---
title: "onecrypto cookbook"
url: https://recursiveai.org/onecrypto/cookbook/
description: "Answers to common cryptography tasks in C#: sign and verify with Ed25519, X25519 key exchange, Argon2 password hashing, PEM, PKCS#12 and SSH keys, and CMS…"
version: "0.1.0-preview.1"
---

# onecrypto cookbook

Answers to common cryptography tasks in C#: sign and verify with Ed25519, X25519 key exchange, Argon2 password hashing, PEM, PKCS#12 and SSH keys, and CMS signing and encryption. Each recipe is a complete program with the output it really prints on OneCrypto 0.1.0-preview.1, checked against OpenSSL or ssh-keygen. OneCrypto has not been independently audited.

## Signatures and key exchange

- [Sign and verify with Ed25519 in C#](https://recursiveai.org/onecrypto/cookbook/ed25519-sign-verify/index.md): Sign and verify with Ed25519 in C# on .NET 10, which has no Ed25519 of its own: generate a key, sign, verify, save the keys as PEM, and check the signature with OpenSSL. Runnable code with OneCrypto 0.1.0-preview.1.
- [X25519 key exchange in C#](https://recursiveai.org/onecrypto/cookbook/x25519-key-exchange/index.md): X25519 key exchange in C# on .NET 10, which has no Curve25519 of its own: agree on a shared secret with a peer’s public key, turn it into an AES key with HKDF, and check the secret against OpenSSL. Runnable code with OneCrypto 0.1.0-preview.1.

## Passwords and key derivation

- [Hash passwords with Argon2 in C#](https://recursiveai.org/onecrypto/cookbook/argon2-password-hashing/index.md): Hash and verify passwords with Argon2id in C# on .NET 10: a random salt, the OWASP minimum parameters, a standard $argon2id$ string to store, and verification. Checked against OpenSSL. Runnable code with OneCrypto 0.1.0-preview.1.

## Keys and certificate files

- [Load a PEM or PKCS#8 private key in C#](https://recursiveai.org/onecrypto/cookbook/load-pem-private-key/index.md): Load a PEM private key in C#: encrypted PKCS#8, traditional RSA and EC PEM with DEK-Info, and Ed25519 keys made by OpenSSL, in one call that detects the format, then sign with the key. Runnable code with OneCrypto 0.1.0-preview.1.
- [Convert PEM to PFX (PKCS#12) in C#](https://recursiveai.org/onecrypto/cookbook/convert-pem-to-pfx/index.md): Convert a PEM certificate and private key to a PKCS#12 .pfx file in C#, with AES-256 and PBKDF2 protection, then open it with .NET and OpenSSL. Runnable code with OneCrypto 0.1.0-preview.1.
- [Generate an SSH key in C#](https://recursiveai.org/onecrypto/cookbook/generate-ssh-key/index.md): Generate an SSH key pair in C#: an Ed25519 OpenSSH private key protected with a passphrase and the matching .pub line for authorized_keys, read back by ssh-keygen. Runnable code with OneCrypto 0.1.0-preview.1.

## Signed and encrypted messages

- [Sign a file with CMS (PKCS#7) in C#](https://recursiveai.org/onecrypto/cookbook/sign-file-cms/index.md): Sign a file with CMS (PKCS#7, .p7s) in C# and verify the signature: a detached signature with an ECDSA certificate, a per-rule verification report, and the same file checked by openssl cms. Runnable code with OneCrypto 0.1.0-preview.1.
- [Encrypt and decrypt with CMS in C#](https://recursiveai.org/onecrypto/cookbook/encrypt-file-cms/index.md): Encrypt and decrypt a file with CMS in C# (the S/MIME and .p7m format) for a recipient’s certificate, using AES-256-GCM and RSA-OAEP, and exchange encrypted files with openssl cms both ways. Runnable code with OneCrypto 0.1.0-preview.1.