Windows SDK (DLL)

The Crypt-in Windows SDK is a DLL that lets you integrate dongle-based file encryption into any Windows application.

Licence: Apache-2.0  |  Status: free and open source

Apache 2.0, not GPL: you can ship this DLL inside a closed-source commercial product, and the patent grant covers you for the HID protocol and the .crin format it implements. See Licence for the full split.

The SDK itself costs nothing. The €150 + €100/year plan on the pricing page buys direct support and an SLA, not the code — see SDK Developer Support.

On Linux and macOS the equivalent is the Linux CLI, same Apache-2.0 licence — but it has not shipped: it was not in the beta package, and no date has been announced. See Python tools.

Source: github.com/jaffa2970/cryptin-sdk-beta, src/CryptinSDK/ — Apache-2.0, with its own LICENSE and NOTICE. Published as a beta on 17 October 2026: no support, no issues and no pull requests. The beta package is a separate release and ships binaries only.

What you can do

• Encrypt and decrypt .crin files from your application
• Verify dongle presence and PIN authentication
• Read the K_identity and K_attestation public keys
• Sign a challenge with the dongle for proof-of-possession

What stays closed

The DLL talks to the dongle over the HID protocol. The firmware running on the dongle is closed source: you integrate with the protocol, not with the firmware. That is enough — the protocol and the .crin format are published in full.

Installation

NuGet, at launch:

dotnet add package CryptinSDK

⚠️ Not available during the beta. There is no NuGet package: the command above documents the intended package name, it does not work today. The source is published, so you can build the DLL yourself — dotnet build CryptinSDK.sln -c Release in cryptin-sdk-beta — and reference the assembly directly.

Quick start — C#

using CryptinSDK;

var dongle = new CryptinDongle();
dongle.Connect();                       // finds VID 0x303A, PID 0x8123

var result = dongle.VerifyPin("123456");
if (result != PinResult.Ok)
{
    Console.WriteLine("Wrong PIN, or dongle blocked");
    return;
}

dongle.EncryptFile("document.pdf", "document.crin");
dongle.DecryptFile("document.crin", "document.pdf");

dongle.Disconnect();

Calling it from C++

Correction, 2026-08-06

An earlier version of this page carried a C++ quick start. The SDK is a .NET class library and there is no C ABI layer, so a native C++ program cannot consume it directly — the header that example included does not exist.

From native C++ the routes are the ordinary .NET interop ones, and none of them ships with the SDK today: C++/CLI, a COM callable wrapper, or a NativeAOT export surface. Until one exists, the supported paths on Windows are C# and, for anything else, the HID protocol directly — it is published in full precisely so that a client can be written in any language without asking lake8.dev for anything.

API reference

CryptinDongle

Method	Returns	Description
Connect()	bool	Find and connect to the dongle
Disconnect()	void	Release the connection
VerifyPin(pin)	PinResult	Authenticate. Required before anything else
GetIdentityPubKey()	byte[32]	K_identity public key
GetAttestationPubKey()	byte[32]	K_attestation public key
Challenge(nonce)	byte[64]	Ed25519 signature over your nonce
GetFileSecret()	byte[32]	Deprecated — the underlying CMD_GET_SECRET (0x04) answers ERR_DEPRECATED on production firmware
EncryptFile(src, dst)	void	Encrypt to .crin
DecryptFile(src, dst)	void	Decrypt from .crin

Every method except Connect requires a successful VerifyPin first: the dongle answers ERR_PIN_REQUIRED otherwise. Generate the Challenge nonce from a cryptographically secure RNG and use it once — the dongle does not track freshness.

There is no DeriveSessionKey. Command 0x05 is reserved and not implemented in current firmware.

Per-file keys are not derived on the host. Since firmware 2026-08-02 EncryptFile and DecryptFile stream the data through the dongle (CMD_ENCRYPT_BLOCK / CMD_DECRYPT_BLOCK), which derives the key from file_secret and the per-file salt and runs AES-256-GCM itself: the key never crosses the USB bus. GetFileSecret() is a leftover of the previous model and its opcode is deprecated. See the PIN gate and the key hierarchy.

PinResult

Value	Meaning
Ok	PIN correct, dongle unlocked for this insertion
Wrong	Wrong PIN, attempt counted
Blocked	Three wrong attempts — only BIP-39 recovery unblocks
Required	PIN not verified yet

Contributing

The SDK is licensed Apache-2.0 and the source is published, but the repository takes no issues and no pull requests during the beta — forking is allowed by the licence, sending changes back is not open yet, and there is no date. This is how pull requests will be handled when they open — before a PR reaches production:

• CI must pass — build and tests
• at least one review
• lake8.dev reviews every change to cryptography, the HID protocol and licence activation

Only lake8.dev signs release binaries.

Support

Beta questions: info@lake8.dev · Security issues: security@lake8.dev