Data Protection API In .Net Core

Introduction

The .NET Core 2.0 release brought more goodies to developers in the realm of cryptography. Microsoft has added the Data Protection API in order to make it easier for developers to use strong cryptography to safeguard their data. I personally love this API because it’s well-designed from a security perspective as well as an API perspective. With this API, when you need to encrypt data you simply pass the data into the protect method. When you need to access the data again, simply pass the encrypted data into the Unprotect method, and it’s converted back into plaintext.

This API is great because it’s simple and successfully abstracts all of the inner workings away from the developers. By default, it uses 256-bit AES encryption to protect data, which is one of the best choices for an algorithm. When you encrypt data, key management becomes a concern. The Data Protection API handles all of that for you, including rotating keys on a regular basis. Developers don’t have to worry about the details, just what methods to call and when.

Step 1

Create a console application in .Net core.

Step 2

Run the below commands in the package manager console.

Install-Package Microsoft.Extensions.DependencyInjection -Version 3.0.0
Install-Package Microsoft.AspNetCore.DataProtection -Version 3.0.0

Use the below usings statements in your class file.

using System;
using Microsoft.AspNetCore.DataProtection;
using Microsoft.Extensions.DependencyInjection;

In Microsoft.AspNetCore.DataProtection namespace we have one interface that is IDataProtectionProvider and it contains one method CreateProtector.

We have one more interface, IDataProtector, which inherits the IDataProtectionProvider interface. It includes two different method definitions.

namespace Microsoft.AspNetCore.DataProtection
{
public interface IDataProtector : IDataProtectionProvider
{
byte[] Protect(byte[] plaintext);
byte[] Unprotect(byte[] protectedData);
}
}

In the above code snippet, we can see the two methods

Protect - Cryptographically protects a piece of plaintext data.

Unprotect - Cryptographically unprotects a piece of protected data

Step 3

Use the below code in your class file

public static void Main(string[] args)
{
// add data protection services
var serviceCollection = new ServiceCollection();
serviceCollection.AddDataProtection();
var services = serviceCollection.BuildServiceProvider();
var instance = ActivatorUtilities.CreateInstance<democlass>(services);
instance.RunSample();
}
public class democlass
{
IDataProtector _protector;
// the 'provider' parameter is provided by DI
public democlass(IDataProtectionProvider provider)
{
_protector = provider.CreateProtector("Contoso.democlass.v1");
}
public void RunSample()
{
Console.Write("Enter input: ");
string input = Console.ReadLine();
// protect the payload
string protectedPayload = _protector.Protect(input);
Console.WriteLine($"Protect returned: {protectedPayload}");
// unprotect the payload
string unprotectedPayload = _protector.Unprotect(protectedPayload);
Console.WriteLine($"Unprotect returned: {unprotectedPayload}");
Console.ReadLine();
}
}

In the main method, we are adding data protection services with the help of Dependency Injection and also creating an instance for demo class using a service provider. Using this instance we are calling demo class methods.

Step 4

Let's Enter our plain text. Please check the below snapshot where I am passing plain text through the console.

The Protect method will return the ciphertext or protected text. The Unprotect method will return plain text. Please check the below snapshot for more details.

Summary

In this blog, we discussed data protection. I hope that you find it helpful.

Eat->Code->Sleep->Repeat.