Net 7 on Strathweb. A free flowing tech monologue.

Post-quantum token signing with Dilithium using Duende Identity Server

Fri, 24 Mar 2023 11:06:14 +0000

On March 12th, a new IETF draft JOSE and COSE Encoding for Dilithium was published. It describes JSON serializations for CRYSTALS-Dilithium, a post-quantum cryptography suite. This in turn allows using post-quantum cryptography for tasks like signing JSON Web Tokens in a standardized fashion.

I previously blogged about using CRYSTALS-Dilithium from .NET applications, so in this post let’s see how we can apply this new draft to one of the most popular .NET OpenID Connect / OAuth 2.0 servers, Duende Identity Server

Beware of the default ASP.NET Core Identity settings

Thu, 02 Mar 2023 11:06:14 +0000

The other day I was involved in setting up a new project based on ASP.NET Core Identity, when I noticed something related to the default configuration that I thought would be worth sharing here.

Of course, while in general it is not great to rely on default settings of any product (especially when it is the security backbone of your application!) one also expects sensible defaults to be provided.

Let’s have a look.

Post quantum cryptography in .NET

Tue, 21 Feb 2023 11:06:14 +0000

I have written extensively about quantum computing on this blog before. Quantum computing has the potential to break many of the cryptographic systems that we use today. Shor’s algorithm, for example, can efficiently factor large numbers, which would make widely-used asymmetric cryptography schemes such as RSA and elliptic curves insecure.

In this post, we’ll explore how to use post-quantum cryptography from a C# program, using CRYSTALS-Kyber and CRYSTALS-Dilithium as examples.

dotnet WASI applications in the cloud

Thu, 22 Dec 2022 11:06:14 +0000

Some time ago I blogged about using the experimental dotnet WASI SDK on ARM Macs. Today we are going to explore building dotnet based WASI-WASM applications with that SDK, with the goal of deploying them to the cloud.

dotnet-script 1.4 is out with .NET 7.0 support

Wed, 30 Nov 2022 16:19:56 +0000

This week we released version 1.4 of dotnet-script. The latest release introduces support for .NET 7.0 and C# 11 and is available, as usually, through Github releases and on Nuget. You will need to have at least the .NET SDK 7.0.100 installed.

Problem Details responses everywhere with ASP.NET Core and .NET 7

Sun, 28 Aug 2022 08:18:21 +0000

The Problem Details for HTTP APIs RFC provides a unified, machine-readable and standardized recipe for exposing error information out of your HTTP APIs - which is of course beneficial both for the API authors, as well as the integrating parties.

ASP.NET Core has supported problem details since version 2.1, however it was not been uniformly used across all ASP.NET Core components. It was possible to return the Problem Details response manually, or the framework could generate it automatically in several specific cases. Even the official documentation referred to a third-party middleware in order to get a better Problem Details experience.

This is finally changing in .NET 7.

Running .NET 7 apps on WASI on arm64 Mac

Wed, 30 Mar 2022 20:05:01 +0000

WASI stands for WebAssembly System Interface, and allows to run WebAssembly code independently of the browsers, as it provides access to operating system features such as file system access or networking. It is highly experimental, but at the same time a tremendously interesting project, and one that has the potential of contributing to a massive paradigm-shift in the industry, making WebAssembly truly ubiquitous.

The great mad scientist of web things at Microsoft, Steve Sanderson, recently published the first version of an experiemental WASI SDK for .NET, which allows building .NET 7 and ASP.NET Core applications into standalone WASI compliant apps, and running them from WASI hosts. Steve’s repo provides the easy to follow steps to get going on Windows and Linux, in this post I will walk through some additional hoops that one may need to jump on arm64 Macs.