PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.xml
|
<?xml version="1.0"?>
<doc> <assembly> <name>PenguinConverters.Keyra.KeyStorageProvider.DpapiNg</name> </assembly> <members> <member name="T:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.AesGcmCrypto"> <summary> Internal redirect to <see cref="T:PenguinConverters.CandyStore.AesGcmCrypto"/>. Kept for backward compatibility within this assembly. </summary> </member> <member name="T:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Configuration"> <summary> Configuration for the DPAPI-NG Key Storage Provider. </summary> </member> <member name="F:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Configuration._protectionDescriptor"> <summary> The DPAPI-NG protection descriptor string (SID-based). </summary> </member> <member name="F:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Configuration._keyGenerator"> <summary> The key generator instance used for creating AES keys. </summary> </member> <member name="F:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Configuration._keyGeneratorTypeName"> <summary> The assembly-qualified type name of the key generator for serialization. </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Configuration.ProtectionDescriptor"> <summary> DPAPI-NG protection descriptor (SID-based). Examples: - "SID=S-1-5-21-..." (specific user by SID) - "LOCAL=user" (current user) - "LOCAL=machine" (any user on this machine) - "SID=S-1-5-21-...; SID=S-1-5-21-..." (multiple users/groups with OR logic) - null (password-only protection without Windows identity binding - portable) Default: null (password-only, portable) When null and no password, falls back to standard DPAPI (current user context). </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Configuration.KeyGenerator"> <summary> Key generator for creating AES keys. Default: RandomKeyGenerator </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Configuration.KeyGeneratorTypeName"> <summary> Key generator type name for JSON serialization. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Configuration.#ctor"> <summary> Default constructor </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Configuration.#ctor(System.String)"> <summary> Constructor with protection descriptor </summary> <param name="protectionDescriptor">DPAPI-NG protection descriptor</param> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Configuration.ForCurrentUser"> <summary> Creates a configuration protecting for the current user, using the platform-aware default template (<see cref="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.GetCurrentUserDescriptor"/>): a domain-SID descriptor on AD-joined machines, or a null descriptor (classic per-user DPAPI) off-domain. The property setter is used so a null (off-domain) descriptor is accepted. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Configuration.ForLocalMachine"> <summary> Creates a configuration for local machine protection. Any user on the machine can access protected data. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Configuration.ForMultipleSids(System.String[])"> <summary> Creates a configuration for multiple SIDs (users/groups). </summary> <param name="sids">Array of SID strings</param> </member> <member name="T:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop"> <summary> DPAPI-NG (Data Protection API - Next Generation) wrapper for protecting secrets. Uses NCryptProtectSecret/NCryptUnprotectSecret with SID-based protection descriptors. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.Protect(System.Byte[],System.String)"> <summary> Protects data using DPAPI-NG with the specified protection descriptor. Falls back to standard DPAPI if DPAPI-NG is not available on the system. </summary> <param name="data">The data to protect</param> <param name="protectionDescriptor"> SID-based protection descriptor. Examples: - "SID=S-1-5-21-..." (specific user) - "SID=S-1-5-21-... OR SID=S-1-5-21-..." (multiple users, any can decrypt) - "LOCAL=user" (current user) - null or empty for current user default (falls back to standard DPAPI) </param> <returns>Protected data blob</returns> <exception cref="T:System.PlatformNotSupportedException">If not running on Windows</exception> <exception cref="T:System.Security.Cryptography.CryptographicException">If protection fails</exception> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.Unprotect(System.Byte[])"> <summary> Unprotects data that was protected using DPAPI-NG or standard DPAPI. Automatically detects the blob type and uses the appropriate API. </summary> <param name="protectedBlob">The protected data blob</param> <returns>The original unprotected data</returns> <exception cref="T:System.PlatformNotSupportedException">If not running on Windows</exception> <exception cref="T:System.Security.Cryptography.CryptographicException">If unprotection fails</exception> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.GetCurrentUserDescriptor"> <summary> Resolves the default protection descriptor for the current Windows user, adapting to the machine's directory setup. This is the single, unified template used by BOTH the master-key provider (via <see cref="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Configuration.ForCurrentUser"/>) and the vault-key providers, so the "protect for the current user by default" decision is made in exactly one place: <list type="bullet"> <item><b>AD-joined domain account</b> → <c>SID=<current user SID></c>. The DPAPI-NG SID protector is backed by the domain Key Distribution Service (KDS), binding the data to that domain user and allowing it to roam to other domain machines.