AES

Libraries/Esiur/Protocol/EpConnectionContext.cs

@@ -3,6 +3,7 @@ using Esiur.Data;
 using Esiur.Net.Packets;
 using Esiur.Resource;
 using Esiur.Security.Authority;
+using Esiur.Security.Cryptography;
 using Esiur.Security.Membership;
 using Esiur.Security.Permissions;
 using System;
@@ -40,6 +41,16 @@ public class EpConnectionContext : IResourceContext
     public string Identity { get; set; }
     public string AuthenticationProtocol { get; set; } = "hash";
 
+    /// <summary>
+    /// Controls whether the authenticated session key must protect EP traffic.
+    /// </summary>
+    public EncryptionMode EncryptionMode { get; set; } = EncryptionMode.None;
+
+    /// <summary>
+    /// Encryption provider protocol names offered to the responder, in preference order.
+    /// </summary>
+    public string[] EncryptionProviders { get; set; } = new[] { "aes-gcm" };
+
     public bool AutoReconnect { get; set; } = false;
 
     public uint ReconnectInterval { get; set; } = 5;

Libraries/Esiur/Protocol/EpServer.cs

@@ -59,6 +59,17 @@ public class EpServer : NetworkServer<EpConnection>, IResource
     //[Attribute]
     public string[] AllowedAuthenticationProviders { get; set; }
 
+    /// <summary>
+    /// Encryption provider protocol names that incoming connections may negotiate.
+    /// Providers must also be registered with the server Warehouse.
+    /// </summary>
+    public string[] AllowedEncryptionProviders { get; set; } = Array.Empty<string>();
+
+    /// <summary>
+    /// Rejects incoming sessions that do not request authenticated encryption.
+    /// </summary>
+    public bool RequireEncryption { get; set; }
+
     //[Attribute]
     public bool AllowUnauthorizedAccess { get; set; }