Search code examples
c#linuxwindows.net-corecredentials

How to securely store and retrieve sensitive data in a .NET Standard 2.0 cross-platform (Windows+Linux) library


I have .NET Framework 4.7.2 library to store and retrieve sensitive data (like tokens for our desktop apps communication) with help of CredentialManagement package on Windows. Now I need to make this library work both on Windows and Linux. I've retargeted it to .NET Standard 2.0 (to be able to consume it from both .NET Framework and .NET Core desktop apps) and used KdSoft.CredentialManagement package (since CredentialManagement.Standard package was unlisted from nuget.org). I determine operating system with RuntimeInformation.IsOSPlatform:

if (RuntimeInformation.IsOSPlatform(OSPlatform.Windows))
{
    //Use CredentialManager
}
else if (RuntimeInformation.IsOSPlatform(OSPlatform.Linux))
{
    //What to use here?
}
else if (RuntimeInformation.IsOSPlatform(OSPlatform.OSX))
{
    throw new NotImplementedException();
}

But I have no idea what library to use on Linux to achieve the same goal. What is the most common approach on that OS?

P. S. My library doesn't use any database. And I saw similar questions #1 and #2: they are about Windows-only approach and answers there (Data Protection API for Windows - ProtectData class) doesn`t support Windows Home and on non-NTFS.


Solution

  • I ended up with Devlooped.CredentialManager nuget (.Net Standard 2.0, MIT license) - a .NS20 port of a cross platform Git Credential Manager. It supports several credential stores - I use GPG/pass compatible files.

    Another option could be Simple.CredentialsManager nuget (.Net Standard 2.1, Apache-2.0 license) but version at nuget.org is extremely outdated. It also has a pull request returning .Net Standard 2.0 target and another one with handy readme.md update but both are still not merged.