</item> <item><b>Workgroup / local account</b> → <c>null</c>. Off-domain there is no KDS, so SID protectors are unavailable and fail (e.g. NTE_INTERNAL_ERROR 0x80090034 — even for the caller's own local SID). Returning null selects classic per-user DPAPI (<c>CryptProtectData</c>), which binds the data to the current Windows user and works on any standalone machine.</item> </list> Both cases are recorded the same way in this provider's block; only the underlying Windows protector differs by platform. Explicitly-chosen protectors (e.g. an AD authenticator's principals, or <see cref="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.GetLocalMachineDescriptor"/>) bypass this default. </summary> <returns>A <c>SID=</c> descriptor for domain accounts; <c>null</c> (classic per-user DPAPI) off-domain.</returns> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.IsCurrentUserDomainAccount"> <summary> Returns true when the current process user is an Active Directory domain account on a domain-joined machine (as opposed to a local/workgroup account). This is the switch that drives <see cref="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.GetCurrentUserDescriptor"/>'s AD-vs-non-AD template. Deliberately self-contained (a small netapi32 P/Invoke) so the crypto layer does not take a dependency on the Authentication project; it mirrors <c>AdPrincipalService.IsCurrentUserDomainAccount()</c>. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.IsDomainJoined"> <summary> Checks whether this machine is joined to an AD domain via NetGetJoinInformation (the Netlogon join status, cached in the registry so it also answers correctly offline). </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.ResolveProtectionDescriptor(System.String)"> <summary> The single, unified template for choosing the DPAPI-NG protection descriptor when protecting a <b>Master Key</b> or a <b>Vault key</b>. Both key kinds MUST resolve their descriptor here so their default protection behaves identically across AD and non-AD setups: <list type="number"> <item>If an AD authenticator contributed an explicit descriptor (from its selected principals), use it verbatim — the key is bound to, and roams to, those AD identities.</item> <item>Otherwise fall back to the platform-aware current-user default (<see cref="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.GetCurrentUserDescriptor"/>): a domain-SID descriptor on AD-joined machines, or <c>null</c> (classic per-user DPAPI) on workgroup/local machines.</item> </list> </summary> <param name="adProtectionDescriptor"> The descriptor built from an AD authenticator's principals, or null/empty when the chain has no AD authenticator (password-only, YubiKey-only, or no authenticators at all). </param> <returns>The descriptor to protect the key with; <c>null</c> means classic per-user DPAPI.</returns> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.GetLocalMachineDescriptor"> <summary> Gets the protection descriptor for the local machine. Data protected with this descriptor can be unprotected by any user on the same machine. </summary> <returns>LOCAL=machine protection descriptor</returns> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.CreateMultiSidDescriptor(System.String[])"> <summary> Creates a protection descriptor for multiple SIDs (users or groups). </summary> <param name="sids">Array of SID strings</param> <returns>Combined protection descriptor</returns> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.ZeroUnmanaged(System.IntPtr,System.Int32)"> <summary> Overwrites <paramref name="count"/> bytes of unmanaged memory at <paramref name="ptr"/> with zeros before it is freed, so raw key material does not linger in the process heap/pagefile. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.IsDpapiNgUnavailableError(System.Security.Cryptography.CryptographicException)"> <summary> Checks if the exception indicates DPAPI-NG is unavailable on this system. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.DescriptorIsCurrentUserOnly(System.String)"> <summary> Whether <paramref name="descriptor"/> binds solely to the current user's SID (a single <c>SID=<current-user-SID></c> clause). Only such a descriptor may safely fall back to standard DPAPI when DPAPI-NG is unavailable, because standard DPAPI is also current-user — so it is an equivalent protection, not a downgrade. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.ProtectWithDpapiNg(System.Byte[],System.String)"> <summary> Protects data using DPAPI-NG with SID-based protection descriptor. Only the specified security principals can decrypt the data. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.ProtectWithStandardDpapi(System.Byte[])"> <summary> Protects data using standard DPAPI (current user context). </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.UnprotectWithDpapiNg(System.Byte[])"> <summary> Unprotects data using DPAPI-NG (NCrypt APIs). This is used for data protected with SID-based protection descriptors. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.UnprotectWithStandardDpapi(System.Byte[])"> <summary> Unprotects data using standard DPAPI (CryptUnprotectData). </summary> </member> <member name="T:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.NativeMethods"> <summary> Contains P/Invoke declarations for DPAPI and DPAPI-NG native methods. