RepletoryLib.Security.Encryption 1.0.0

RepletoryLib.Security.Encryption

AES and RSA encryption, cryptographic hashing, and data masking services.

Part of the RepletoryLib ecosystem -- standalone, reusable .NET 10 libraries with zero business logic.

Overview

RepletoryLib.Security.Encryption provides a comprehensive set of cryptographic services for .NET applications. It wraps the complexity of symmetric encryption (AES-256-CBC), asymmetric encryption (RSA-OAEP), password hashing (BCrypt, SHA-256, SHA-512), HMAC signing, and data masking behind clean, testable interfaces.

All services are registered as singletons through a single DI extension method and configured via appsettings.json.

Key Features

• AES-256-CBC encryption -- Symmetric encryption/decryption with PKCS7 padding
• RSA-OAEP encryption -- Asymmetric encryption with SHA-256 padding and key pair generation
• Password hashing -- BCrypt (adaptive), SHA-256, and SHA-512
• HMAC-SHA256 -- Message authentication codes for data integrity
• Secure token generation -- Cryptographically random URL-safe tokens
• Data masking -- Email, phone, ID number, credit card, and custom masking patterns

Installation

dotnet add package RepletoryLib.Security.Encryption

Or add to your .csproj:

<PackageReference Include="RepletoryLib.Security.Encryption" Version="1.0.0" />

Note: RepletoryLib packages are published to a local BaGet feed. See the main repository README for feed configuration.

Dependencies

Quick Start

Register encryption services in Program.cs:

using RepletoryLib.Security.Encryption;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddRepletorySecurity(builder.Configuration);

Add configuration to appsettings.json:

{
  "Encryption": {
    "AesKey": "your-32-character-aes-256-key!!",
    "AesIv": "your-16-char-iv!"
  }
}

Configuration

EncryptionOptions

Section name: "Encryption"

Usage Examples

AES Encryption and Decryption

using RepletoryLib.Security.Encryption.Interfaces;

public class UserService
{
    private readonly IEncryptionService _encryption;

    public UserService(IEncryptionService encryption) => _encryption = encryption;

    public string ProtectSensitiveData(string idNumber)
    {
        // Encrypt -- returns Base64-encoded ciphertext
        string encrypted = _encryption.AesEncrypt(idNumber);

        // Decrypt -- returns original plaintext
        string decrypted = _encryption.AesDecrypt(encrypted);

        return encrypted;
    }
}

RSA Encryption with Key Generation

using RepletoryLib.Security.Encryption.Interfaces;

public class KeyExchangeService
{
    private readonly IEncryptionService _encryption;

    public KeyExchangeService(IEncryptionService encryption) => _encryption = encryption;

    public (string PublicKey, string PrivateKey) GenerateKeys()
    {
        return _encryption.GenerateRsaKeyPair();
    }

    public string EncryptForRecipient(string message)
    {
        return _encryption.RsaEncrypt(message);
    }

    public string DecryptFromSender(string cipherText)
    {
        return _encryption.RsaDecrypt(cipherText);
    }
}

Password Hashing and Verification

using RepletoryLib.Security.Encryption.Interfaces;
using RepletoryLib.Security.Encryption.Models;

public class AuthService
{
    private readonly IHashingService _hashing;

    public AuthService(IHashingService hashing) => _hashing = hashing;

    public string HashPassword(string password)
    {
        // BCrypt -- adaptive, recommended for passwords
        return _hashing.Hash(password, HashAlgorithmType.BCrypt);
    }

    public bool VerifyPassword(string password, string hash)
    {
        return _hashing.Verify(password, hash, HashAlgorithmType.BCrypt);
    }

    public string HashForStorage(string value)
    {
        // SHA-256 -- fast, suitable for non-password data
        return _hashing.Sha256(value);
    }

    public string GenerateApiKey()
    {
        // Cryptographically secure URL-safe token
        return _hashing.GenerateSecureToken(48);
    }
}

HMAC Signing

using RepletoryLib.Security.Encryption.Interfaces;

public class WebhookService
{
    private readonly IHashingService _hashing;

    public WebhookService(IHashingService hashing) => _hashing = hashing;

    public string SignPayload(string payload, string secret)
    {
        return _hashing.HmacSha256(payload, secret);
    }

    public bool VerifyWebhook(string payload, string signature, string secret)
    {
        var expected = _hashing.HmacSha256(payload, secret);
        return string.Equals(expected, signature, StringComparison.OrdinalIgnoreCase);
    }
}

Data Masking

using RepletoryLib.Security.Encryption.Interfaces;

public class AuditLogger
{
    private readonly IDataMaskingService _masking;

    public AuditLogger(IDataMaskingService masking) => _masking = masking;

    public void LogSensitiveOperation(string email, string phone, string idNumber, string cardNumber)
    {
        var maskedEmail = _masking.MaskEmail(email);         // "j***@example.com"
        var maskedPhone = _masking.MaskPhone(phone);         // "+27***4567"
        var maskedId = _masking.MaskIdNumber(idNumber);      // "**********567"
        var maskedCard = _masking.MaskCreditCard(cardNumber); // "************4242"

        // Custom masking -- show first 3 and last 2 characters
        var maskedCustom = _masking.MaskCustom("ABC123XYZ", 3, 2); // "ABC****YZ"
    }
}

API Reference

IEncryptionService

IHashingService

IDataMaskingService

HashAlgorithmType

Integration with Other RepletoryLib Packages

Testing

[Fact]
public void AesEncrypt_and_decrypt_roundtrip()
{
    var options = Options.Create(new EncryptionOptions
    {
        AesKey = "12345678901234567890123456789012",
        AesIv = "1234567890123456"
    });
    var service = new EncryptionService(options);

    var encrypted = service.AesEncrypt("sensitive data");
    var decrypted = service.AesDecrypt(encrypted);

    decrypted.Should().Be("sensitive data");
    encrypted.Should().NotBe("sensitive data");
}

[Fact]
public void BCrypt_hash_and_verify()
{
    var service = new HashingService();

    var hash = service.Hash("password123", HashAlgorithmType.BCrypt);
    var isValid = service.Verify("password123", hash, HashAlgorithmType.BCrypt);

    isValid.Should().BeTrue();
}

Troubleshooting

License

This project is licensed under the MIT License.

Copyright (c) 2024-2026 Repletory.

For complete documentation, infrastructure setup, and configuration reference, see the RepletoryLib main repository.