Merge remote-tracking branch 'GH_CSharp/GenFreeWin'

Author: joecare99

GenFreeWin/GenSecure.Contracts/ICurrentPrincipalProvider.cs

@@ -0,0 +1,13 @@
+namespace GenSecure.Contracts;
+
+/// <summary>
+/// Provides the stable identifier of the current principal for secure-store access control.
+/// </summary>
+public interface ICurrentPrincipalProvider
+{
+    /// <summary>
+    /// Gets the identifier of the current principal.
+    /// </summary>
+    /// <returns>The current principal identifier.</returns>
+    string GetCurrentPrincipalId();
+}

GenFreeWin/GenSecure.Contracts/ILocalKeyProtector.cs

@@ -0,0 +1,21 @@
+namespace GenSecure.Contracts;
+
+/// <summary>
+/// Protects and unprotects the local master key material on the current machine.
+/// </summary>
+public interface ILocalKeyProtector
+{
+    /// <summary>
+    /// Protects the specified plaintext bytes for local storage.
+    /// </summary>
+    /// <param name="arrPlaintext">The plaintext bytes to protect.</param>
+    /// <returns>The protected payload.</returns>
+    byte[] Protect(byte[] arrPlaintext);
+
+    /// <summary>
+    /// Unprotects the specified locally protected bytes.
+    /// </summary>
+    /// <param name="arrProtectedData">The protected payload to unprotect.</param>
+    /// <returns>The original plaintext bytes.</returns>
+    byte[] Unprotect(byte[] arrProtectedData);
+}

GenFreeWin/GenSecure.Contracts/IPersonSecureStore.cs

@@ -42,17 +42,17 @@ public interface IPersonSecureStore
     void Delete(string sPersonId, DeleteMode eMode);
 
     /// <summary>
-    /// Grants access to a Windows SID for an existing person record.
+    /// Grants access to a principal identifier for an existing person record.
     /// </summary>
     /// <param name="sPersonId">The stable person identifier.</param>
-    /// <param name="sWindowsSid">The Windows SID to add.</param>
-    void GrantAccess(string sPersonId, string sWindowsSid);
+    /// <param name="sPrincipalId">The principal identifier to add.</param>
+    void GrantAccess(string sPersonId, string sPrincipalId);
 
     /// <summary>
-    /// Gets the SHA-256 hashes of Windows SIDs that are permitted to decrypt a person record.
-    /// The raw SIDs are never persisted; only their hashes are stored.
+    /// Gets the hashes of principal identifiers that are permitted to decrypt a person record.
+    /// The raw principal identifiers are never persisted; only their hashes are stored.
     /// </summary>
     /// <param name="sPersonId">The stable person identifier.</param>
-    /// <returns>SHA-256 hashes (lowercase hex) of the configured Windows SIDs.</returns>
-    IReadOnlyCollection<string> GetAllowedWindowsSidHashes(string sPersonId);
+    /// <returns>Lowercase hex hashes of the configured principal identifiers.</returns>
+    IReadOnlyCollection<string> GetAllowedPrincipalHashes(string sPersonId);
 }

GenFreeWin/GenSecure.Contracts/README.md

@@ -12,13 +12,15 @@ tested with mocks and swapped without recompilation.
 ## Key Features
 
 - `IPersonSecureStore` — save, load, delete, exists, and access-control operations
+- `ICurrentPrincipalProvider` — supplies the current platform principal identifier
+- `ILocalKeyProtector` — abstracts local master-key protection for the active platform
 - `IMasterKeyBackupService` — PBKDF2 recovery key creation and restore
 - `DeleteMode` — `SoftDelete` (removes files) vs. `SecureDelete` (crypto-deletion, DSGVO Art. 17)
 - `StoreMode` — `Encrypted` (AES-256-GCM, living persons) vs. `Plaintext` (deceased / historical)
 
