ProMilesV5.SharedEncryption 0.1.5

ProMilesV5.SharedEncryption

C# Class Library (.NET 8) for field-level AES-256-GCM encryption/decryption, published as a NuGet package.

Purpose

Consumers call Encrypt/Decrypt on IEncryptionService, and optionally EncryptSearchableAsync / ComputeSearchHash for a deterministic search token (HMAC blind index). All crypto and key management are internal. Key version caching and rotation are handled inside the library.

Configuration

Read from environment variables only — no appsettings, no consumer configuration.

When KeyVaultUri is absent, the library uses a DEV ONLY hardcoded fallback AES key and a DEV ONLY HMAC key. See Dev Fallback below.

Authentication

DefaultAzureCredential → User-Assigned Managed Identity.

Ciphertext Format

Base64 inner payload (then the whole payload is Base64-encoded again for the API string):

The Key Vault named key must be RSA with wrap/unwrap permissions (RSA-OAEP). Ciphertext produced with the dev fallback (keyVersion = dev) is not affected—only Key Vault–backed ciphertext from versions prior to the RSA wrap implementation (no wrappedKey segment) must be re-encrypted.

Public API

• IEncryptionService: EncryptAsync, DecryptAsync, EncryptSearchableAsync (ciphertext + search hash), ComputeSearchHash (HMAC-SHA256, Base64, 44 chars for non-empty input).
• No Key Vault types exposed publicly.

Build

dotnet build

Test

dotnet test

Pack & Push

# Pack (output to ./nupkgs)
dotnet pack -c Release -o ./nupkgs

# Push to NuGet.org
dotnet nuget push ./nupkgs/ProMilesV5.SharedEncryption.*.nupkg --api-key YOUR_API_KEY --source https://api.nuget.org/v3/index.json

# Push to Azure Artifacts (replace feed URL and PAT)
dotnet nuget push ./nupkgs/ProMilesV5.SharedEncryption.*.nupkg --api-key YOUR_PAT --source https://pkgs.dev.azure.com/ORG/PROJECT/_packaging/FEED/nuget/v3/index.json

Usage (after package publish)

<PackageReference Include="ProMilesV5.SharedEncryption" Version="0.1.5" />

// Register and use IEncryptionService
var encrypted = await encryptionService.EncryptAsync(plaintext);
var (cipher, searchHash) = await encryptionService.EncryptSearchableAsync(plaintext);
var queryHash = encryptionService.ComputeSearchHash(searchValue);
var decrypted = await encryptionService.DecryptAsync(encrypted);

Key Dependencies

• Azure.Security.KeyVault.Keys
• Azure.Identity
• System.Security.Cryptography (built-in)

Deployment

Environment variables are injected as Kubernetes Secrets by DevOps/IT. Consuming developers do not set or manage these values.

Dev Fallback

DEV ONLY — When KeyVaultUri is not set, the library uses a baked-in 32-byte AES-256 key and a separate baked-in 32-byte HMAC key for blind indexes. Never use in production.

• keyVersion sentinel: "dev" — identifies blobs encrypted with the dev key
• Production safeguard: When Key Vault is configured, decrypting "dev"-versioned blobs throws InvalidOperationException ("Dev-encrypted data cannot be decrypted in a Key Vault environment.") — prevents dev data leaking into production

Development

• Target: .NET 8.0
• Nullable and implicit usings enabled

License

© 2026 ProMiles Online. All rights reserved. Internal use only.