Cryptography¶

Nalix ships several cryptography primitives in Nalix.Codec.Security, but they are easier to read as separate topics than as one long page.

Source mapping¶

Topic	Main types	Read next
Hashing and MAC	`Keccak256`, `HmacKeccak256`, `Poly1305`, `Pbkdf2`	Hashing and MAC
AEAD and envelope encryption	`ChaCha20Poly1305`, `Salsa20Poly1305`, `EnvelopeCipher`	AEAD and Envelope
Handshake protocol	`HandshakeHandlers`, `X25519`	Handshake Protocol
Security enums	`CipherSuiteType`, `DropPolicy`

use X25519 for session key agreement
use Keccak256 for transcript hashing and proofs
use EnvelopeCipher when you want the high-level transport-facing encryption entry point
use Pbkdf2 for credential hashing helpers
use Csprng when you need secure random bytes, nonces, or unbiased random integers

var keys = X25519.GenerateKeyPair();
byte[] digest = Keccak256.HashData(payload);

Pbkdf2.Hash("secret", out byte[] salt, out byte[] hash);

Nalix also ships Csprng in Nalix.Framework.Random:

Use it for:

secure byte generation with GetBytes(...) or Fill(...)
nonce generation with CreateNonce(...)
unbiased integer sampling with GetInt32(...)
strict cryptographic randomness only; if the operating system CSPRNG cannot be initialized, Nalix throws instead of downgrading to a non-cryptographic fallback

byte[] key = Csprng.GetBytes(32);
byte[] nonce = Csprng.CreateNonce();
int shard = Csprng.GetInt32(0, 8);