 ## Targets
 
-`net9.0-windows`
+`net481`, `net6.0`, `net7.0`, `net8.0`
 
 ## Public API
 
@@ -34,8 +36,8 @@ void Delete(string sPersonId, DeleteMode eMode);
 //   DeleteMode.SecureDelete — removes only the DEK (crypto-deletion); plaintext fallback: data file
 
 // Access control
-void GrantAccess(string sPersonId, string sWindowsSid);
-IReadOnlyCollection<string> GetAllowedWindowsSidHashes(string sPersonId);
+void GrantAccess(string sPersonId, string sPrincipalId);
+IReadOnlyCollection<string> GetAllowedPrincipalHashes(string sPersonId);
 
 // Recovery
 void CreateRecoveryKeyBackup(string sPassphrase, bool xOverwrite = false);

GenFreeWin/GenSecure.Core.Tests/GenSecure.Core.Tests.csproj

@@ -1,7 +1,7 @@
 <Project>
 	<Import Project="..\GenFreeWin.props" />
 	<PropertyGroup>
-		<TargetFramework>net9.0-windows</TargetFramework>
+		<TargetFramework>net9.0</TargetFramework>
 		<ImplicitUsings>disable</ImplicitUsings>
 		<IsPackable>false</IsPackable>
 		<UseWPF>false</UseWPF>

GenFreeWin/GenSecure.Core.Tests/GenealogySecureStoreTests.cs

@@ -197,12 +197,18 @@ public GenealogyStoreScope()
             {
                 RootDirectory = sRootDirectory,
             };
-            BackupService = new MasterKeyBackupService(Options);
-            Store = new GenealogySecureStore(BackupService, Options);
+            LocalKeyProtector = new PassThroughLocalKeyProtector();
+            PrincipalProvider = new FixedPrincipalProvider();
+            BackupService = new MasterKeyBackupService(Options, LocalKeyProtector);
+            Store = new GenealogySecureStore(BackupService, Options, PrincipalProvider);
         }
 
         public GenSecureStoreOptions Options { get; }
 
+        public PassThroughLocalKeyProtector LocalKeyProtector { get; }
+
+        public FixedPrincipalProvider PrincipalProvider { get; }
+
         public MasterKeyBackupService BackupService { get; }
 
         public GenealogySecureStore Store { get; }
@@ -220,6 +226,26 @@ public void Dispose()
                 Directory.Delete(Options.GetValidatedRootDirectory(), recursive: true);
             }
         }
+
+        public sealed class PassThroughLocalKeyProtector : ILocalKeyProtector
+        {
+            public byte[] Protect(byte[] arrPlaintext)
+            {
+                ArgumentNullException.ThrowIfNull(arrPlaintext);
+                return arrPlaintext.ToArray();
+            }
+
+            public byte[] Unprotect(byte[] arrProtectedData)
+            {
+                ArgumentNullException.ThrowIfNull(arrProtectedData);
+                return arrProtectedData.ToArray();
+            }
+        }
+
+        public sealed class FixedPrincipalProvider : ICurrentPrincipalProvider
+        {
+            public string GetCurrentPrincipalId() => "user:test-user";
+        }
     }
 
     private sealed class BaseGenClassesFactory : IGenealogyModelFactory

GenFreeWin/GenSecure.Core.Tests/PersonSecureStoreTests.cs

@@ -119,13 +119,13 @@ public void SecureDelete_Plaintext_ShouldRemoveDataFile()
     }
 
     [TestMethod]
-    public void GetAllowedWindowsSidHashes_ShouldReturnHmacSha256Hashes_NotRawSids()
+    public void GetAllowedPrincipalHashes_ShouldReturnHmacSha256Hashes_NotRawPrincipalIds()
     {
         using TestStoreScope scope = new();
 
         scope.Store.Save("person-5", new TestPerson("Emmy", "Noether"));
 
-        IReadOnlyCollection<string> lstHashes = scope.Store.GetAllowedWindowsSidHashes("person-5");
+        IReadOnlyCollection<string> lstHashes = scope.Store.GetAllowedPrincipalHashes("person-5");
 
