Stratara.Security 3.2.2

.NET 10.0 This package targets .NET 10.0. The package is compatible with this framework or higher. 
dotnet add package Stratara.Security --version 3.2.2
                    


                    

                
NuGet\Install-Package Stratara.Security -Version 3.2.2
This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package. 
<PackageReference Include="Stratara.Security" Version="3.2.2" />
For projects that support PackageReference, copy this XML node into the project file to reference the package. 
<PackageVersion Include="Stratara.Security" Version="3.2.2" />
                    


                            Directory.Packages.props
                        

                    

                
<PackageReference Include="Stratara.Security" />
                    


                            Project file
For projects that support Central Package Management (CPM), copy this XML node into the solution Directory.Packages.props file to version the package. 
paket add Stratara.Security --version 3.2.2
                    


                    

                
#r "nuget: Stratara.Security, 3.2.2"
#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package. 
#:package Stratara.Security@3.2.2
#:package directive can be used in C# file-based apps starting in .NET 10 preview 4. Copy this into a .cs file before any lines of code to reference the package. 
#addin nuget:?package=Stratara.Security&version=3.2.2
                    


                            Install as a Cake Addin
                        

                    

                
#tool nuget:?package=Stratara.Security&version=3.2.2
                    


                            Install as a Cake Tool

Stratara.Security

License: MIT.

Dependency-light key store and envelope encryption for Stratara. Provides a production IKeyStore with KEK-wrapped, versioned per-scope data-encryption keys (rotation, revoke, and crypto-shred), a file-backed master-key provider, and an AES-GCM blob encryptor — referencing only Stratara.Abstractions + BCL crypto. No EF Core, RabbitMQ, Redis, or cloud SDKs in the graph.

Quick start

// appsettings / secrets:
// "Stratara": { "KeyStore": { "MasterKeyBase64": "<openssl rand -base64 32>", "StorePath": "/var/run/secrets/keystore.json" } }

builder.Services.AddStrataraFileKeyStore(builder.Configuration);

// Encrypt a blob bound to a tenant scope + purpose:
var scope = new KeyScope(DataSensitivityLevel.TenantScoped, TenantId: "acme-corp");
await using var encrypted = await encryptor.EncryptAsync(plainStream, scope, purpose: "attachment");
await using var plain = await encryptor.DecryptAsync(encrypted, scope);

What's inside

  • EnvelopeFileKeyStore (IKeyStore) — random 32-byte DEK per scope/version, KEK-wrapped with AES-256-GCM (wrap AAD bound to the key id, so a wrapped DEK can't be moved to another scope). The store file holds only wrapped DEKs + metadata, never plaintext. RotateAsync adds a version; RevokeAsync makes one version undecryptable; EraseScopeAsync deletes all versions for a scope (GDPR Art. 17 crypto-shred). DEKs are zeroed after use; the store file is written 0600 on Unix.
  • FileMasterKeyProvider (IMasterKeyProvider) — KEK from MasterKeyBase64, validated to decode to exactly 32 bytes (AES-256) at startup. The custody seam: swap for an HSM / KMS / vault provider later without touching the stored data.
  • AesGcmSecureBlobEncryptor (ISecureBlobEncryptor) — AES-GCM stream encryption with a purpose-bound AAD ({tenant}||{purpose}) and a versioned, self-describing format (v2 leading byte). Reads legacy streams without the version byte; set Stratara:BlobEncryption:LegacyBlobsCarryPurpose to match the legacy layout.
  • DummyKeyStore — Development-only deterministic fallback (throws outside Development).

Key id schema

{level}:{tenant}:{user}:v{N} — e.g. TenantScoped:acme-corp::v1. GetOrCreateCurrentKeyAsync returns the highest non-revoked version (creating v1 if none); RotateAsync creates v{N+1}.

