigma.Cryptography 4.1.0

Enigma.Cryptography

A comprehensive .NET cryptography library built on top of BouncyCastle.Cryptography, providing a clean and easy-to-use API for common cryptographic operations.

• Bouncy Castle GitHub repository
• Bouncy Castle Official website

Features

• Block Ciphers — AES, DES, 3DES, Blowfish, Twofish, Serpent, Camellia, and more (CBC, ECB, GCM, SIC/CTR modes)
• Stream Ciphers — ChaCha20, ChaCha20-RFC7539, Salsa20
• Public-Key Cryptography — RSA encryption, signing, and PEM key management
• Post-Quantum Cryptography — ML-DSA (CRYSTALS-Dilithium) and ML-KEM (CRYSTALS-Kyber)
• Hashing — MD5, SHA-1, SHA-256, SHA-512, SHA-3
• Key Derivation — PBKDF2 and Argon2
• Padding — PKCS7, ISO 7816-4, X9.23
• Data Encoding — Base64 and hexadecimal encoding/decoding

Installation

dotnet add package Enigma.Cryptography

Block ciphers

Supported algorithms

Classes

• BlockCipherService — Service for encryption/decryption with block ciphers
• BlockCipherServiceFactory — IBlockCipherService factory
• BlockCipherEngineFactory — IBlockCipher factory
• BlockCipherPaddingFactory — IBlockCipherPadding factory
• BlockCipherParametersFactory — ICipherParameters factory

Usage

Create a block cipher service with an algorithm string:

var service = new BlockCipherService("AES/CBC/PKCS7Padding");
// or without padding:
var service = new BlockCipherService("AES/CBC/NoPadding");

Create a block cipher service with factories:

var engineFactory = new BlockCipherEngineFactory();
var paddingFactory = new BlockCipherPaddingFactory();

// With padding
var service = new BlockCipherServiceFactory().CreateCbcService(engineFactory.CreateAesEngine, paddingFactory.CreatePkcs7Padding);

// Without padding
var service = new BlockCipherServiceFactory().CreateCbcService(engineFactory.CreateAesEngine);

AES-256 GCM example

var service = new BlockCipherService("AES/GCM");

var key = RandomUtils.GenerateRandomBytes(32);
var nonce = RandomUtils.GenerateRandomBytes(12);
var parameters = new BlockCipherParametersFactory().CreateGcmParameters(key, nonce, "associated data".GetUtf8Bytes());

var data = "This is a secret message !".GetUtf8Bytes();

// Encrypt
using var inputEnc = new MemoryStream(data);
using var outputEnc = new MemoryStream();
await service.EncryptAsync(inputEnc, outputEnc, parameters);

var encrypted = outputEnc.ToArray();

// Decrypt
using var inputDec = new MemoryStream(encrypted);
using var outputDec = new MemoryStream();
await service.DecryptAsync(inputDec, outputDec, parameters);

var decrypted = outputDec.ToArray();

AES-256 CBC example

var service = new BlockCipherService("AES/CBC/PKCS7Padding");

var key = RandomUtils.GenerateRandomBytes(32);
var iv = RandomUtils.GenerateRandomBytes(16);
var parameters = new BlockCipherParametersFactory().CreateCbcParameters(key, iv);

var data = "This is a secret message !".GetUtf8Bytes();

// Encrypt
using var inputEnc = new MemoryStream(data);
using var outputEnc = new MemoryStream();
await service.EncryptAsync(inputEnc, outputEnc, parameters);

var encrypted = outputEnc.ToArray();

// Decrypt
using var inputDec = new MemoryStream(encrypted);
using var outputDec = new MemoryStream();
await service.DecryptAsync(inputDec, outputDec, parameters);

var decrypted = outputDec.ToArray();

Stream ciphers

Supported algorithms

Classes

• StreamCipherService — Service for encryption/decryption with stream ciphers
• StreamCipherServiceFactory — IStreamCipherService factory

ChaCha20-RFC7539 example

var service = new StreamCipherServiceFactory().CreateChaCha7539Service();

var key = RandomUtils.GenerateRandomBytes(32);
var nonce = RandomUtils.GenerateRandomBytes(12);

var data = "This is a secret message !".GetUtf8Bytes();

// Encrypt
using var inputEnc = new MemoryStream(data);
using var outputEnc = new MemoryStream();
await service.EncryptAsync(inputEnc, outputEnc, key, nonce);

var encrypted = outputEnc.ToArray();

// Decrypt
using var inputDec = new MemoryStream(encrypted);
using var outputDec = new MemoryStream();
await service.DecryptAsync(inputDec, outputDec, key, nonce);

var decrypted = outputDec.ToArray();

Public-key cryptography

Classes

• PublicKeyService — Service for public-key encryption/decryption and signing/verifying
• PublicKeyServiceFactory — IPublicKeyService factory

RSA example

var service = new PublicKeyServiceFactory().CreateRsaService();

// Generate a 4096-bit key pair
var keyPair = service.GenerateKeyPair(4096);

var data = "This is a secret message".GetUtf8Bytes();

// Encrypt/decrypt
var enc = service.Encrypt(data, keyPair.Public);
var dec = service.Decrypt(enc, keyPair.Private);

// Sign/verify
var signature = service.Sign(data, keyPair.Private);
var verified = service.Verify(data, signature, keyPair.Public);

