Windows SDK (DLL)

The Crypt-in Windows SDK is a DLL that lets you integrate dongle-based file encryption into any Windows application.

Licence: Apache-2.0  |  Status: free and open source

Apache 2.0, not GPL: you can ship this DLL inside a closed-source commercial product, and the patent grant covers you for the HID protocol and the .crin format it implements. See Licence for the full split.

The SDK itself costs nothing. The €150 + €100/year plan on the pricing page buys direct support and an SLA, not the code — see SDK Developer Support.

On Linux and macOS the equivalent is the Linux CLI, same Apache-2.0 licence, shipping with the developer beta: Python tools.

Source: github.com/lake8dev/cryptin-sdk — the repository opens at the developer beta, 30 September 2026. It does not exist yet, which is why the link is not clickable: it would return a 404.

What you can do

• Encrypt and decrypt .crin files from your application
• Verify dongle presence and PIN authentication
• Read the K_identity and K_attestation public keys
• Sign a challenge with the dongle for proof-of-possession

What stays closed

The DLL talks to the dongle over the HID protocol. The firmware running on the dongle is closed source: you integrate with the protocol, not with the firmware. That is enough — the protocol and the .crin format are published in full.

Installation

NuGet, at launch:

dotnet add package CryptinSDK

During the beta, from the release page of the public repository.

Quick start — C#

using CryptinSDK;

var dongle = new CryptinDongle();
dongle.Connect();                       // finds VID 0x303A, PID 0x8123

var result = dongle.VerifyPin("123456");
if (result != PinResult.Ok)
{
    Console.WriteLine("Wrong PIN, or dongle blocked");
    return;
}

dongle.EncryptFile("document.pdf", "document.crin");
dongle.DecryptFile("document.crin", "document.pdf");

dongle.Disconnect();

Calling it from C++

Correction, 2026-08-06

An earlier version of this page carried a C++ quick start. The SDK is a .NET class library and there is no C ABI layer, so a native C++ program cannot consume it directly — the header that example included does not exist.

From native C++ the routes are the ordinary .NET interop ones, and none of them ships with the SDK today: C++/CLI, a COM callable wrapper, or a NativeAOT export surface. Until one exists, the supported paths on Windows are C# and, for anything else, the HID protocol directly — it is published in full precisely so that a client can be written in any language without asking lake8.dev for anything.

API reference

CryptinDongle

Method	Returns	Description
Connect()	bool	Find and connect to the dongle
Disconnect()	void	Release the connection
VerifyPin(pin)	PinResult	Authenticate. Required before anything else
GetIdentityPubKey()	byte[32]	K_identity public key
GetAttestationPubKey()	byte[32]	K_attestation public key
Challenge(nonce)	byte[64]	Ed25519 signature over your nonce
GetFileSecret()	byte[32]	Deprecated — the underlying CMD_GET_SECRET (0x04) answers ERR_DEPRECATED on production firmware
EncryptFile(src, dst)	void	Encrypt to .crin
DecryptFile(src, dst)	void	Decrypt from .crin

Every method except Connect requires a successful VerifyPin first: the dongle answers ERR_PIN_REQUIRED otherwise. Generate the Challenge nonce from a cryptographically secure RNG and use it once — the dongle does not track freshness.

There is no DeriveSessionKey. Command 0x05 is reserved and not implemented in current firmware.

Per-file keys are not derived on the host. Since firmware 2026-08-02 EncryptFile and DecryptFile stream the data through the dongle (CMD_ENCRYPT_BLOCK / CMD_DECRYPT_BLOCK), which derives the key from file_secret and the per-file salt and runs AES-256-GCM itself: the key never crosses the USB bus. GetFileSecret() is a leftover of the previous model and its opcode is deprecated. See the PIN gate and the key hierarchy.

PinResult

Value	Meaning
Ok	PIN correct, dongle unlocked for this insertion
Wrong	Wrong PIN, attempt counted
Blocked	Three wrong attempts — only BIP-39 recovery unblocks
Required	PIN not verified yet

Contributing

The SDK is open source under Apache-2.0 and pull requests are welcome. Before a PR reaches production:

• CI must pass — build and tests
• at least one review
• lake8.dev reviews every change to cryptography, the HID protocol and licence activation

Only lake8.dev signs release binaries.

Support

Beta questions: info@lake8.dev · Security issues: security@lake8.dev