PSCertPatterns

Production cryptographic patterns in PowerShell 7

Overview

PSCertPatterns provides production-grade cryptographic implementations for PowerShell 7, covering AES-GCM symmetric encryption, RSA and ECDSA asymmetric operations, key rotation strategies, algorithm agility patterns, and comprehensive certificate chain validation.

Prerequisites

• PowerShell 7.4+
• .NET 8
• Pester 5.x

Installation

Import-Module ./PSCertPatterns.psm1

Usage

using module ./PSCertPatterns.psm1
# AES-GCM encrypt / decrypt$key= [byte[]]::new(32)
$aesGcm= [AesGcmService]::new($key)
$encrypted=$aesGcm.Encrypt([System.Text.Encoding]::UTF8.GetBytes("Hello, world!"))
$decrypted=$aesGcm.Decrypt($encrypted)
$aesGcm.Dispose()
# PBKDF2 key derivation$salt= [SaltGenerator]::Generate(32)
$derivedKey= [Pbkdf2KeyDerivation]::DeriveKey("password",$salt,32)
# AES-CBC + HMAC Encrypt-then-MAC$encKey= [byte[]]::new(32)
$macKey= [byte[]]::new(32)
$aesCbc= [AesCbcService]::new($encKey,$macKey)
$package=$aesCbc.Encrypt([System.Text.Encoding]::UTF8.GetBytes("Hello, world!"))
$decrypted=$aesCbc.Decrypt($package)
$aesCbc.Dispose()
# RSA encrypt / decrypt (OAEP SHA-256)$rsaEnc= [RsaEncryptionService]::new(2048)
$encrypted=$rsaEnc.Encrypt([System.Text.Encoding]::UTF8.GetBytes("Hello, world!"))
$decrypted=$rsaEnc.Decrypt($encrypted)
$rsaEnc.Dispose()
# RSA sign / verify (PSS SHA-256)$rsaSign= [RsaSigningService]::new(2048)
$data= [System.Text.Encoding]::UTF8.GetBytes("message to sign")
$signature=$rsaSign.Sign($data)
$valid=$rsaSign.Verify($data,$signature)
$rsaSign.Dispose()

Test Suite

Invoke-Pester-Path './tests/*.Tests.ps1'-Output Detailed

254 Pester tests covering all completed slices.

Slice	File	Classes	Tests
1	src/01_AesGcm.ps1	AesGcmService	15
2	src/02_KeyDerivation.ps1	Pbkdf2KeyDerivation, SaltGenerator	14
3	src/03_NonceManagement.ps1	RandomNonceGenerator, CounterNonceGenerator	17
4	src/04_HmacCbc.ps1	AesCbcService, HmacService	27
5	src/05_Rsa.ps1	RsaEncryptionService, RsaSigningService	30
6	src/06_Ecdsa.ps1	EcdsaSigningService	20
7	src/07_CertChain.ps1	CertificateValidator, InMemoryPki	18
8	src/08_KeyRotation.ps1	RotatingKeyManager, EncryptedPackage	21
9	src/09_AlgorithmAgility.ps1	CipherProfile, AlgorithmRegistry	22
10	src/10_ReplayProtection.ps1	NonceReplayGuard	20
A	tests/00_Adversarial.Tests.ps1	(boundary/adversarial)	50

Adversary Tool (Experimental)

The adversary/ folder contains an experimental adversarial battery engine for validating cryptographic pattern implementations against documented behavioral thresholds. It is scoped to PSCertPatterns and is not a general-purpose security testing framework.

See adversary/README.md for full documentation, supported contracts, usage, and the disclaimer you should read before running it.

# Quick start. ./adversary/Invoke-AdversaryBattery.ps1$key= [byte[]]::new(32)
[System.Security.Cryptography.RandomNumberGenerator]::Fill($key)
$svc= [AesGcmService]::new($key)
Invoke-AdversaryBattery-Target $svc-Contract EncryptDecrypt

License

MIT License — see LICENSE for details.

---

██████╗██╗ ██╗ ██████╗ ██╗ ██╗██╗███╗ ██╗
██╔════╝╚██╗ ██╔╝██╔════╝ ██║ ██║██║████╗ ██║
██║ ╚████╔╝ ██║ ███╗██║ ██║██║██╔██╗ ██║
██║ ╚██╔╝ ██║ ██║██║ ██║██║██║╚██╗██║
╚██████╗ ██║ ╚██████╔╝╚██████╔╝██║██║ ╚████║
╚═════╝ ╚═╝ ╚═════╝ ╚═════╝ ╚═╝╚═╝ ╚═══╝
drop-in tools for developers · cyguin.com