CLR Security

Updated Wiki: Security.AppDomain

shawnfa — Thu, 06 Nov 2008 18:55:06 GMT

System.AppDomain

Several extension methods for the AppDomain class are provided in the AppDomainExtensionMethods type. This type is in the Security namespace (not the System namespace), so in order to use these extension methods, you will need to make sure you include this namespace as well as a reference to Security.dll.

APIs

PermissionSetAppDomain::GetPermissionSet()

The GetPermissionSet method returns the permission set that the current AppDomain is sandboxed with. This is the permission set which is used if a security demand crosses the AppDomain boundary. Using this method requires FullTrust.

bool AppDomain::IsHomogenous()

The IsHomogenous method detects if an AppDomain is a simple sandbox style domain, created by passing a PermissionSet to the AppDomain.CreateDomain call. If the domain is a simple sandbox, IsHomogenous returns true; if it is a legacy v1.x domain, IsHomogenous returns false.

bool AppDomain::IsSandboxed()

The IsSandboxed method returns true if the current AppDomain is a sandboxed AppDomain. That is, if the current AppDomain has a grant set other than FullTrust.

Source code checked in, #16815

shawnfa — Thu, 06 Nov 2008 18:53:11 GMT

Add an AppDomain.IsHomogenous extension method to enable detection of simple sandbox domains

Updated Wiki: Security.Reflection.Assembly

shawnfa — Fri, 17 Oct 2008 19:46:41 GMT

System.Reflection.Assembly

Several extension methods for the Assembly class are provided in the AssemblyExtensionMethods type. This type is in the Security.Reflection namespace (not the System.Reflection namespace), so in order to use these extension methods, you will need to make sure you include this namespace as well as a reference to Security.dll.

APIs

PermissionSetAssembly::GetPermissionSet()

The GetPermissionSet method returns the permission set that an assembly is granted. This method works for assemblies loaded via implicit loads, or explicit calls to Assembly.Load(String) or Assembly.LoadFrom. Results may not be accurate for assemblies loaded via Assembly.Load(byte[]), or dynamic assemblies created with AppDomain::DefineDynamicAssembly.

This method requires FullTrust to use.

StrongNameAssembly::GetStrongName()

Exceptions:

ArgumentException

if the assembly is not strongly named

The GetStrongName method returns a StrongName object representing the strong name of the assembly it is called on. This strong name may be different from the strong name in the assembly's evidence if a host has chosen to load the assembly with custom evidence.

bool Assembly::IsFullyTrusted()

The IsFullyTrusted method returns true if the assembly is granted to full trust. This method may not return accurate results for assemblies loaded from a byte array, or defined dynamically with DefineDynamicAssembly.

bool Assembly::IsStrongNamed()

The IsStrongNamed method returns true if the assembly is signed with a strong name key pair. It does not attempt to detect if the assembly is delay signed and loaded due to a skip verification entry on the machine.

Updated Wiki: Security.Policy.StrongName

shawnfa — Fri, 17 Oct 2008 19:38:04 GMT

System.Security.Policy.StrongName

Several extension methods for the StrongName class are provided in the StrongNameExtensionMethods type. This type is in the Security.Policy namespace (not the System.Security.Policy namespace), so in order to use these extension methods, you will need to make sure you include this namespace as well as a reference to Security.dll.

APIs

StrongNameMembershipCondition StrongName::CreateMembershipCondition()

The CreateMembershipCondition method builds a membership condition which exactly matches the current strong name (including version).

Updated Wiki: Security.Policy.Evidence

shawnfa — Fri, 17 Oct 2008 19:32:57 GMT

System.Security.Policy.Evidence

Several extension methods for the Evidence class are provided in the EvidenceExtensionMethods type. This type is in the Security.Policy namespace (not the System.Security.Policy namespace), so in order to use these extension methods, you will need to make sure you include this namespace as well as a reference to Security.dll.

APIs

T Evidence::GetAssemblyEvidence<T>()

GetAssemblyEvidence<T> retrieves the first evidence object of type T supplied by the assembly that the Evidence collection is for. If no evidence object of type T exists in the assembly evidence list, then null is returned.