         Assert.AreEqual(1, lstHashes.Count);
 
@@ -134,28 +134,27 @@ public void GetAllowedWindowsSidHashes_ShouldReturnHmacSha256Hashes_NotRawSids()
         // An HMAC-SHA256 output is 32 bytes = exactly 64 lowercase hex characters
         Assert.AreEqual(64, sSidHash.Length);
         Assert.IsTrue(sSidHash.All(c => (c >= '0' && c <= '9') || (c >= 'a' && c <= 'f')),
-            "The returned value must be a lowercase hex string, not a raw Windows SID.");
+            "The returned value must be a lowercase hex string, not a raw principal identifier.");
 
-        // Must not look like a Windows SID
-        Assert.IsFalse(sSidHash.StartsWith("S-", StringComparison.OrdinalIgnoreCase));
+        // Must not be the raw principal identifier
+        Assert.IsFalse(string.Equals(scope.PrincipalProvider.CurrentPrincipalId, sSidHash, StringComparison.OrdinalIgnoreCase));
 
-        // Must not be the plain SHA-256 of the SID — proves the HMAC pepper is in use
-        string sCurrentSid = System.Security.Principal.WindowsIdentity.GetCurrent().User?.Value ?? string.Empty;
-        string sPlainSha256 = Convert.ToHexString(SHA256.HashData(Encoding.UTF8.GetBytes(sCurrentSid))).ToLowerInvariant();
+        // Must not be the plain SHA-256 of the principal ID — proves the HMAC pepper is in use
+        string sPlainSha256 = Convert.ToHexString(SHA256.HashData(Encoding.UTF8.GetBytes(scope.PrincipalProvider.CurrentPrincipalId))).ToLowerInvariant();
         Assert.AreNotEqual(sPlainSha256, sSidHash,
-            "The stored hash must be HMAC-SHA256(SID, pepper), not plain SHA-256(SID).");
+            "The stored hash must be HMAC-SHA256(principalId, pepper), not plain SHA-256(principalId).");
     }
 
     [TestMethod]
     public void GrantAccess_ShouldStoreHashAndBeVerifiable()
     {
         using TestStoreScope scope = new();
 
-        const string sFakeSid = "S-1-5-21-0000000000-1111111111-2222222222-500";
+        const string sFakePrincipalId = "user:granted-user";
         scope.Store.Save("person-6", new TestPerson("Lise", "Meitner"));
-        scope.Store.GrantAccess("person-6", sFakeSid);
+        scope.Store.GrantAccess("person-6", sFakePrincipalId);
 
-        IReadOnlyCollection<string> lstHashes = scope.Store.GetAllowedWindowsSidHashes("person-6");
+        IReadOnlyCollection<string> lstHashes = scope.Store.GetAllowedPrincipalHashes("person-6");
 
         // Owner hash (current user) + granted hash = 2 entries
         Assert.AreEqual(2, lstHashes.Count);
@@ -165,17 +164,17 @@ public void GrantAccess_ShouldStoreHashAndBeVerifiable()
         {
             Assert.AreEqual(64, sHash.Length);
             Assert.IsTrue(sHash.All(c => (c >= '0' && c <= '9') || (c >= 'a' && c <= 'f')),
-                "Every stored hash must be a lowercase hex string, not a raw SID.");
+                "Every stored hash must be a lowercase hex string, not a raw principal identifier.");
         }
 
-        // Raw SID must not appear in the list
-        Assert.IsFalse(lstHashes.Contains(sFakeSid, StringComparer.OrdinalIgnoreCase),
-            "The raw Windows SID must never be stored.");
+        // Raw principal identifier must not appear in the list
+        Assert.IsFalse(lstHashes.Contains(sFakePrincipalId, StringComparer.OrdinalIgnoreCase),
+            "The raw principal identifier must never be stored.");
 