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.NativeMethods.NetGetJoinInformation(System.String,System.IntPtr@,System.Int32@)"> <summary> Retrieves the machine's domain-join status (used to choose the default protector). </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.NativeMethods.NetApiBufferFree(System.IntPtr)"> <summary> Frees a buffer allocated by the NetApi32 functions (e.g. NetGetJoinInformation). </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.NativeMethods.NCryptCreateProtectionDescriptor(System.String,System.UInt32,PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.SafeNCryptDescriptorHandle@)"> <summary> Creates a protection descriptor from a descriptor string. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.NativeMethods.NCryptCreateProtectionDescriptorRaw(System.String,System.UInt32,System.IntPtr@)"> <summary> Creates a protection descriptor (raw IntPtr version). </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.NativeMethods.NCryptProtectSecret(PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.SafeNCryptDescriptorHandle,System.UInt32,System.Byte[],System.Int32,System.IntPtr,System.IntPtr,System.IntPtr@,System.Int32@)"> <summary> Protects a secret using DPAPI-NG. Note: ppbProtectedBlob is BYTE** - the API allocates memory and returns pointer. Caller must free with LocalFree. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.NativeMethods.NCryptProtectSecretRaw(System.IntPtr,System.UInt32,System.Byte[],System.Int32,System.IntPtr,System.IntPtr,System.IntPtr@,System.Int32@)"> <summary> Protects a secret using DPAPI-NG (raw IntPtr version). </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.NativeMethods.NCryptUnprotectSecret(PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.SafeNCryptDescriptorHandle@,System.UInt32,System.Byte[],System.Int32,System.IntPtr,System.IntPtr,System.IntPtr@,System.Int32@)"> <summary> Unprotects a secret that was protected using DPAPI-NG. Note: ppbData is BYTE** - the API allocates memory and returns pointer. Caller must free with LocalFree. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.NativeMethods.LocalFree(System.IntPtr)"> <summary> Frees memory allocated by NCrypt functions. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.NativeMethods.NCryptCloseProtectionDescriptor(System.IntPtr)"> <summary> Closes a protection descriptor handle. </summary> </member> <member name="T:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.NativeMethods.DATA_BLOB"> <summary> Data blob structure for DPAPI. </summary> </member> <member name="F:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.NativeMethods.DATA_BLOB.cbData"> <summary> The size, in bytes, of the data pointed to by pbData. </summary> </member> <member name="F:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.NativeMethods.DATA_BLOB.pbData"> <summary> A pointer to the data buffer. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.NativeMethods.CryptProtectData(PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.NativeMethods.DATA_BLOB@,System.String,System.IntPtr,System.IntPtr,System.IntPtr,System.UInt32,PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.NativeMethods.DATA_BLOB@)"> <summary> Protects data using standard DPAPI. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.NativeMethods.CryptUnprotectData(PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.NativeMethods.DATA_BLOB@,System.IntPtr,System.IntPtr,System.IntPtr,System.IntPtr,System.UInt32,PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.NativeMethods.DATA_BLOB@)"> <summary> Unprotects data using standard DPAPI. </summary> </member> <member name="T:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.SafeNCryptDescriptorHandle"> <summary> Safe handle for NCRYPT protection descriptor handles. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.SafeNCryptDescriptorHandle.#ctor"> <summary> Initializes a new instance of SafeNCryptDescriptorHandle with ownership of the handle. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.SafeNCryptDescriptorHandle.ReleaseHandle"> <inheritdoc/> </member> <member name="T:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgPortableKeyLoader"> <summary> Loads DPAPI-NG protected keys from exported .key files. Implements <see cref="T:PenguinConverters.Keyra.Core.KeyStorageProvider.IPortableKeyLoader"/> for SDK auto-discovery. </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgPortableKeyLoader.ProviderTypeId"> <summary> Supported file extensions for DPAPI-NG key files. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgPortableKeyLoader.LoadKey(System.Byte[],System.Security.SecureString)"> <summary> Loads a key from .key JSON content. </summary> <param name="keyFileContent">Raw bytes of the .key JSON file</param> <param name="password">Optional password used to protect the key</param> <returns>Loaded IKey instance</returns> <exception cref="T:System.Security.Cryptography.CryptographicException">Thrown when password is incorrect or key is corrupted</exception> </member> <member name="T:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgProtection"> <summary> DPAPI-NG key protection. This provider performs only the Windows <c>NCrypt</c> operation and records how to read the result in its own block of the key entry; it does <b>not</b> implement AES-GCM/password protection (that is the AES-GCM provider's portable scheme, owned by the engine). <para>What it writes, all under <c>providerTypeId: "dpapi-ng"</c>:</para> <list type="bullet"> <item><c>NCryptProtect(key)</c> — tied to a Windows identity (SID descriptor, or the current user when the descriptor is null).</item> <item><c>NCryptProtect(key XOR KEK)</c> when a password factor is present — recorded as the provider property <c>passwordFactor</c>, with the Argon2id salt and recipe beside it.