I'm looking into upgrading a .NET software application that encrypts files. At the moment it is doing that by using a fixed key and a specific algorithm in the codebase. Moving the key to a safer place will be my first step.
However, I want to improve the system. Having key rollover and additional algorithms seems like a given these days. Of course I don't want to write that myself. If it was an ASP.NET web app, I would be using its dataprotection library. However, when looking in the documentation you find this:
The ASP.NET Core data protection APIs are not primarily intended for indefinite persistence of confidential payloads. Other technologies like Windows CNG DPAPI and Azure Rights Management are more suited to the scenario of indefinite storage, and they have correspondingly strong key management capabilities. That said, there's nothing prohibiting a developer from using the ASP.NET Core data protection APIs for long-term protection of confidential data.
Which leaves me a bit concerned. Should I use it even with this warning for encrypting files? Are there other frameworks/libraries that offer the same functionality? Should I look into something totally different?