-        // Plain SHA-256(SID) must not appear — proves the pepper (HMAC) is in use
-        string sPlainSha256 = Convert.ToHexString(SHA256.HashData(Encoding.UTF8.GetBytes(sFakeSid))).ToLowerInvariant();
+        // Plain SHA-256(principalId) must not appear — proves the pepper (HMAC) is in use
+        string sPlainSha256 = Convert.ToHexString(SHA256.HashData(Encoding.UTF8.GetBytes(sFakePrincipalId))).ToLowerInvariant();
         Assert.IsFalse(lstHashes.Contains(sPlainSha256, StringComparer.OrdinalIgnoreCase),
-            "The stored hash must be HMAC-SHA256(SID, pepper), not plain SHA-256(SID).");
+            "The stored hash must be HMAC-SHA256(principalId, pepper), not plain SHA-256(principalId).");
     }
 
     [TestMethod]
@@ -205,12 +204,18 @@ public TestStoreScope()
             {
                 RootDirectory = sRootDirectory,
             };
-            BackupService = new MasterKeyBackupService(Options);
-            Store = new PersonSecureStore(BackupService, Options);
+            LocalKeyProtector = new PassThroughLocalKeyProtector();
+            PrincipalProvider = new FixedPrincipalProvider();
+            BackupService = new MasterKeyBackupService(Options, LocalKeyProtector);
+            Store = new PersonSecureStore(BackupService, Options, PrincipalProvider);
         }
 
         public GenSecureStoreOptions Options { get; }
 
+        public PassThroughLocalKeyProtector LocalKeyProtector { get; }
+
+        public FixedPrincipalProvider PrincipalProvider { get; }
+
         public MasterKeyBackupService BackupService { get; }
 
         public PersonSecureStore Store { get; }
@@ -245,6 +250,28 @@ public void Dispose()
 
     }
 
+    private sealed class PassThroughLocalKeyProtector : ILocalKeyProtector
+    {
+        public byte[] Protect(byte[] arrPlaintext)
+        {
+            ArgumentNullException.ThrowIfNull(arrPlaintext);
+            return arrPlaintext.ToArray();
+        }
+
+        public byte[] Unprotect(byte[] arrProtectedData)
+        {
+            ArgumentNullException.ThrowIfNull(arrProtectedData);
+            return arrProtectedData.ToArray();
+        }
+    }
+
+    private sealed class FixedPrincipalProvider : ICurrentPrincipalProvider
+    {
+        public string CurrentPrincipalId { get; } = "user:test-user";
+
+        public string GetCurrentPrincipalId() => CurrentPrincipalId;
+    }
+
     private static string[] GetRelativeSegments(string sRootPath, string sFilePath)
     {
         string sRelativePath = Path.GetRelativePath(sRootPath, sFilePath);

GenFreeWin/GenSecure.Core/CryptoUtilities.cs

@@ -80,36 +80,36 @@ public static string GetShardedFilePath(string sRootDirectory, string sLogicalId
     }
 
     /// <summary>
-    /// Derives the SID pepper key from the master key using HKDF-SHA256.
-    /// The pepper ensures that SID hashes cannot be brute-forced via SID enumeration,
-    /// even when the SID domain and RID range are known to an attacker.
+    /// Derives the principal pepper key from the master key using HKDF-SHA256.
+    /// The pepper ensures that principal hashes cannot be brute-forced via principal enumeration,
+    /// even when the principal identifier namespace is predictable to an attacker.
     /// </summary>
     /// <param name="arrMasterKey">The 32-byte AES master key.</param>
-    /// <returns>A 32-byte SID pepper key.</returns>
-    public static byte[] DeriveSidPepperKey(byte[] arrMasterKey)
+    /// <returns>A 32-byte principal pepper key.</returns>
+    public static byte[] DerivePrincipalPepperKey(byte[] arrMasterKey)
     {
         ArgumentNullException.ThrowIfNull(arrMasterKey);
 
         return HKDF.DeriveKey(
             HashAlgorithmName.SHA256,
             arrMasterKey,
             outputLength: 32,
-            info: Encoding.UTF8.GetBytes("GenSecure-SID-Pepper"));
+            info: Encoding.UTF8.GetBytes("GenSecure-Principal-Pepper"));
     }
 
