public byte[] DecryptDataFromStream(byte[] entropy, DataProtectionScope scope, Stream stream, int length)
        {
            if (stream == null)
                throw new ArgumentNullException("stream");
            if (length <= 0)
                throw new ArgumentException("Length");
            if (entropy == null)
                throw new ArgumentNullException("entropy");
            if (entropy.Length <= 0)
                throw new ArgumentException("Entropy");

            var inBuffer = new byte[length];
            byte[] outBuffer;

            // Read the encrypted data from a stream.
            if (stream.CanRead)
            {
                stream.Read(inBuffer, 0, length);
                outBuffer = ProtectedData.Unprotect(inBuffer, entropy, scope);
            }
            else
            {
                throw new IOException("Could not read the stream.");
            }

            // Return the length that was written to the stream.
            return outBuffer;
        }

        public int EncryptDataToStream(byte[] buffer, byte[] entropy, DataProtectionScope scope, Stream stream)
        {
            if (buffer.Length <= 0)
                throw new ArgumentException("Buffer");
            if (buffer == null)
                throw new ArgumentNullException("buffer");
            if (entropy.Length <= 0)
                throw new ArgumentException("Entropy");
            if (entropy == null)
                throw new ArgumentNullException("entropy");
            if (stream == null)
                throw new ArgumentNullException("stream");

            var length = 0;

            // Encrypt the data in memory. The result is stored in the same same array as the original data.
            var encrptedData = ProtectedData.Protect(buffer, entropy, scope);

            // Write the encrypted data to a stream.
            if (stream.CanWrite)
            {
                stream.Write(encrptedData, 0, encrptedData.Length);
                length = encrptedData.Length;
            }

            // Return the length that was written to the stream.
            return length;
        }

        private static byte[] ProtectOrUnprotect(byte[] inputData, byte[] optionalEntropy, DataProtectionScope scope, bool protect)
        {
            unsafe
            {
                fixed (byte* pInputData = inputData, pOptionalEntropy = optionalEntropy)
                {
                    DATA_BLOB userDataBlob = new DATA_BLOB((IntPtr)pInputData, (uint)(inputData.Length));
                    DATA_BLOB optionalEntropyBlob = default(DATA_BLOB);
                    if (optionalEntropy != null)
                    {
                        optionalEntropyBlob = new DATA_BLOB((IntPtr)pOptionalEntropy, (uint)(optionalEntropy.Length));
                    }

                    // For desktop compat, we ignore unknown bits in the "scope" value rather than throwing.
                    CryptProtectDataFlags flags = CryptProtectDataFlags.CRYPTPROTECT_UI_FORBIDDEN;
                    if (scope == DataProtectionScope.LocalMachine)
                    {
                        flags |= CryptProtectDataFlags.CRYPTPROTECT_LOCAL_MACHINE;
                    }

                    DATA_BLOB outputBlob = default(DATA_BLOB);
                    try
                    {
                        bool success = protect ?
                            Interop.Crypt32.CryptProtectData(ref userDataBlob, null, ref optionalEntropyBlob, IntPtr.Zero, IntPtr.Zero, flags, out outputBlob) :
                            Interop.Crypt32.CryptUnprotectData(ref userDataBlob, IntPtr.Zero, ref optionalEntropyBlob, IntPtr.Zero, IntPtr.Zero, flags, out outputBlob);
                        if (!success)
                        {
                            int lastWin32Error = Marshal.GetLastWin32Error();
                            if (protect && ErrorMayBeCausedByUnloadedProfile(lastWin32Error))
                                throw new CryptographicException(SR.Cryptography_DpApi_ProfileMayNotBeLoaded);
                            else
                                throw lastWin32Error.ToCryptographicException();
                        }

                        // In some cases, the API would fail due to OOM but simply return a null pointer.
                        if (outputBlob.pbData == IntPtr.Zero)
                            throw new OutOfMemoryException();

                        int length = (int)(outputBlob.cbData);
                        byte[] outputBytes = new byte[length];
                        Marshal.Copy(outputBlob.pbData, outputBytes, 0, length);
                        return outputBytes;
                    }
                    finally
                    {
                        if (outputBlob.pbData != IntPtr.Zero)
                        {
                            int length = (int)(outputBlob.cbData);
                            byte* pOutputData = (byte*)(outputBlob.pbData);
                            for (int i = 0; i < length; i++)
                            {
                                pOutputData[i] = 0;
                            }
                            Marshal.FreeHGlobal(outputBlob.pbData);
                        }
                    }
                }
            }
        }

        public static byte[] Protect(byte[] userData, byte[] optionalEntropy, DataProtectionScope scope)
        {
            if (userData == null)
                throw new ArgumentNullException(nameof(userData));

            return ProtectOrUnprotect(userData, optionalEntropy, scope, protect: true);
        }

        public static byte[] Unprotect(byte[] encryptedData, byte[] optionalEntropy, DataProtectionScope scope)
        {
            if (encryptedData == null)
                throw new ArgumentNullException(nameof(encryptedData));

            return ProtectOrUnprotect(encryptedData, optionalEntropy, scope, protect: false);
        }