</item> </list> <para> The password-factor mode used to be encoded in an envelope scheme name (<c>dpapi</c> vs <c>dpapi+password</c>), which put an internal mode of this provider into the engine's vocabulary and blocked any new provider from joining it. It is a property of this provider now, invisible to the engine and to every other provider (issue #54). </para> </summary> </member> <member name="F:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgProtection.PROVIDER_DPAPI_NG"> <summary>This provider's id, the sole discriminator for the keys it owns.</summary> </member> <member name="F:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgProtection.PROVIDER_AES_GCM"> <summary>The portable provider a descriptor-less (password-only) re-protect produces.</summary> </member> <member name="F:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgProtection.PropProtector"> <summary> Provider-owned properties. The DPAPI-NG protector, and whether a password factor was XOR-combined into the key before <c>NCryptProtect</c>. These used to be encoded in the envelope scheme name (<c>dpapi</c> vs <c>dpapi+password</c>), which made an internal mode of this provider part of the engine's vocabulary. They are this provider's business now. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgProtection.ProtectKey(System.Byte[],System.Security.SecureString,System.String)"> <summary> Protects an AES key, returning the raw ciphertext together with the provider block that records how to read it back. With a descriptor and no password the key is DPAPI-NG bound; with both, a password factor is XOR-combined in first; with a password and no descriptor the key is not a DPAPI key at all and the engine's portable scheme produces it. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgProtection.UnprotectKey(System.Byte[],System.Security.SecureString,PenguinConverters.Keyra.Core.KeyStorageProvider.KeyProviderBlock)"> <summary> Recovers an AES key from raw <paramref name="ciphertext"/> using the provider block recorded with it. Dispatches on <see cref="P:PenguinConverters.Keyra.Core.KeyStorageProvider.KeyProviderBlock.TypeId"/> - never on the bytes - and performs the Windows <c>NCryptUnprotect</c> for the keys this provider owns. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgProtection.BuildBlock(System.String,System.Boolean,System.Byte[],PenguinConverters.Keyra.Core.Crypto.KdfRecipe)"> <summary> Builds this provider's block. The protector and the password-factor mode are recorded as provider-owned properties; Core does not model them and no other provider reads them. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgProtection.ReadPasswordFactor(PenguinConverters.Keyra.Core.KeyStorageProvider.KeyProviderBlock)"> <summary>Whether a password factor was XOR-combined into the key before DPAPI protection.</summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgProtection.DeriveKek(System.Byte[],System.Byte[],PenguinConverters.Keyra.Core.Crypto.KdfRecipe)"> <summary>Derives the 32-byte Argon2id KEK by executing <paramref name="recipe"/> in the engine.</summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgProtection.ToUtf8PasswordBytes(System.Security.SecureString)"> <summary> Extracts the UTF-8 bytes of a <see cref="T:System.Security.SecureString"/> password. The caller owns the returned buffer and must zero it after use. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgProtection.CombineKeyWithPassword(System.Byte[],System.Byte[])"> <summary> XORs the AES key with the password-derived KEK — the second factor so that both DPAPI-NG unprotection AND the correct password are required. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgProtection.ExtractKeyFromCombined(System.Byte[],System.Byte[])"> <summary>Reverses <see cref="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgProtection.CombineKeyWithPassword(System.Byte[],System.Byte[])"/> to recover the AES key.</summary> </member> <member name="T:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Generators.RandomKeyGenerator"> <summary> Generates cryptographically secure random AES-256 keys. This is the default key generator for the DPAPI-NG provider. </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Generators.RandomKeyGenerator.DisplayName"> <summary> Display name for UI </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Generators.RandomKeyGenerator.Description"> <summary> Description of this generator </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Generators.RandomKeyGenerator.RequiresUserInput"> <summary> This generator does not require user input </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Generators.RandomKeyGenerator.KeySizeBytes"> <summary> Key size: 32 bytes for AES-256 </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Generators.RandomKeyGenerator.Algorithm"> <summary> Gets the AES-256-GCM encryption algorithm specification. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Generators.RandomKeyGenerator.GenerateKey"> <summary> Generates a cryptographically secure random AES-256 key. </summary> <returns>32-byte random key</returns> </member> <member name="T:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Key"> <summary> AES-256-GCM key for encrypting/decrypting vault secrets. Uses authenticated encryption with unique nonces per operation. </summary> </member> <member name="F:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Key.DEFAULT_KEY_ENCIPHERMENT"> <summary> Default value for the KeyEncipherment property. </summary> </member> <member name="F:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Key._keyNext"> <summary> Reference to the next key in the key chain, if any. </summary> </member> <member name="F:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Key._keyStorageProvider"> <summary> The key storage provider that manages this key. </summary> </member> <member name="F:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Key._keyStorageProviderEscrow"> <summary> Escrow key storage providers for key recovery. </summary> </member> <member name="F:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Key._keyEncipherment"> <summary> Indicates whether this key is used for enciphering other keys. </summary> </member> <member name="F:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Key._aesKey"> <summary> The raw AES-256 key material. </summary> </member> <member name="F:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Key._identifier"> <summary> The unique identifier for this key. </summary> </member> <member name="F:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Key._password"> <summary> The password used for key protection, stored securely. </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Key.KeyNext"> <summary> Next key if multiple keys used to encrypt/decrypt secrets </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Key.KeyStorageProvider"> <summary> Key storage provider </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Key.KeyStorageProviderEscrow"> <summary> Key storage provider Escrow </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Key.MaxSecretSize"> <summary> AES-GCM has no practical limit for secret size. Returns int.MaxValue. </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Key.Algorithm"> <summary> Gets the AES-256-GCM encryption algorithm specification. </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Key.KeyEncipherment"> <summary> Defines key purpose. If true key will be used to encrypt next key. Default: false </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Key.Identifier"> <summary> Key identifier (GUID-based) </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Key.Password"> <summary> Password from authenticator chain (write-only for security). Makes a copy of the provided SecureString to prevent external disposal from affecting the key. </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Key.AesKey"> <summary> Internal access to AES key for provider operations </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Key.#ctor"> <summary> Default constructor </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Key.#ctor(System.Byte[],System.String)"> <summary> Constructor with AES key and identifier </summary> <param name="aesKey">AES-256 key (32 bytes)</param> <param name="identifier">Unique key identifier</param> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Key.Decrypt(System.String)"> <summary> Decrypts ciphertext using AES-256-GCM. Input format (Base64): nonce (12) + ciphertext + tag (16) </summary> <param name="ciphertext">Base64-encoded encrypted data</param> <returns>Decrypted plaintext as SecureString</returns> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Key.Encrypt(System.Security.SecureString)"> <summary> Encrypts plaintext using AES-256-GCM. Output format (Base64): nonce (12) + ciphertext + tag (16) </summary> <param name="plaintext">Plaintext as SecureString</param> <returns>Base64-encoded encrypted data</returns> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Key.EncryptBytes(System.Byte[])"> <summary> Encrypts raw bytes using AES-256-GCM, bypassing SecureString. Output format (Base64): nonce (12) + ciphertext + tag (16) </summary> <param name="plaintext">Raw bytes to encrypt</param> <returns>Base64-encoded encrypted data</returns> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Key.DecryptBytes(System.String)"> <summary> Decrypts Base64-encoded ciphertext into raw bytes using AES-256-GCM, bypassing SecureString. Input format (Base64): nonce (12) + ciphertext + tag (16) </summary> <param name="ciphertext">Base64-encoded encrypted data</param> <returns>Decrypted raw bytes</returns> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Key.OpenCipher"> <summary> Opens the value cipher for this key (a non-owning view). Overrides the <see cref="M:PenguinConverters.Keyra.Core.KeyStorageProvider.IKey.OpenCipher"/> default so decryption keeps the plaintext in a Rust-owned buffer (<see cref="M:PenguinConverters.Keyra.Core.KeyStorageProvider.ISecretCipher.DecryptToBuffer(System.String)"/>) — the key stays managed by design. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Key.GetMetadata"> <summary> Returns key metadata (identifier as bytes, not the actual key) </summary> <returns>Key identifier as UTF-8 bytes</returns> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Key.Delete"> <summary> Deletes the key from memory and storage </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Key.Export(PenguinConverters.Keyra.Core.Package@,System.String,System.Security.SecureString)"> <summary> Exports the key (protected) to a package </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Key.Export(PenguinConverters.Keyra.Core.Package@,System.String,System.Security.SecureString,System.String)"> <summary> Exports the key (protected) to a package with a custom DPAPI-NG protection descriptor. </summary> <param name="package">Archive to reference for export</param> <param name="path">Path inside archive to use for exporting</param> <param name="password">Optional password protection from authenticator chain</param> <param name="protectionDescriptor"> DPAPI-NG protection descriptor specifying who can decrypt the key. Examples: - "SID=S-1-5-21-..." (specific user SID) - "SID=S-1-5-21-... OR SID=S-1-5-21-..." (multiple users, any can decrypt) - "SID=S-1-5-21-... AND SID=S-1-5-21-..." (multiple users, all must authorize) - null for current user default </param> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Key.GetPasswordIfAvailable"> <summary> Safely gets the internal password if it's available and not disposed. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Key.Import(System.IO.Stream,System.Security.SecureString)"> <summary> Imports a key from a package </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Key.SetKey(System.Byte[])"> <summary> Sets the AES key (internal use by Provider) </summary> </member> <member name="F:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Key._disposed"> <summary> Tracks whether this key has been disposed. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Key.Dispose(System.Boolean)"> <summary> Disposes the key, securely clearing it from memory </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Key.Dispose"> <summary> Disposes the key </summary> </member> <member name="T:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.KeyMetadata"> <summary> Metadata for stored DPAPI-NG protected keys. Serialized to .key files. </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.KeyMetadata.KeyId"> <summary> Unique key identifier (e.g., "keyra.a1b2c3d4...") </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.KeyMetadata.ProtectedBlob"> <summary> DPAPI-NG protected key blob (Base64 encoded) </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.KeyMetadata.CreatedUtc"> <summary> Key creation timestamp (UTC) </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.KeyMetadata.Algorithm"> <summary> Encryption algorithm used (e.g., "AES-256-GCM") </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.KeyMetadata.Version"> <summary> Metadata format version for future compatibility </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.KeyMetadata.ProviderTypeId"> <summary> Provider type identifier for unified .key format. Used to determine which provider should load this key file. </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.KeyMetadata.KeyVerificationHash"> <summary> Key verification hash (Base64 encoded). Used to verify the decrypted key is correct after password-based decryption. Computed as SHA256(key || "KeyraVerification.v1") </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.KeyMetadata.Provider"> <summary> How this key is protected: the provider that owns it plus that provider's own parameters (the DPAPI-NG protector, whether a password factor was combined in, and the Argon2id salt and recipe when it was). The ONLY description of the derivation - there is no second, summarized copy that could drift from the recipe that ran. </summary> </member> <member name="T:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Metadata"> <summary> Metadata for the DPAPI-NG Key Storage Provider. Describes AES-256-GCM capabilities (fixed key size, no expiration). </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Metadata.ProviderTypeId"> <inheritdoc/> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Metadata.DisplayName"> <inheritdoc/> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Metadata.Description"> <inheritdoc/> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Metadata.SupportedKeySizes"> <inheritdoc/> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Metadata.DefaultKeySize"> <inheritdoc/> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Metadata.SupportsKeyExpiration"> <inheritdoc/> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Metadata.DefaultExpiration"> <inheritdoc/> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Metadata.SupportsAuthenticatorChain"> <inheritdoc/> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Metadata.SupportedAuthenticators"> <inheritdoc/> <remarks> DPAPI-NG has built-in AD protection via SID-based protection descriptors. Uses ActiveDirectory + default authenticators (Password, YubiKey). </remarks> </member> <member name="T:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.NativeSecretCipher"> <summary> The DPAPI-NG key's <see cref="T:PenguinConverters.Keyra.Core.KeyStorageProvider.ISecretCipher"/>: value crypto runs in the native engine with the key passed per call (the key itself is managed by design — it is unwrapped by NCrypt in .NET and stays there, per the DPAPI-stays-.NET boundary). <see cref="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.NativeSecretCipher.DecryptToBuffer(System.String)"/> keeps the decrypted <em>plaintext</em> in a Rust-owned allocation, matching the AES-GCM provider's plaintext custody. Non-owning view; <see cref="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.NativeSecretCipher.Dispose"/> is a no-op. </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.NativeSecretCipher.KeyId"> <inheritdoc/> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.NativeSecretCipher.Algorithm"> <inheritdoc/> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.NativeSecretCipher.Encrypt(System.Byte[])"> <inheritdoc/> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.NativeSecretCipher.Decrypt(System.String)"> <inheritdoc/> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.NativeSecretCipher.DecryptToBuffer(System.String)"> <inheritdoc/> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.NativeSecretCipher.Dispose"> <summary>No-op: this cipher is a view over the key; the key's owner disposes it.