Serilog.Sinks.File.Encrypt

A Serilog.File.Sink hook that encrypts log files using RSA and AES-GCM hybrid encryption. This package provides secure logging by encrypting log data before writing to disk, ensuring sensitive information remains protected.

📦 Packages

Package	NuGet	Description
Serilog.Sinks.File.Encrypt		File sink hook — encrypts log entries as they are written
Serilog.Sinks.File.Decrypt		Library for programmatic decryption of encrypted log files
Serilog.Sinks.File.Encrypt.Cli		CLI tool for key generation and ad-hoc log decryption
Serilog.Sinks.File.Encrypt.Core		Shared cryptographic primitives — transitive dependency, no direct reference needed

📌 Versioning

All packages in this repository are released in lockstep — every package is versioned and published together on every release, even when a change only affects one of them.

Package	Always versioned together
Serilog.Sinks.File.Encrypt	✅
Serilog.Sinks.File.Decrypt	✅
Serilog.Sinks.File.Encrypt.Cli	✅
Serilog.Sinks.File.Encrypt.Core	✅

Always use the same version across all packages. For example, if you install Serilog.Sinks.File.Encrypt v5.1.0, install Serilog.Sinks.File.Decrypt v5.1.0 as well. Mixing versions is not supported and may produce unexpected behaviour.

✨ Features

• Transparent encryption of log files using hybrid RSA + AES-GCM cryptography
• Tamper-evident v2 format (v6.0.0+) — frame ordering and session identity are bound into the AES-GCM authenticated data, and cleanly closed logs end with an authenticated seal, making truncation, reordering, and splicing detectable; per-session SealStatus is reported on decryption
• Key rotation — assign a key ID to each EncryptHooks instance; the decryption layer selects the correct key automatically
• CLI utilities for key generation, decryption (including --require-sealed verification), and batch processing of encrypted logs
• Memory-optimized streaming for large log files
• Programmatic decryption via Serilog.Sinks.File.Decrypt — supports custom key providers for Azure Key Vault, AWS KMS, etc.
• Backward compatible reading — v6.x decrypts v1-format files written by v3.x–v5.x (v5.x and earlier cannot read v6 files)

📖 Documentation

Detailed installation, configuration, and usage instructions are provided in the package-specific README files:

• 📄 Serilog.Sinks.File.Encrypt — encrypting log files with Serilog
• 📄 Serilog.Sinks.File.Decrypt — programmatic decryption API
• 📄 Serilog.Sinks.File.Encrypt.Cli — CLI key generation and decryption tool
• 📄 Serilog.Sinks.File.Encrypt.Core — shared primitives (transitive dependency)
• 📊 Performance Benchmarks & Analysis
• 📋 Changelog & Migration Guide

Please refer to these files for up-to-date and comprehensive documentation for each package.

🎯 .NET Support Policy

This library targets .NET Long-Term Support (LTS) releases only. Current targets: net8.0 and net10.0.

• A new LTS TFM is added when Microsoft ships it (approximately every 2 years).
• The oldest LTS TFM is dropped when Microsoft ends support for it.
• Users on STS or end-of-life runtimes can pin an older package version — .NET's runtime forward-compatibility means a net8.0 or net10.0 package will run on any higher runtime version.

🤝 Build & Contributing

Contributions are welcome! Please see CONTRIBUTING.md for guidelines on how to build, test, and contribute to the project.

📝 License

This project is licensed under the terms of the MIT License.

🔐 Support & Security

For security issues, please see SECURITY.md.

For questions or support, please open an issue on GitHub.