T Evidence::GetHostEvidence<T>()

GetAssemblyEvidence<T> retrieves the first evidence object of type T supplied by the host for the assembly or AppDomain that the Evidence collection is for. If no evidence object of type T exists in the host evidence list, then null is returned.

Updated Wiki: Security.Policy.ApplicationTrust

shawnfa — Fri, 17 Oct 2008 19:30:09 GMT

System.Security.Policy.ApplicationTrust

Several extension methods for the ApplicationTrust class are provided in the ApplicationTrustExtensionMethods type. This type is in the Security.Policy namespace (not the System.Security.Policy namespace), so in order to use these extension methods, you will need to make sure you include this namespace as well as a reference to Security.dll.

IList<StrongName> ApplicationTrust::GetFullTrustAssemblies()

An ApplicationTrust object contains a default grant set as well as a list of assemblies which are fully trusted. The GetFullTrustAssemblies method retrieves the strong names of assemblies which the ApplicationTrust object considers to be fully trusted.

Updated Wiki: Security.SecurityElement

shawnfa — Fri, 17 Oct 2008 19:21:20 GMT

System.Security.SecurityElement

Several extension methods for the SecurityElement class are provided in the SecurityElementExtensionMethods type. This type is in the Security namespace (not the System.Security namespace), so in order to use these extension methods, you will need to make sure you include this namespace as well as a reference to Security.dll.

APIs

XmlElementSecurityElement::ToXmlElement()

ToXmlElement converts a SecurityElement to an equivalent XML tree in the System.Xml namespace.

XmlElementSecurityElement::ToXmlElement(XmlDocument containingDocument)

Parameters:

containingDocument

XML Document that the created SecurityElement should be a member of

Exceptions:

ArgumentNullException

if containingDocument is null

ToXmlElement converts a SecurityElement to an equivalent XML tree in the System.Xml namespace.

bool SecurityElement::XmlEquals(SecurityElement rhs)

Parameters:

rhs	SecurityElement to compare the current element with

Exceptions:

ArgumentNullException

if rhs is null

XmlEquals performs a case-sensitive comparison of two SecurityElement XML trees. The return value of this method is true if:

The tags of each element are the same
The attributes of each element are the same
The child elements are XmlEqual to each other (in the order they appear in)
Contained text is equal

bool SecurityElement::XmlEquals(SecurityElement rhs, StringComparison comparisonType)

Parameters:

rhs	SecurityElement to compare the current element with
comparisonType	type of string comparsions to make

Exceptions:

ArgumentNullException

if rhs is null

XmlEquals performs a comparison of two SecurityElement XML trees using the given string comparison operator. The return value of this method is true if:

The tags of each element are the same
The attributes of each element are the same
The child elements are XmlEqual to each other (in the order they appear in)
Contained text is equal

Updated Wiki: Security.AppDomain

shawnfa — Fri, 17 Oct 2008 19:12:11 GMT

System.AppDomain

APIs

PermissionSetAppDomain::GetPermissionSet()

bool AppDomain::IsSandboxed()

The IsSandboxed method returns true if the current AppDomain is a sandboxed AppDomain. That is, if the current AppDomain has a grant set other than FullTrust.

Updated Wiki: Security.dll

shawnfa — Fri, 17 Oct 2008 19:06:06 GMT

Security.dll

Security.dll provides a set of extension methods to ease working with the Code Access Security system in the .NET Framework.

Download

Security 1.0

Class Reference

Security.AppDomain - A set of extension methods for the AppDomain type
Security.SecurityElement - A set of extension methods for the SecurityElement type

Security.Policy.ApplicationTrust - A set of extension methods for the ApplicationTrust type
Security.Policy.Evidence - A set of extension methods for the Evidence type
Security.Policy.StrongName - A set of extension methods for the StrongName type

Security.Reflection.Assembly - A set of extension methods for the Assembly type

Updated Wiki: Home

shawnfa — Fri, 17 Oct 2008 19:01:56 GMT

Introduction

Welcome to the CLR security team's Codeplex site. On this site you'll find a set of projects that extend the security APIs shipped with the .NET framework to provide additional functionality. We also have some tools to help in debugging security related problems in your code.