</summary> </member> <member name="T:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Provider"> <summary> DPAPI-NG Key Storage Provider using AES-256-GCM encryption. Protects AES keys using DPAPI-NG with SID-based protection descriptors. Supports authenticator chain (Password, YubiKey) for multi-factor key protection. </summary> </member> <member name="F:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Provider.KEY_FILE_EXTENSION"> <summary> File extension used for stored key files. </summary> </member> <member name="F:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Provider.SUBJECT_PREFIX"> <summary> Prefix used for generating key identifiers. </summary> </member> <member name="F:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Provider._configuration"> <summary> The provider configuration containing protection descriptor and key generator settings. </summary> </member> <member name="F:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Provider._identifier"> <summary> The provider identifier, typically a vault directory path. </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Provider.Configuration"> <summary> Provider configuration </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Provider.Identifier"> <summary> Provider identifier (vault directory path) </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Provider.MaxSecretSize"> <summary> AES-GCM has no practical limit for secret size </summary> </member> <member name="P:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Provider.Namespace"> <summary> Provider namespace </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Provider.#ctor"> <summary> Default constructor </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Provider.#ctor(PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Configuration)"> <summary> Constructor with configuration </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Provider.GenerateKey"> <summary> Generates a new AES-256 key without password protection. </summary> <returns>New Key instance</returns> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Provider.GenerateKey(System.Security.SecureString)"> <summary> Generates a new AES-256 key protected by DPAPI-NG. The password (from authenticator chain) provides additional protection. </summary> <param name="password">Optional password from authenticator chain</param> <returns>New Key instance</returns> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Provider.GenerateKey(System.Security.SecureString,System.Byte[])"> <summary> Generates a new AES-256 key protected by DPAPI-NG with additional entropy. The additional entropy is mixed into the generated key using HKDF. </summary> <param name="password">Optional password from authenticator chain</param> <param name="additionalEntropy">Additional entropy to mix into key generation</param> <returns>New Key instance</returns> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Provider.MixKeyWithEntropy(System.Byte[],System.Byte[])"> <summary> Mixes a key with additional entropy using HKDF-like derivation. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Provider.FindKeyByIdentifier(System.String,System.Security.SecureString)"> <summary> Finds and loads an existing key by identifier. </summary> <param name="identifier">Key identifier</param> <param name="password">Password used during key creation (if any)</param> <returns>Loaded Key instance</returns> <exception cref="T:System.Security.Cryptography.CryptographicException">Thrown when password is incorrect</exception> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Provider.DeleteKey(System.String)"> <summary> Deletes a key file by identifier </summary> <param name="identifier">Key identifier</param> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Provider.Delete"> <summary> Deletes the provider and all its keys </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Provider.Export(PenguinConverters.Keyra.Core.Package@,System.String,System.Security.SecureString)"> <summary> Exports the provider configuration to a package </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Provider.Import(System.IO.Stream,System.Security.SecureString)"> <summary> Imports provider configuration from a package </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Provider.GetKeyIdentifiers"> <summary> Gets all key identifiers in this provider </summary> <returns>List of key identifiers</returns> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Provider.ApplyAdProtection(System.String)"> <summary> Binds keys this provider generates to the given AD principals, resolving what that means on this machine through the one shared template (<see cref="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.DpapiNgInterop.ResolveProtectionDescriptor(System.String)"/>): the selected principals when an AD authenticator supplied them, otherwise the platform-aware current-user default (a domain SID on an AD-joined account; null — classic per-user DPAPI — off-domain, where a SID protector has no KDS to derive from and would fail). Callers pass the chain's raw AD descriptor and stay out of that decision; this is the only place it is made for vault keys. </summary> <param name="adProtectionDescriptor"> Descriptor from an AD authenticator's principals, or null/empty when the chain has no AD authenticator. </param> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Provider.ApplyCurrentIdentityProtection"> <inheritdoc/> <remarks> The descriptor for "the identity running this process" is resolved here, inside the provider, rather than by the caller: on an AD-joined machine it is a domain-SID protector, off-domain it is classic per-user DPAPI. A caller only states the intent. </remarks> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Provider.ReprotectKey(PenguinConverters.Keyra.Core.KeyStorageProvider.IKey,System.Security.SecureString,System.String)"> <summary> Re-protects an existing key with a new password and/or protection descriptor. Used when changing the authenticator chain (e.g., Master Key configuration). </summary> <param name="key">The key to re-protect (must be a DpapiNg Key with loaded AES material)</param> <param name="newPassword">New password from authenticator chain (null for DPAPI-NG only)</param> <param name="protectionDescriptor">DPAPI-NG protection descriptor (null for current user default)</param> <returns>True if re-protection succeeded</returns> </member> <member name="F:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Provider.VERIFICATION_SALT"> <summary> Salt string used for computing key verification hashes. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Provider.CreateKeyEntry(System.Security.SecureString,System.Byte[])"> <inheritdoc/> <remarks> Nothing is written here. The Windows <c>NCrypt</c> operation still happens in this provider; what changes is that its result and the properties needed to read it back go into the entry's provider block instead of a file this provider owns. </remarks> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Provider.ReprotectKeyEntry(PenguinConverters.Keyra.Core.KeyStorageProvider.IKey,System.Security.SecureString)"> <inheritdoc/> <remarks> Sharing decides the protection, not the source vault: with no AD descriptor configured the engine's portable scheme produces the entry and it is labelled <c>aes-gcm</c>, because that is what it is. A Windows-bound key would be unreadable to the receiver. </remarks> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Provider.OpenKeyEntry(PenguinConverters.Keyra.Core.SecretStorageProvider.VaultKeyEntry,System.Security.SecureString)"> <inheritdoc/> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Provider.SaveProtectedKey(System.String,System.Byte[],System.String,System.Byte[],PenguinConverters.Keyra.Core.KeyStorageProvider.KeyProviderBlock)"> <summary> Saves a protected key blob to disk along with its metadata. </summary> <param name="path">The file path to save to.</param> <param name="protectedBlob">The DPAPI-NG protected key blob.</param> <param name="keyId">The key identifier.</param> <param name="aesKey">The unprotected AES key used to compute the verification hash.</param> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Provider.LoadKeyMetadata(System.String)"> <summary> Loads and deserializes key metadata from a key file. </summary> <param name="path">The file path to load from.</param> <returns>The deserialized key metadata.</returns> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Provider.ComputeVerificationHash(System.Byte[])"> <summary> Computes a verification hash from the AES key. Used to verify the key is correct after decryption. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Provider.VerifyKey(System.Byte[],System.String)"> <summary> Verifies the decrypted key matches the stored verification hash. </summary> </member> <member name="F:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Provider._disposed"> <summary> Tracks whether this provider has been disposed. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Provider.Dispose(System.Boolean)"> <summary> Disposes the provider </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Provider.Dispose"> <summary> Disposes the provider </summary> </member> <member name="T:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.ProviderBuilder"> <summary> Builder for creating DPAPI-NG Key Storage Provider instances. </summary> </member> <member name="F:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.ProviderBuilder._provider"> <summary> The provider instance being configured by this builder. </summary> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.ProviderBuilder.AddVaultIdentifier(System.String)"> <summary> Sets the vault identifier (directory path) for the provider. </summary> <param name="identifier">Vault directory path</param> <returns>This builder for fluent chaining</returns> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.ProviderBuilder.AddConfiguration(System.Byte[])"> <summary> Sets the provider configuration from serialized bytes. </summary> <param name="configuration">JSON-serialized configuration bytes</param> <returns>This builder for fluent chaining</returns> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.ProviderBuilder.AddConfiguration(PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.Configuration)"> <summary> Sets the provider configuration directly. </summary> <param name="configuration">Configuration instance</param> <returns>This builder for fluent chaining</returns> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.ProviderBuilder.AddProtectionDescriptor(System.String)"> <summary> Sets the protection descriptor for DPAPI-NG. </summary> <param name="descriptor">SID-based protection descriptor</param> <returns>This builder for fluent chaining</returns> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.ProviderBuilder.AddKeyGenerator(PenguinConverters.Keyra.Core.KeyStorageProvider.IKeyGenerator)"> <summary> Sets the key generator for creating new keys. </summary> <param name="keyGenerator">Key generator instance</param> <returns>This builder for fluent chaining</returns> </member> <member name="M:PenguinConverters.Keyra.KeyStorageProvider.DpapiNg.ProviderBuilder.Build"> <summary> Builds and returns the configured provider. </summary> <returns>Configured Provider instance</returns> </member> </members> </doc> |