Class ReversibleStringTransforms

Creates reusable reversible string transformations.

Inheritance

object

ReversibleStringTransforms

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Namespace: Eigenverft.NetLib.Infrastructure.Transformations

Assembly: Eigenverft.NetLib.Infrastructure.dll

Syntax

public static class ReversibleStringTransforms

Remarks

These transformations are intentionally persistence-neutral. They do not add JSON-settings enc: wrappers and they do not decide which configuration keys are transformed. Persisted format/version ownership remains with the caller that frames the transformed payload, such as ConfigurationValueCodec.

Properties

Base64

Gets a UTF-8 to Base64 representation transform.

Declaration

public static ReversibleStringTransform Base64 { get; }

Property Value

Type	Description
ReversibleStringTransform

Remarks

Base64 is a storage representation only. It may obscure text visually but provides no cryptographic protection.

Base92JsonSafe

Gets the JSON-safe Base92 representation transform.

Declaration

public static ReversibleStringTransform Base92JsonSafe { get; }

Property Value

Type	Description
ReversibleStringTransform

Remarks

Base92JsonSafe is a representation and analysis-friction layer, not cryptographic protection. It may hide immediately recognizable inner text from trivial inspection but adds no secret or cryptographic boundary.

DpapiMachine

Gets the Windows DPAPI LocalMachine transform represented as Base64.

Declaration

public static ReversibleStringTransform DpapiMachine { get; }

Property Value

Type	Description
ReversibleStringTransform

Remarks

LocalMachine binds protected bytes to the Windows machine, not to an administrator or individual user. Windows permits another user on the same machine to unprotect a LocalMachine payload. The security value is therefore the originating machine-context requirement. Base64 is only the string representation for the protected bytes.

DpapiMachineBase64Url

Gets the Windows DPAPI LocalMachine transform represented as unpadded Base64Url.

Declaration

public static ReversibleStringTransform DpapiMachineBase64Url { get; }

Property Value

Type	Description
ReversibleStringTransform

Remarks

LocalMachine is machine scope, not user/admin isolation. Base64Url is only the persisted string representation around DPAPI bytes and is not another protection factor.

Rot13

Gets the ROT13 obfuscation transform.

Declaration

public static ReversibleStringTransform Rot13 { get; }

Property Value

Type	Description
ReversibleStringTransform

Remarks

ROT13 is deliberately weak obfuscation and analysis friction. It can disrupt trivial string matching but provides no cryptographic protection and adds no secret factor.

Methods

AesPassword(byte[])

Creates the same AES-GCM transform from visible ASCII password bytes.

Declaration

public static ReversibleStringTransform AesPassword(byte[] passwordAsciiBytes)

Parameters

Type	Name	Description
byte[]	passwordAsciiBytes	Visible ASCII bytes representing the password.

Returns

Type	Description
ReversibleStringTransform	The same transform as the equivalent string password.

Remarks

This overload can avoid a clear password in the assembly string-literal table, but it is only a small static-analysis obstacle and is not a secrecy boundary. The bytes remain recoverable from the executable. Bytes outside visible ASCII 0x21 through 0x7E are rejected deliberately.

AesPassword(string)

Creates a password-derived AES-GCM transform.

Declaration

public static ReversibleStringTransform AesPassword(string password)

Parameters

Type	Name	Description
string	password	The non-empty visible-ASCII password used to derive the AES key.

Returns

Type	Description
ReversibleStringTransform	A parameterized AES-GCM transform.

Remarks

Security is bounded by how the caller obtains and protects the password. The transform captures that password for its lifetime, so callers should assume it is recoverable from a sufficiently compromised process or from static analysis when embedded directly in the consuming executable.

The transformed payload is explicitly versioned. Its Base64Url fields are only representations of binary AES payload parts. Future KDF/cipher changes require a deliberate new payload version or explicit migration.

Caesar(int)

Creates a Caesar-shift obfuscation transform for ASCII letters.

Declaration

public static ReversibleStringTransform Caesar(int shift)

Parameters

Type	Name	Description
int	shift	The letter shift. Values are normalized modulo 26.

Returns

Type	Description
ReversibleStringTransform	A reversible Caesar transform.

Remarks

Caesar shifting is deliberately weak obfuscation and analysis friction; it provides no cryptographic protection. The normalized shift is carried in the transformed value so it is not secret. Carrying the shift also allows callers that know the expected transform to reject a payload produced with a different shift.

Compose(params ReversibleStringTransform[])

Composes reversible transforms into one transform.

Declaration

public static ReversibleStringTransform Compose(params ReversibleStringTransform[] transforms)

Parameters

Type	Name	Description
ReversibleStringTransform[]	transforms	Transforms in forward execution order.

Returns

Type	Description
ReversibleStringTransform	A transform that applies from first to last and reverses from last to first.

Remarks

This is pure value-level composition. It does not add persistence framing between stages. Callers that require nested persisted wrappers or stage-specific migration metadata must compose at their persistence/codec layer instead.

PhysicalMachineBoundAes()

Creates an AES-GCM transform whose password material is derived from the current platform fingerprint.

Declaration

public static ReversibleStringTransform PhysicalMachineBoundAes()

Returns

Type	Description
ReversibleStringTransform

Remarks

This is lightweight machine binding, not a hardware-backed secret. It is intended to make application-directory-only theft insufficient for offline reversal on another machine unless the source platform identity was also collected. An attacker with sufficient source-machine access can read the same identity and reproduce the fingerprint.