Project Description: Security.dll
Security.dll provides a set of extension methods to ease working with the Code Access Security system in the .NET Framework. Within this project you will find:

Methods to determine the grant set of an assembly or AppDomain
Methods to help in creating and examining simple sandbox domains
Methods to make working with classes like Evidence and SecurityElement easier

Download Security 1.0

Project Description: Security.Cryptography.dll
Security.Cryptography.dll provides a new set of algorithm implementations to augment the built in .NET framework supported algorithms. It also provides some APIs to extend the existing framework cryptography APIs. Within this project you will find:

A CNG implementation of the AES, RSA, and TripleDES encryption algorithms
A CNG implementation of a random number generator
A class that allows dynamically creating algorithms both from this library as well as all of the algorithms that ship with .NET 3.5
An enumerator over all of the installed CNG providers on the current machine
Extension methods that allow access to all of the keys installed in a CNG provider, as well as all of the algorithms the provider supports

Download Security.Cryptography 1.2

Project Description: Security.Cryptography.Debug.dll
Have you ever run into an indecipherable cryptographic exception complaining about "Padding is invalid and cannot be removed" when using the .NET Framework's symmetric algorithms? Since nearly all bugs relating to symmetric algorithms tend to result in this same exception, it can be incredibly difficult to track down exactly what went wrong to cause the exception. Security.Cryptography.Debug.dll is a tool that can be used in these circumstances in order to help you figure out the root cause of your cryptographic exception.

Download Security.Cryptography.Debug 1.0

Updated Release: Security 1.0 (Oct 17, 2008)

shawnfa — Fri, 17 Oct 2008 18:57:10 GMT

This is the first release of the Security.dll library, which provides extension methods and helper APIs for withing with the .NET Framework Code Access Security system. This release contains:

Extension Methods:

AppDomain
ApplicationTrust
Assembly
Evidence
SecurityElement
StrongName

Released: Security 1.0 (Oct 17, 2008)

Fri, 17 Oct 2008 18:57:10 GMT

AppDomain
ApplicationTrust
Assembly
Evidence
SecurityElement
StrongName

Source code checked in, #16444

shawnfa — Fri, 17 Oct 2008 18:56:33 GMT

Security.dll 1.0: Extension Methods: *AppDomain *ApplicationTrust *Assembly *Evidence *SecurityElement *StrongName

Updated Release: Security.Cryptography 1.2 (Sep 23, 2008)

shawnfa — Tue, 23 Sep 2008 18:02:30 GMT

This update to the Security.Cryptography.dll library adds new classes to support working with X.509 certificates. The release contains all checkins through change set 15596.

Updated APIs:

CngKey - Adds a CreateSelfSignedCertificate extension method to create an X.509 certificate that contains the given key
X509Certificate - Adds a HasCngKey extension method to detect if a certificate's key is stored in CNG or CAPI
X509Certificate2 - Adds a GetCngPrivateKey extension method to get a certificate's private key if it is stored in CNG

Released: Security.Cryptography 1.2 (Sep 23, 2008)

Tue, 23 Sep 2008 18:02:30 GMT

This update to the Security.Cryptography.dll library adds new classes to support working with X.509 certificates. The release contains all checkins through change set 15596.

Updated APIs:

CngKey - Adds a CreateSelfSignedCertificate extension method to create an X.509 certificate that contains the given key
X509Certificate - Adds a HasCngKey extension method to detect if a certificate's key is stored in CNG or CAPI
X509Certificate2 - Adds a GetCngPrivateKey extension method to get a certificate's private key if it is stored in CNG

Updated Release: Security.Cryptography 1.1 (Aug 25, 2008)

shawnfa — Tue, 23 Sep 2008 17:54:17 GMT

This update to the Security.Cryptography.dll library fixes some bugs in the RSACng class as well as a few new classes and methods. The release contains all checkins through change set 15300.