Dependencies

  • Stratara.Abstractions
  • Stratara.Diagnostics
  • Microsoft.Extensions.{Configuration,DependencyInjection,Hosting,Logging}.Abstractions
  • Microsoft.Extensions.Options (+ Options.ConfigurationExtensions)
Product Compatible and additional computed target framework versions.
.NET net10.0 is compatible.  net10.0-android was computed.  net10.0-browser was computed.  net10.0-ios was computed.  net10.0-maccatalyst was computed.  net10.0-macos was computed.  net10.0-tvos was computed.  net10.0-windows was computed. 
Compatible target framework(s)
Included target framework(s) (in package)
Learn more about Target Frameworks and .NET Standard.

NuGet packages (2)

Showing the top 2 NuGet packages that depend on Stratara.Security:

Package Downloads
Stratara.Infrastructure

Infrastructure glue for the Stratara framework — authorization decorators, configuration providers, and DI composition helpers that wire Mediator, Outbox, Identity, and EF Core into a hosted app.
Stratara.Testing

Test doubles and assertion helpers for applications built on the Stratara framework — an in-memory IKeyStore, an in-memory IMessageBus, in-memory membership/setting/API-key stores, a preset ISessionContextProvider, deterministic tenant ids, and a given/when/then aggregate rehydration harness. Drop the Postgres/RabbitMQ testcontainers for unit tests.

GitHub repositories

This package is not used by any popular GitHub repositories.

Version Downloads Last Updated
3.2.2 137 8/14/2026
3.2.1 394 8/2/2026
3.2.0 141 7/18/2026
3.1.7 156 7/1/2026
3.1.6 579 6/22/2026
3.1.5 153 6/22/2026
3.1.4 1,618 6/15/2026
3.1.3 160 6/10/2026
3.1.2 161 6/5/2026
3.1.1 877 6/1/2026
3.1.0 133 5/30/2026

API keys can now be bootstrapped. Issuance always generated the key itself, which does not fit the
setups where server and caller have to share a key *before* either starts — container orchestration,
CI provisioning, self-hosted bundles, end-to-end test hosts. This release adds an import path for a
key the caller already holds, plus the canonical key format as public API so callers generate values
instead of inventing them.

### Added

- **`IApiKeyStore.ImportAsync` — store a machine key whose raw value the caller already holds.**
 Issuance generates the key itself, which is the wrong shape when server and caller must share it
 *before* either boots: container orchestration, CI provisioning, self-hosted bundles, end-to-end
 test hosts. Without this path, consumers bypassed the store and reimplemented its internals (the
 digest format and the machine-key membership row) — a copy that keeps compiling after the store
 changes and fails as a runtime 401. Import is idempotent, so it can run unconditionally on every
 boot: a value that is already stored returns the existing descriptor and the stored key is never
 mutated, so a changed configuration cannot escalate a key's roles or extend its expiry unnoticed.
 Revoked, expired, and foreign-tenant values are rejected rather than silently adopted, and
 concurrent replicas racing the same first import converge on one key. Machine keys only —
 `ApiKeyImportRequest` carries no `UserId`.
- **`ApiKeyFormat` (`Stratara.Abstractions.ApiKeys`) — the canonical raw-key format as public API.**
 `CreateRawKey()` generates `stk_` plus the Base64Url encoding of 32 CSPRNG bytes; `IsWellFormed()`
 checks that shape. `ImportAsync` accepts only well-formed values: the store keeps its stored
 digest unsalted because a generated key carries 256 bits of entropy, and a hand-picked value would
 quietly invalidate that. Generate keys out of band with `CreateRawKey()` and keep them in a secret
 store — the type lives in the abstractions package so host-builder and orchestration projects can
 reach it without referencing the storage implementation.
- **`InMemoryApiKeyStore` (`Stratara.Testing`) — the drop-in double for the API-key store**,
 mirroring issuance, import, fail-closed validation, revocation, and the erasure sweeps, and
 materializing machine keys into a membership store you can share and inspect.

### Changed

- **API-key lifecycle events are now logged** (`Stratara.Diagnostics` event-ID range 116_000):
 import, idempotent repeat, and a repeat that supplied different parameters. Key ids and tenant
 ids only — never the raw key or its digest.
- **For implementers of `IApiKeyStore`:** the interface gained `ImportAsync`. Custom implementations
 need the new member; callers are unaffected.