Stratara.Security 4.0.3

Prefix Reserved
dotnet add package Stratara.Security --version 4.0.3
                    
NuGet\Install-Package Stratara.Security -Version 4.0.3
                    
This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package.
<PackageReference Include="Stratara.Security" Version="4.0.3" />
                    
For projects that support PackageReference, copy this XML node into the project file to reference the package.
<PackageVersion Include="Stratara.Security" Version="4.0.3" />
                    
Directory.Packages.props
<PackageReference Include="Stratara.Security" />
                    
Project file
For projects that support Central Package Management (CPM), copy this XML node into the solution Directory.Packages.props file to version the package.
paket add Stratara.Security --version 4.0.3
                    
#r "nuget: Stratara.Security, 4.0.3"
                    
#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package.
#:package Stratara.Security@4.0.3
                    
#:package directive can be used in C# file-based apps starting in .NET 10 preview 4. Copy this into a .cs file before any lines of code to reference the package.
#addin nuget:?package=Stratara.Security&version=4.0.3
                    
Install as a Cake Addin
#tool nuget:?package=Stratara.Security&version=4.0.3
                    
Install as a Cake Tool

Stratara.Security

Derived. The behaviour described here is specified under openspec/specs/. Those specifications are the source; this page explains and illustrates them.

License: MIT.

Dependency-light key store and envelope encryption for Stratara. Provides a production IKeyStore with KEK-wrapped, versioned per-scope data-encryption keys (rotation, revoke, and crypto-shred), a file-backed master-key provider, and an AES-GCM blob encryptor — referencing only Stratara.Abstractions + BCL crypto. No EF Core, RabbitMQ, Redis, or cloud SDKs in the graph.

Quick start

// appsettings / secrets:
// "Stratara": { "KeyStore": { "MasterKeyBase64": "<openssl rand -base64 32>", "StorePath": "/var/run/secrets/keystore.json" } }

builder.Services.AddStrataraFileKeyStore(builder.Configuration);

// Encrypt a blob bound to a tenant scope + purpose:
var scope = new KeyScope(DataSensitivityLevel.TenantScoped, TenantId: "acme-corp");
await using var encrypted = await encryptor.EncryptAsync(plainStream, scope, purpose: "attachment");
await using var plain = await encryptor.DecryptAsync(encrypted, scope);

What's inside

  • EnvelopeFileKeyStore (IKeyStore) — random 32-byte DEK per scope/version, KEK-wrapped with AES-256-GCM (wrap AAD bound to the key id, so a wrapped DEK can't be moved to another scope). The store file holds only wrapped DEKs + metadata, never plaintext. RotateAsync adds a version; RevokeAsync makes one version undecryptable; EraseScopeAsync deletes all versions for a scope (GDPR Art. 17 crypto-shred). DEKs are zeroed after use; the store file is written 0600 on Unix.
  • FileMasterKeyProvider (IMasterKeyProvider) — KEK from MasterKeyBase64, validated to decode to exactly 32 bytes (AES-256) at startup. The custody seam: swap for an HSM / KMS / vault provider later without touching the stored data.
  • AesGcmSecureBlobEncryptor (ISecureBlobEncryptor) — AES-GCM stream encryption with a purpose-bound AAD ({tenant}||{purpose}) and a versioned, self-describing format (v2 leading byte). Reads legacy streams without the version byte; set Stratara:BlobEncryption:LegacyBlobsCarryPurpose to match the legacy layout.
  • DummyKeyStore — Development-only deterministic fallback (throws outside Development).

Key id schema

{level}:{tenant}:{user}:v{N} — e.g. TenantScoped:acme-corp::v1. GetOrCreateCurrentKeyAsync returns the highest non-revoked version (creating v1 if none); RotateAsync creates v{N+1}.

Dependencies

  • Stratara.Abstractions
  • Stratara.Diagnostics
  • Microsoft.Extensions.{Configuration,DependencyInjection,Hosting,Logging}.Abstractions
  • Microsoft.Extensions.Options (+ Options.ConfigurationExtensions)
Product Compatible and additional computed target framework versions.
.NET net10.0 is compatible.  net10.0-android was computed.  net10.0-browser was computed.  net10.0-ios was computed.  net10.0-maccatalyst was computed.  net10.0-macos was computed.  net10.0-tvos was computed.  net10.0-windows was computed. 
Compatible target framework(s)
Included target framework(s) (in package)
Learn more about Target Frameworks and .NET Standard.

