Stratara.Security
4.0.3
Prefix Reserved
dotnet add package Stratara.Security --version 4.0.3
NuGet\Install-Package Stratara.Security -Version 4.0.3
<PackageReference Include="Stratara.Security" Version="4.0.3" />
<PackageVersion Include="Stratara.Security" Version="4.0.3" />
<PackageReference Include="Stratara.Security" />
paket add Stratara.Security --version 4.0.3
#r "nuget: Stratara.Security, 4.0.3"
#:package Stratara.Security@4.0.3
#addin nuget:?package=Stratara.Security&version=4.0.3
#tool nuget:?package=Stratara.Security&version=4.0.3
Stratara.Security
Derived. The behaviour described here is specified under
openspec/specs/. Those specifications are the source; this page explains and illustrates them.
License: MIT.
Dependency-light key store and envelope encryption for Stratara. Provides a production
IKeyStore with KEK-wrapped, versioned per-scope data-encryption keys (rotation, revoke, and
crypto-shred), a file-backed master-key provider, and an AES-GCM blob encryptor — referencing only
Stratara.Abstractions + BCL crypto. No EF Core, RabbitMQ, Redis, or cloud SDKs in the graph.
Quick start
// appsettings / secrets:
// "Stratara": { "KeyStore": { "MasterKeyBase64": "<openssl rand -base64 32>", "StorePath": "/var/run/secrets/keystore.json" } }
builder.Services.AddStrataraFileKeyStore(builder.Configuration);
// Encrypt a blob bound to a tenant scope + purpose:
var scope = new KeyScope(DataSensitivityLevel.TenantScoped, TenantId: "acme-corp");
await using var encrypted = await encryptor.EncryptAsync(plainStream, scope, purpose: "attachment");
await using var plain = await encryptor.DecryptAsync(encrypted, scope);
What's inside
EnvelopeFileKeyStore(IKeyStore) — random 32-byte DEK per scope/version, KEK-wrapped with AES-256-GCM (wrap AAD bound to the key id, so a wrapped DEK can't be moved to another scope). The store file holds only wrapped DEKs + metadata, never plaintext.RotateAsyncadds a version;RevokeAsyncmakes one version undecryptable;EraseScopeAsyncdeletes all versions for a scope (GDPR Art. 17 crypto-shred). DEKs are zeroed after use; the store file is written0600on Unix.FileMasterKeyProvider(IMasterKeyProvider) — KEK fromMasterKeyBase64, validated to decode to exactly 32 bytes (AES-256) at startup. The custody seam: swap for an HSM / KMS / vault provider later without touching the stored data.AesGcmSecureBlobEncryptor(ISecureBlobEncryptor) — AES-GCM stream encryption with apurpose-bound AAD ({tenant}||{purpose}) and a versioned, self-describing format (v2 leading byte). Reads legacy streams without the version byte; setStratara:BlobEncryption:LegacyBlobsCarryPurposeto match the legacy layout.DummyKeyStore— Development-only deterministic fallback (throws outsideDevelopment).
Key id schema
{level}:{tenant}:{user}:v{N} — e.g. TenantScoped:acme-corp::v1. GetOrCreateCurrentKeyAsync
returns the highest non-revoked version (creating v1 if none); RotateAsync creates v{N+1}.
Dependencies
Stratara.AbstractionsStratara.DiagnosticsMicrosoft.Extensions.{Configuration,DependencyInjection,Hosting,Logging}.AbstractionsMicrosoft.Extensions.Options(+Options.ConfigurationExtensions)
| Product | Versions Compatible and additional computed target framework versions. |
|---|---|
| .NET | net10.0 is compatible. net10.0-android was computed. net10.0-browser was computed. net10.0-ios was computed. net10.0-maccatalyst was computed. net10.0-macos was computed. net10.0-tvos was computed. net10.0-windows was computed. |
-
net10.0
- Microsoft.Extensions.Configuration.Abstractions (>= 10.0.11)
- Microsoft.Extensions.DependencyInjection.Abstractions (>= 10.0.11)
- Microsoft.Extensions.Hosting.Abstractions (>= 10.0.11)
- Microsoft.Extensions.Logging.Abstractions (>= 10.0.11)
- Microsoft.Extensions.Options (>= 10.0.11)
- Microsoft.Extensions.Options.ConfigurationExtensions (>= 10.0.11)
- Stratara.Abstractions (>= 4.0.3)
- Stratara.Diagnostics (>= 4.0.3)
NuGet packages (2)
Showing the top 2 NuGet packages that depend on Stratara.Security:
| Package | Downloads |
|---|---|
|
Stratara.Infrastructure
Infrastructure glue for the Stratara framework — authorization decorators, configuration providers, and DI composition helpers that wire Mediator, Outbox, Identity, and EF Core into a hosted app. |
|
|
Stratara.Testing
Test doubles and assertion helpers for applications built on the Stratara framework — an in-memory IKeyStore, an in-memory IMessageBus, in-memory membership/setting/API-key stores, a preset ISessionContextProvider, deterministic tenant ids, and a given/when/then aggregate rehydration harness. Drop the Postgres/RabbitMQ testcontainers for unit tests. |
GitHub repositories
This package is not used by any popular GitHub repositories.