// FIXME	[DataProtectionPermission (SecurityAction.Demand, UnprotectData = true)]
		public static byte[] Unprotect (byte[] encryptedData, byte[] optionalEntropy, DataProtectionScope scope) 
		{
			if (encryptedData == null)
				throw new ArgumentNullException ("encryptedData");

			// on Windows this is supported only under 2000 and later OS
			Check (scope);

			switch (impl) {
#if !MOBILE
			case DataProtectionImplementation.ManagedProtection:
				try {
					return ManagedProtection.Unprotect (encryptedData, optionalEntropy, scope);
				}
				catch (Exception e) {
					string msg = Locale.GetText ("Data unprotection failed.");
					throw new CryptographicException (msg, e);
				}
			case DataProtectionImplementation.Win32CryptoProtect:
				try {
					return NativeDapiProtection.Unprotect (encryptedData, optionalEntropy, scope);
				}
				catch (Exception e) {
					string msg = Locale.GetText ("Data unprotection failed.");
					throw new CryptographicException (msg, e);
				}
#endif
			default:
				throw new PlatformNotSupportedException ();
			}
		}

 /// <summary>
 /// <para>Initializes a new instance of <see cref="SymmetricAlgorithmProviderData"/> class.</para>
 /// </summary>
 /// <param name="name"><para>The name for the provider.</para></param>
 /// <param name="algorithmType"><para>The type name of the hash algorithm.</para></param>
 /// <param name="protectedKeyFilename">File name where key is stored</param>
 /// <param name="protectedKeyProtectionScope">DPAPI protection scope used to store key</param>
 public SymmetricAlgorithmProviderData(string name, Type algorithmType, string protectedKeyFilename, DataProtectionScope protectedKeyProtectionScope)
     : base(name, typeof(SymmetricAlgorithmProvider))
 {
     AlgorithmType = algorithmType;
     ProtectedKeyProtectionScope = protectedKeyProtectionScope;
     ProtectedKeyFilename = protectedKeyFilename;
 }

 ProtectedKey GenerateKey(KeyedHashAlgorithm algorithm, DataProtectionScope dataProtectionScope)
 {
     using (algorithm)
     {
         return ProtectedKey.CreateFromPlaintextKey(algorithm.Key, dataProtectionScope);
     }
 }

		/// <overloads>
		/// Reads an encrypted key from an input stream. This method is not intended to allow keys to be transferred
		/// from another machine.
		/// </overloads>
		/// <summary>
		/// Reads an encrypted key from an input stream. This method is not intended to allow keys to be transferred
		/// from another machine.
		/// </summary>
		/// <param name="inputStream"><see cref="Stream"/> from which DPAPI-protected key is to be read.</param>
		/// <param name="dpapiProtectionScope"><see cref="DataProtectionScope"/> used to protect the key on disk. </param>
		/// <returns>Key read from stream, encapsulated in a <see cref="ProtectedKey"></see>.</returns>
		public static ProtectedKey Read(Stream inputStream, DataProtectionScope dpapiProtectionScope)
		{
			IKeyReader reader = new KeyReaderWriter();
			ProtectedKey key = reader.Read(inputStream, dpapiProtectionScope);

			return key;
		}

        public static int EncryptDataToStream(byte[] Buffer, byte[] Entropy, DataProtectionScope Scope, Stream S)
        {
            if (Buffer.Length <= 0)
                throw new ArgumentException("Buffer");
            if (Buffer == null)
                throw new ArgumentNullException("Buffer");
            if (Entropy.Length <= 0)
                throw new ArgumentException("Entropy");
            if (Entropy == null)
                throw new ArgumentNullException("Entropy");
            if (S == null)
                throw new ArgumentNullException("S");

            int length = 0;

            // Encrypt the data in memory. The result is stored in the same same array as the original data.
            byte[] encrptedData = ProtectedData.Protect(Buffer, Entropy, Scope);

            // Write the encrypted data to a stream.
            if (S.CanWrite && encrptedData != null)
            {
                S.Write(encrptedData, 0, encrptedData.Length);

                length = encrptedData.Length;
            }

            // Return the length that was written to the stream. 
            return length;