NuGet packages (2)

Showing the top 2 NuGet packages that depend on Stratara.Security:

Package Downloads
Stratara.Infrastructure

Infrastructure glue for the Stratara framework — authorization decorators, configuration providers, and DI composition helpers that wire Mediator, Outbox, Identity, and EF Core into a hosted app.

Stratara.Testing

Test doubles and assertion helpers for applications built on the Stratara framework — an in-memory IKeyStore, an in-memory IMessageBus, in-memory membership/setting/API-key stores, a preset ISessionContextProvider, deterministic tenant ids, and a given/when/then aggregate rehydration harness. Drop the Postgres/RabbitMQ testcontainers for unit tests.

GitHub repositories

This package is not used by any popular GitHub repositories.

Version Downloads Last Updated
4.0.3 46 9/3/2026
4.0.2 108 9/3/2026
4.0.1 90 9/2/2026
4.0.0 274 8/31/2026
4.0.0-preview.1 61 8/31/2026
3.4.0 216 8/28/2026
3.3.0 362 8/25/2026
3.2.3 156 8/22/2026
3.2.2 759 8/14/2026
3.2.1 401 8/2/2026
3.2.0 148 7/18/2026
3.1.7 162 7/1/2026
3.1.6 585 6/22/2026
3.1.5 162 6/22/2026
3.1.4 1,623 6/15/2026
3.1.3 165 6/10/2026
3.1.2 165 6/5/2026
3.1.1 881 6/1/2026
3.1.0 136 5/30/2026

Three fixes to the same complaint: a host composed exactly as the documentation describes did not
start. Each one was a registration the composites assumed somebody else had made — a tracer, a unit
of work, a Redis connection — and each is now made by the registration that needs it. Nothing that
already worked changes: every fix defers to a registration the host makes itself, in either order,
so the lines a working host added to get past these gaps can simply be deleted. Additive on every
published surface.

### Fixed

- **A host without Redis starts and dispatches.** Every composite that carries a dispatcher
 registered the projection-replay state, and its only implementation took a Redis connection that
 no composite registers, so a host composed as documented failed at its first dispatch unless it
 also ran Redis and called `AddCaching()`. `AddProjectionReplayState()` now chooses at first
 resolution: with a registered `IConnectionMultiplexer` the Redis-backed state as before, without
 one an in-process state with the same lease semantics — and a warning, once at start-up
 (`104_012`), that replay coordination is confined to that process, so a replay requested there
 suppresses publication there only. A deployment whose replay must reach several hosts registers
 the shared connection, in either order. Redis-backed hosts observe no change.
- **Registering a store context now registers its unit of work.**
 `AddNpgsqlWriteDbContextFactory<T>()` registered the context factory, the context and the default
 connection resolver but not the `IWriteUnitOfWork` that the event source, the outbox dispatcher and
 the command worker take from the container — and nothing else in the published packages did, so a
 host composed exactly as documented failed at its first command with a dependency-injection error.
 The write registration now try-adds a scoped `IWriteUnitOfWork` over its context, and
 `AddNpgsqlReadDbContextFactory<T>()` try-adds `IProjectionsUnitOfWork` and `IReadUnitOfWork`
 likewise. A unit of work the host registers itself, before or after, is still the one used; a
 hand-written registration can simply be deleted.
- **`AddMediator()` no longer requires the host to register an OpenTelemetry `Tracer`.** The
 mediator traces every dispatch and obtained its tracer from the host, but nothing registered one,
 so a host that called `AddMediator()` and nothing else failed at the first resolve of `IMediator`.
 `AddMediator()` now registers a fallback that emits the dispatch spans from the framework's
 `Stratara.Application` activity source — a host that subscribes to framework telemetry sees them,
 a host that subscribes to nothing pays for nothing. A `Tracer` the host registers, before or after
 `AddMediator()`, is still the one used, so no existing host changes behaviour; the registration
 line can simply be deleted. The samples, the README and the package README no longer carry it.