| Version | Downloads | Last Updated |
|---|---|---|
| 4.0.3 | 46 | 9/3/2026 |
| 4.0.2 | 108 | 9/3/2026 |
| 4.0.1 | 90 | 9/2/2026 |
| 4.0.0 | 274 | 8/31/2026 |
| 4.0.0-preview.1 | 61 | 8/31/2026 |
| 3.4.0 | 216 | 8/28/2026 |
| 3.3.0 | 362 | 8/25/2026 |
| 3.2.3 | 156 | 8/22/2026 |
| 3.2.2 | 759 | 8/14/2026 |
| 3.2.1 | 401 | 8/2/2026 |
| 3.2.0 | 148 | 7/18/2026 |
| 3.1.7 | 162 | 7/1/2026 |
| 3.1.6 | 585 | 6/22/2026 |
| 3.1.5 | 162 | 6/22/2026 |
| 3.1.4 | 1,623 | 6/15/2026 |
| 3.1.3 | 165 | 6/10/2026 |
| 3.1.2 | 165 | 6/5/2026 |
| 3.1.1 | 881 | 6/1/2026 |
| 3.1.0 | 136 | 5/30/2026 |
Three fixes to the same complaint: a host composed exactly as the documentation describes did not
start. Each one was a registration the composites assumed somebody else had made — a tracer, a unit
of work, a Redis connection — and each is now made by the registration that needs it. Nothing that
already worked changes: every fix defers to a registration the host makes itself, in either order,
so the lines a working host added to get past these gaps can simply be deleted. Additive on every
published surface.
### Fixed
- **A host without Redis starts and dispatches.** Every composite that carries a dispatcher
registered the projection-replay state, and its only implementation took a Redis connection that
no composite registers, so a host composed as documented failed at its first dispatch unless it
also ran Redis and called `AddCaching()`. `AddProjectionReplayState()` now chooses at first
resolution: with a registered `IConnectionMultiplexer` the Redis-backed state as before, without
one an in-process state with the same lease semantics — and a warning, once at start-up
(`104_012`), that replay coordination is confined to that process, so a replay requested there
suppresses publication there only. A deployment whose replay must reach several hosts registers
the shared connection, in either order. Redis-backed hosts observe no change.
- **Registering a store context now registers its unit of work.**
`AddNpgsqlWriteDbContextFactory<T>()` registered the context factory, the context and the default
connection resolver but not the `IWriteUnitOfWork` that the event source, the outbox dispatcher and
the command worker take from the container — and nothing else in the published packages did, so a
host composed exactly as documented failed at its first command with a dependency-injection error.
The write registration now try-adds a scoped `IWriteUnitOfWork` over its context, and
`AddNpgsqlReadDbContextFactory<T>()` try-adds `IProjectionsUnitOfWork` and `IReadUnitOfWork`
likewise. A unit of work the host registers itself, before or after, is still the one used; a
hand-written registration can simply be deleted.
- **`AddMediator()` no longer requires the host to register an OpenTelemetry `Tracer`.** The
mediator traces every dispatch and obtained its tracer from the host, but nothing registered one,
so a host that called `AddMediator()` and nothing else failed at the first resolve of `IMediator`.
`AddMediator()` now registers a fallback that emits the dispatch spans from the framework's
`Stratara.Application` activity source — a host that subscribes to framework telemetry sees them,
a host that subscribes to nothing pays for nothing. A `Tracer` the host registers, before or after
`AddMediator()`, is still the one used, so no existing host changes behaviour; the registration
line can simply be deleted. The samples, the README and the package README no longer carry it.