Utility Classes:

CryptoConfig2 - added an AddAlgorithm method
RSAPKCS1SHA256SignatureDescription

Updated Wiki: Security.Cryptography.dll

shawnfa — Tue, 23 Sep 2008 17:53:38 GMT

Security.Cryptography.dll

Security.Cryptography.dll provides a new set of algorithm implementations to augment the built in .NET framework supported algorithms. It also provides some APIs to extend the existing framework cryptography APIs. All of the CNG APIs provided in this library require Windows Vista or greater to run. The library itself is built upon the .NET Framework version 3.5. The sources are provided in a Visual Studio 2008 project.

Download

Security.Cryptography 1.2

Class Reference

Security.Cryptography.AesCng - A managed wrapper around the CNG implementation of the AES algorithm
Security.Cryptography.CngAlgorithm2 - A set of additional CngAlgorithm objects for algorithms not in the framework's CngAlgorithm type.
Security.Cryptography.CngProviderCollection - Enumerates over the installed CNG providers on the machine
Security.Cryptography.CryptoConfig2 - Provides CryptoConfig like access to all of the algorithms included in standard CryptoConfig, as well as the algorithms in the .NET 3.5 System.Core.dll assembly and in the Security.Cryptography.dll assembly.
Security.Cryptography.RNGCng - A managed wrapper around the CNG random number generator
Security.Cryptography.RSACng - A managed wrapper around the CNG implementation of the RSA algorithm
Security.Cryptography.RSAPKCS1SHA256SignatureDescription - A signature description class for RSA-SHA256 signatures.
Security.Cryptography.TripleDESCng - A managed wrapper around the CNG implementation of the 3DES algorithm

System.Security.Cryptography.CngProvider - A set of extension methods for the CngProvider type
System.Security.Cryptography.CngKey - A set of extension methods for the CngKey type

Security.Cryptography.X509Certificates.X509CertificateCreationOptions - Flags for use when creating a new X509 certificate
Security.Cryptography.X509Certificates.X509CertificateCreationParameters - Configuration parameters for use when creating a new X509 certificate
Security.Cryptography.X509Certificates.X509CertificateSignatureAlgorithm - Algorithms which can be used to sign a new X509 certificate

System.Security.Cryptography.X509Certificates.X509Certificate - A set of extension methods for the X509Certificate type
System.Security.Cryptography.X509Certificates.X509Certificate2 - A set of extension methods for the X509Certificate2 type

Updated Wiki: Home

shawnfa — Tue, 23 Sep 2008 17:52:49 GMT

Introduction

Welcome to the CLR security team's Codeplex site. On this site you'll find a set of projects that extend the security APIs shipped with the .NET framework to provide additional functionality. We also have some tools to help in debugging security related problems in your code.

Project Description: Security.Cryptography.dll
Security.Cryptography.dll provides a new set of algorithm implementations to augment the built in .NET framework supported algorithms. It also provides some APIs to extend the existing framework cryptography APIs. Within this project you will find:

A CNG implementation of the AES, RSA, and TripleDES encryption algorithms
A CNG implementation of a random number generator
A class that allows dynamically creating algorithms both from this library as well as all of the algorithms that ship with .NET 3.5
An enumerator over all of the installed CNG providers on the current machine
Extension methods that allow access to all of the keys installed in a CNG provider, as well as all of the algorithms the provider supports

Updated Release: Security.Cryptography 1.2 (Sep 23, 2008)

shawnfa — Tue, 23 Sep 2008 17:50:52 GMT

This update to the Security.Cryptography.dll library adds new classes to support working with X.509 certificates. The release contains all checkins through change set 15596.

Updated APIs:

CngKey - Adds a CreateSelfSignedCertificate extension method to create an X.509 certificate that contains the given key
X509Certificate - Adds a HasCngKey extension method to detect if a certificate's key is stored in CNG or CAPI
X509Certificate2 - Adds a GetCngPrivateKey extension method to get a certificate's private key if it is stored in CNG

Source code checked in, #15596

shawnfa — Mon, 08 Sep 2008 22:12:46 GMT

Add some additional information about the use of DangerousAddRef in the AcquireCngPrivateKey method.