Target frameworks
The library offers the same algorithms and data formats on every target. This page lists which assembly is built for which target, and where the path to a feature differs because .NET Framework doesn't have a type yet.
Assemblies and targets
| Assembly | Targets | Contents |
|---|---|---|
WKL.System.Security.Cryptography.Core | .NET Framework 4.6.2, .NET Core 3.1, .NET 8, .NET 9 | PostQuantumConfig, CryptoMode, the policy, and the provider interface |
WKL.System.Security.Cryptography.Extensions | .NET Framework 4.6.2 and 4.7.2, .NET Core 3.1, .NET 8 | the extension methods and the OpenSSL provider |
WKL.System.Security.Cryptography.WASM | .NET 9 | the Blazor WebAssembly provider, with OpenSSL as a WebAssembly module |
An app that targets .NET Framework 4.8 uses the 4.7.2 build, and an app that targets .NET 9 or later uses the .NET 8 build.
Differences on .NET Framework
| Area | .NET Framework | Reason |
|---|---|---|
| Issuing certificates | X509CertificateBuilder on every version; the CertificateRequest extensions on 4.7.2 and later | CertificateRequest exists only starting with .NET Framework 4.7.2 |
CopyWithPrivateKey with CryptoMode | 4.7.2 and later | the .NET method exists only starting with 4.7.2 |
| Self-signed certificate on 4.6.2 | The library associates the RSA or ECDSA key through an in-memory PFX file. A key that can't be exported in plaintext stays unassociated. | 4.6.2 can't associate a key with a certificate directly |
| Chain validation with your own trust anchors | The anchors go into ExtraStore. The chain is valid only if it ends in one of the anchors, and ChainStatus then also reports UntrustedRoot. | X509ChainPolicy.CustomTrustStore doesn't exist |
| Issuing CRLs | X509CrlBuilder; the CertificateRevocationListBuilder overloads only on .NET 8 | CertificateRevocationListBuilder exists only starting with .NET 7 |
PFX with PbeParameters | The library provides PbeParameters and PbeEncryptionAlgorithm in the System.Security.Cryptography namespace | .NET Framework doesn't have these types |
| ECDSA and ECDH on 4.6.2 | with keys of type ECDsaCng and ECDiffieHellmanCng | ECParameters exists only starting with .NET Framework 4.7 |
| Composite ML-KEM | pairs with RSA work as on .NET 8; pairs with ECDH throw PlatformNotSupportedException | the combiner needs the raw ECDH secret, which .NET exposes only starting with .NET 8 |
| Loading OpenSSL | The library loads libcrypto by its full path from PostQuantumConfig.OpenSslPath | .NET Framework can't resolve library names at run time |
Everything else behaves on .NET Framework the same way it does on .NET 8: hybrid and pure ML-DSA
certificates, chains, signatures, CMS and XML signatures, KemEnvelopedCms, PFX files, key storage, and
the policy.
Differences by operating system
| Area | Windows | Linux | macOS |
|---|---|---|---|
| .NET Framework | yes | – | – |
| Key files next to the certificate store | DPAPI | with Secret Service | not available |
| Chain with a pure ML-DSA issuer | yes | if .NET also loads OpenSSL 3.5 or later | not stated |
| PFX import of a certificate whose main key is ML-DSA or ML-KEM | yes | not with .NET 8 | not stated |
Not stated means that there are no guarantees for this combination. For details on Linux, see Configure OpenSSL and Transfer certificates with PQ keys as PFX files.
Limitations
- .NET Framework on Windows only. Mono and other runtimes for .NET Framework aren't supported.
- .NET Core 3.1 is out of support at Microsoft. The library still builds for it so that existing apps can adopt PQ algorithms.
Related topics
en/wiki/pqcrypt/lib/reference/target-frameworks.txt · Last modified: by Wolfgang van der Stille