     /// <summary>
-    /// Computes an HMAC-SHA256 of a Windows SID keyed with the pepper derived from the master key.
-    /// Raw SIDs are never written to disk; only their keyed hashes are persisted.
+    /// Computes an HMAC-SHA256 of a principal identifier keyed with the pepper derived from the master key.
+    /// Raw principal identifiers are never written to disk; only their keyed hashes are persisted.
     /// </summary>
-    /// <param name="sSid">The Windows SID string (e.g. <c>S-1-5-21-…</c>).</param>
-    /// <param name="arrSidPepperKey">The 32-byte pepper key obtained from <see cref="DeriveSidPepperKey"/>.</param>
+    /// <param name="sPrincipalId">The principal identifier.</param>
+    /// <param name="arrPrincipalPepperKey">The 32-byte pepper key obtained from <see cref="DerivePrincipalPepperKey"/>.</param>
     /// <returns>Lowercase hex-encoded HMAC-SHA256 digest.</returns>
-    public static string ToSidHash(string sSid, byte[] arrSidPepperKey)
+    public static string ToPrincipalHash(string sPrincipalId, byte[] arrPrincipalPepperKey)
     {
-        ArgumentException.ThrowIfNullOrWhiteSpace(sSid);
-        ArgumentNullException.ThrowIfNull(arrSidPepperKey);
+        ArgumentException.ThrowIfNullOrWhiteSpace(sPrincipalId);
+        ArgumentNullException.ThrowIfNull(arrPrincipalPepperKey);
 
-        byte[] arrHash = HMACSHA256.HashData(arrSidPepperKey, Encoding.UTF8.GetBytes(sSid));
+        byte[] arrHash = HMACSHA256.HashData(arrPrincipalPepperKey, Encoding.UTF8.GetBytes(sPrincipalId));
         return Convert.ToHexString(arrHash).ToLowerInvariant();
     }
 

GenFreeWin/GenSecure.Core/DependencyInjectionExtensions.cs

@@ -1,6 +1,7 @@
 using System;
 using GenSecure.Contracts;
 using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.DependencyInjection.Extensions;
 
 namespace GenSecure.Core;
 
@@ -24,6 +25,8 @@ public static IServiceCollection AddGenSecureStore(this IServiceCollection servi
         configureOptions(options);
 
         services.AddSingleton(options);
+        services.TryAddSingleton<ILocalKeyProtector>(provider => PlatformServiceResolver.CreateLocalKeyProtector(provider.GetRequiredService<GenSecureStoreOptions>()));
+        services.TryAddSingleton<ICurrentPrincipalProvider>(static _ => PlatformServiceResolver.CreateCurrentPrincipalProvider());
         services.AddSingleton<MasterKeyBackupService>();
         services.AddSingleton<IMasterKeyBackupService>(provider => provider.GetRequiredService<MasterKeyBackupService>());
         services.AddSingleton<IPersonSecureStore, PersonSecureStore>();

GenFreeWin/GenSecure.Core/FileModels.cs

@@ -1,6 +1,7 @@
 using System;
 using System.Collections.Generic;
 using System.Text.Json;
+using System.Text.Json.Serialization;
 
 namespace GenSecure.Core;
 
@@ -31,9 +32,11 @@ internal sealed class PersonKeyRecord
 
     public required string Tag { get; init; }
 
-    public required string OwnerWindowsSidHash { get; init; }
+    [JsonPropertyName("OwnerWindowsSidHash")]
+    public required string OwnerPrincipalHash { get; init; }
 
-    public required List<string> AllowedWindowsSidHashes { get; init; }
+    [JsonPropertyName("AllowedWindowsSidHashes")]
+    public required List<string> AllowedPrincipalHashes { get; init; }
 
     public DateTimeOffset CreatedUtc { get; init; }