// Save public key in PEM format
using var publicOutput = new MemoryStream();
PemUtils.SaveKey(keyPair.Public, publicOutput);

// Save and encrypt private key in PEM format
using var privateOutput = new MemoryStream();
PemUtils.SavePrivateKey(keyPair.Private, privateOutput, "yourpassword", algorithm: "AES-256-CBC");

// Load public key from PEM
using var publicInput = new MemoryStream(publicOutput.ToArray());
var publicKey = PemUtils.LoadKey(publicInput);

// Load and decrypt private key from PEM
using var privateInput = new MemoryStream(privateOutput.ToArray());
var privateKey = PemUtils.LoadPrivateKey(privateInput, "yourpassword");

Post-Quantum Cryptography (PQC)

Classes

• MLDsaService — Module-Lattice-Based digital signature algorithm (ML-DSA / CRYSTALS-Dilithium)
• MLDsaServiceFactory — IMLDsaService factory
• MLKemService — Module-Lattice-Based key-encapsulation mechanism (ML-KEM / CRYSTALS-Kyber)
• MLKemServiceFactory — IMLKemService factory

ML-DSA example

var service = new MLDsaServiceFactory().CreateDsa65Service();

var keyPair = service.GenerateKeyPair();

var data = "Data to sign".GetUtf8Bytes();

// Sign/verify
var signature = service.Sign(data, keyPair.Private);
var verified = service.Verify(data, signature, keyPair.Public);

// Save public key in PEM format
using var publicOutput = new MemoryStream();
PemUtils.SaveKey(keyPair.Public, publicOutput);

// Save and encrypt private key in PEM format
using var privateOutput = new MemoryStream();
PemUtils.SavePrivateKey(keyPair.Private, privateOutput, "yourpassword", algorithm: "AES-256-CBC");

// Load public key from PEM
using var publicInput = new MemoryStream(publicOutput.ToArray());
var publicKey = PemUtils.LoadKey(publicInput);

// Load and decrypt private key from PEM
using var privateInput = new MemoryStream(privateOutput.ToArray());
var privateKey = PemUtils.LoadPrivateKey(privateInput, "yourpassword");

ML-KEM example

var service = new MLKemServiceFactory().CreateKem1024();

var keyPair = service.GenerateKeyPair();

// Encapsulate a shared secret
var (encapsulation, secret) = service.Encapsulate(keyPair.Public);

// Decapsulate the shared secret
var secretDec = service.Decapsulate(encapsulation, keyPair.Private);

// Save public key in PEM format
using var publicOutput = new MemoryStream();
PemUtils.SaveKey(keyPair.Public, publicOutput);

// Save and encrypt private key in PEM format
using var privateOutput = new MemoryStream();
PemUtils.SavePrivateKey(keyPair.Private, privateOutput, "yourpassword", algorithm: "AES-256-CBC");

// Load public key from PEM
using var publicInput = new MemoryStream(publicOutput.ToArray());
var publicKey = PemUtils.LoadKey(publicInput);

// Load and decrypt private key from PEM
using var privateInput = new MemoryStream(privateOutput.ToArray());
var privateKey = PemUtils.LoadPrivateKey(privateInput, "yourpassword");

Hashing

Supported algorithms

Classes

• HashService — Hash service
• HashServiceFactory — IHashService factory

Usage

var data = "Data to hash".GetUtf8Bytes();

var service = new HashServiceFactory().CreateSha3Service();

using var input = new MemoryStream(data);
var hash = await service.HashAsync(input);

Key Derivation (KDF)

Classes

• Pbkdf2Service — PBKDF2 key derivation service
• Argon2Service — Argon2 password-based key derivation service

PBKDF2 example

var service = new Pbkdf2Service();

var salt = "5775ada0513d7d7d7316de8d72d1f4d2".FromHexString();

// Derive a 32-byte key from a password and salt
var key = service.GenerateKey(size: 32, password: "yourpassword", salt, iterations: 10_000);

Argon2 example

var service = new Argon2Service();

var passwordData = "yourpassword".GetUtf8Bytes();
var salt = RandomUtils.GenerateRandomBytes(16);

// Derive a 32-byte key from a password and salt
var key = service.GenerateKey(32, passwordData, salt);

Padding

Supported schemes

Classes

• NoPaddingService — No-op padding service
• PaddingService — Padding service
• PaddingServiceFactory — IPaddingService factory

Usage

var data = "Data to pad".GetUtf8Bytes();

var service = new PaddingServiceFactory().CreatePkcs7Service();

// Pad/unpad with a 16-byte block size
var padded = service.Pad(data, blockSize: 16);
var unpadded = service.Unpad(padded, blockSize: 16);

Data encoding

Classes

• Base64Service — Base64 encoding/decoding service
• HexService — Hexadecimal encoding/decoding service

Usage

var data = "This is some data".GetUtf8Bytes();

// Hex encoding
var hex = new HexService();
var hexEncoded = hex.Encode(data);
var hexDecoded = hex.Decode(hexEncoded);

// Base64 encoding
var base64 = new Base64Service();
var base64Encoded = base64.Encode(data);
var base64Decoded = base64.Decode(base64Encoded);

With extension methods:

var data = "This is some data".GetUtf8Bytes();

var hexEncoded = data.ToHexString();
var hexDecoded = hexEncoded.FromHexString();

var base64Encoded = data.ToBase64String();
var base64Decoded = base64Encoded.FromBase64String();

Copyright (c) 2026 Josué Clément