adamcaudill/libsodium-net — pull request #70 by adamcaudill (2014-09-14 08:25:46+00:00)
Title: Protect KeyPair.PrivateKey

This makes a few important changes[0] to the `KeyPair` class.

* Properties are now read-only.
* The private key length must be a multiple of 16 bytes (so far, it's 32 or 64).
* Use DPAPI to encrypt the private key while in memory[1].

It turns out there are cases where `KeyPair` may exist in memory for extended period of times. If there was to be an application crash (or some other events), the private key could be written to disk in the clear. This encrypts the `PrivateKey` using DPAPI, so if it's written to disk, it won't be useful.

`[0]` - This is a breaking change, so applications that use `KeyPair` may need to be updated.

`[1]` - This protects as much as possible, but there are still times when it has to be in the clear. So this doesn't eliminate the risk, but it should reduce it quite a bit.