In Brief

• The native CryptoAPI is a brittle programming interface that is capable of most common cryptography related functions. Users of the .NET Compact Framework must target the CryptoAPI to perform cryptography in their applications.

• Due to the brittleness and large number of pitfalls associated with targeting the CryptoAPI class directory from managed code, we provide a simpler-to-use wrapper class called ManagedCryptoAPI .

• ManagedCryptoAPI uses central concepts related to CryptoAPI. Specifically, developers must understand the notion of a handle and a CryptoAPI context.

• CryptoAPI is extensible. Developers can plug in their own "provider" to perform cryptography inside CryptoAPI. Because of its ubiquitous availability, the ManagedCryptoAPI uses the PROV_RSA_FULL provider.

• ManagedCryptoAPI can aquire a CryptoAPI context by calling either ManagedCryptoAPI.AcquireDefaultContext or ManagedCryptoAPI.AcquireNamedContext .

• There are many pitfalls to avoid when acquiring or creating a context.

• The ManagedCryptoAPI.ManagedComputeHash method computes a hash on data.

• The ManagedCryptoAPI.PasswordEncrypt method encrypts data based on a password.

• The ManagedCryptoAPI.PasswordDecrypt method decrypts data based on a password.

• The ManagedCryptoAPI class lets developers share a session key for encrypting and decrypting data on two or more devices.

• ManagedCryptoAPI.GenerateSessionKey creates a session key and returns a handle to it.

• ManagedCryptoAPI.LocalSaveSessionKey exports a session key into a byte array in such a way that only the device that created the byte array can use it again.

• ManagedCryptoAPI.LoadPrivateSessionKey loads the bytes of a previously saved session key. It can only load bytes of a session key created earlier on the same device. It returns a handle to an encryption key with which you can encrypt or decrypt data.

• ManagedCryptoAPI.ExportPublicKey exports a public key as a byte array. The public key can be used by other devices to encrypt a session key, which the original device can also use.

• ManagedCryptoAPI.ImportPublicKey can be used by a device to import the public key of a remote device. Then the device can call ManagedCryptoAPI.ExportSessionKey to export a session key as a set of bytes that the remote device can use. The bytes are encrypted so that only the remote device is capable of deciphering them. Thus, the bytes can be safely transmitted over an insecure network.

• A device can load a session key that a remote device wants to share by passing the session key bytes into ManagedCryptoAPI.LoadSharedSessionKey . The session key bytes must be encrypted with the local device's public key.

• ManagedCryptoAPI.KeyEncrypt encrypts data using a handle to a session key that is passed into it. The session key can be derived in a variety of ways, such as by the same device or imported from another device.

• ManagedCryptoAPI.KeyDecrypt decrypts data using a handle to a session key that is passed into it. It is the complementary method of KeyEncrypt .