        }

    // Summary:
    //     Protects the userData parameter and returns a byte array.
    //
    // Parameters:
    //   userData:
    //     A byte array containing data to protect.
    //
    //   optionalEntropy:
    //     An additional byte array used to encrypt the data.
    //
    //   scope:
    //     One of the System.Security.Cryptography.DataProtectionScope values.
    //
    // Returns:
    //     A byte array representing the encrypted data.
    //
    // Exceptions:
    //   System.ArgumentNullException:
    //     The userData parameter is null.
    //
    //   System.Security.Cryptography.CryptographicException:
    //     The cryptographic protection failed.
    //
    //   System.PlatformNotSupportedException:
    //     The operating system does not support this method.
    //
    //   System.OutOfMemoryException:
    //     The system ran out of memory while encrypting the data.
    public static byte[] Protect(byte[] userData, byte[] optionalEntropy, DataProtectionScope scope)
    {
      Contract.Requires(userData != null);

      Contract.Ensures(Contract.Result<byte[]>() != null);

      return default(byte[]);
    }

		/// <summary>
		/// <para>Initialize a new instance of the <see cref="DpapiSymmetricCryptoProvider"/></para>
		/// </summary>
		/// <param name="scope"><para>One of the <see cref="DataProtectionScope"/> values.</para></param>
		/// <param name="entropy"><para>The entropy to salt the phrase.</para></param>
        /// <param name="instrumentationProvider">Instrumentation provider to use.</param>
		public DpapiSymmetricCryptoProvider(DataProtectionScope scope, byte[] entropy, ISymmetricAlgorithmInstrumentationProvider instrumentationProvider)
		{
            if (instrumentationProvider == null) throw new ArgumentNullException("instrumentationProvider");

			this.protectionScope = scope;
			this.entropy = entropy;
            this.instrumentationProvider = instrumentationProvider;
		}

 public static string Unprotect(string encryptedText, string optionalEntropy = null, DataProtectionScope scope = DataProtectionScope.CurrentUser)
 {
     if (encryptedText == null)
         return ""; // if there is no text, then return an empty string
     byte[] encryptedBytes = Convert.FromBase64String(encryptedText);
     string clearString = GetUnprotectedStringFromBytes(encryptedBytes, optionalEntropy, scope);
     return clearString;
 }

 public static string GetUnprotectedStringFromBytes(byte[] encryptedBytes, string optionalEntropy = null, DataProtectionScope scope = DataProtectionScope.CurrentUser)
 {
     byte[] entropyBytes = string.IsNullOrEmpty(optionalEntropy)
         ? null
         : Encoding.UTF8.GetBytes(optionalEntropy);
     byte[] clearBytes = ProtectedData.Unprotect(encryptedBytes, entropyBytes, scope);
     return Encoding.UTF8.GetString(clearBytes);
 }

        public static byte[] Protect(byte[] userData, byte[] optionalEntropy,
			DataProtectionScope scope)
        {
            byte[] pb = new byte[userData.Length];
            Array.Copy(userData, pb, userData.Length);
            ProtectedMemory.Protect(pb, MemoryProtectionScope.SameProcess);
            return pb;
        }

        public static string Protect(this string plainText, DataProtectionScope scope = DataProtectionScope.LocalMachine, byte[] entropy = null)
        {
            if (plainText == null) {
                throw new ArgumentNullException("plainText");
            }

            return Convert.ToBase64String(ProtectedData.Protect(Encoding.UTF8.GetBytes(plainText), entropy, scope));
        }

        public static string Unprotect(this string encryptedText, DataProtectionScope scope = DataProtectionScope.LocalMachine, byte[] entropy = null)
        {
            if (encryptedText == null) {
                throw new ArgumentNullException("encryptedText");
            }

            return Encoding.UTF8.GetString(ProtectedData.Unprotect(Convert.FromBase64String(encryptedText), entropy, scope));
        }

 public static string Unprotect(
         string encryptedText,
         DataProtectionScope scope = DataProtectionScope.CurrentUser)
 {
     byte[] encryptedBytes = GetBytesFromCSV(encryptedText);
         byte[] clearBytes = ProtectedData.Unprotect(encryptedBytes,entropy, scope);
         return GetString(clearBytes);
 }

		public static byte[] Unprotect (byte[] encryptedData, byte[] optionalEntropy, DataProtectionScope scope) 
		{
			if (encryptedData == null)
				throw new ArgumentNullException ("encryptedData");

			// on Windows this is supported only under 2000 and later OS
			throw new PlatformNotSupportedException ();
		}

 public static byte[] GetProtectedBytes(string clearText, string optionalEntropy = null, DataProtectionScope scope = DataProtectionScope.CurrentUser)
 {
     byte[] clearBytes = Encoding.UTF8.GetBytes(clearText);
     byte[] entropyBytes = string.IsNullOrEmpty(optionalEntropy)
         ? null
         : Encoding.UTF8.GetBytes(optionalEntropy);
     byte[] encryptedBytes = ProtectedData.Protect(clearBytes, entropyBytes, scope);
     return encryptedBytes;
 }