What's New in .NET 10 (LTS): Runtime, Libraries and SDK

Library Highlights: Post-Quantum Cryptography, JSON and Collections#

Post-quantum cryptography with ML-KEM and ML-DSA#

.NET 10 adds the NIST post-quantum algorithms ML-KEM (FIPS 203) for key encapsulation, ML-DSA (FIPS 204) for signatures and SLH-DSA (FIPS 205) for hash-based signatures, plus Composite ML-DSA. The types do not derive from AsymmetricAlgorithm: you create keys with static factory methods and check support with a static IsSupported property. They work where the OS provides the primitives, meaning OpenSSL 3.5 or later or Windows CNG with PQC support. In the 10.0 reference assemblies the core ML-KEM and ML-DSA operations are stable, while SLH-DSA, Composite ML-DSA and the PKCS#8 and SubjectPublicKeyInfo import and export members are experimental under diagnostic SYSLIB5006.

using System.Security.Cryptography;

if (!MLKem.IsSupported)
{
    Console.WriteLine("ML-KEM needs OpenSSL 3.5+ or Windows CNG with PQC support.");
    return;
}

// Receiver: create a key pair and publish only the encapsulation (public) key.
using MLKem receiver = MLKem.GenerateKey(MLKemAlgorithm.MLKem768);
byte[] encapsulationKey = receiver.ExportEncapsulationKey();

// Sender: derive a fresh shared secret plus a ciphertext to send back.
using MLKem sender = MLKem.ImportEncapsulationKey(MLKemAlgorithm.MLKem768, encapsulationKey);
sender.Encapsulate(out byte[] ciphertext, out byte[] senderSecret);

// Receiver: recover the same secret, then feed it into a KDF or an AES-GCM key.
byte[] receiverSecret = receiver.Decapsulate(ciphertext);
Console.WriteLine(CryptographicOperations.FixedTimeEquals(senderSecret, receiverSecret));

Other additions include AES Key Wrap with Padding (RFC 5649) on Aes, FindByThumbprint overloads that take a HashAlgorithmName for SHA-256 thumbprints, and a choice of encryption algorithm for PKCS#12 export.

Safer JSON defaults with System.Text.Json#

The JSON specification does not define what to do with duplicate property names, and "last one wins" parsing has been used to smuggle values past validation. .NET 10 adds AllowDuplicateProperties to JsonSerializerOptions and JsonDocumentOptions, plus a JsonSerializerOptions.Strict preset. Strict rejects unmapped members and duplicates, keeps case-sensitive binding, and honors nullable annotations and required constructor parameters, while staying read-compatible with the default options.

using System.Text.Json;

JsonSerializerOptions options = new(JsonSerializerOptions.Strict)
{
    PropertyNamingPolicy = JsonNamingPolicy.CamelCase
};

string[] payloads =
[
    """{ "sku": "A-100", "quantity": 2 }""",
    """{ "sku": "A-100", "quantity": 2, "quantity": -5 }""",  // duplicate key
    """{ "sku": "A-100", "quantity": 2, "isAdmin": true }""",  // unknown member
];

foreach (var json in payloads)
{
    try
    {
        var line = JsonSerializer.Deserialize<OrderLine>(json, options);
        Console.WriteLine($"Accepted: {line}");
    }
    catch (JsonException ex)
    {
        Console.WriteLine($"Rejected: {ex.Message}");
    }
}

public sealed record OrderLine(string Sku, int Quantity);

The serializer can also read directly from a PipeReader, and source-generated contexts can set a ReferenceHandler, removing one more reason to fall back to reflection when object graphs contain cycles.

Collections, LINQ, networking and more#

• LINQ: LeftJoin and RightJoin are first-class operators on Enumerable and Queryable, and AsyncEnumerable ships in the core libraries.
• Collections: OrderedDictionary<TKey, TValue> gained TryAdd and TryGetValue overloads that return the entry index; JsonObject uses them to update properties 10 to 20% faster.
• Globalization and networking: CompareOptions.NumericOrdering sorts "2" before "10", WebSocketStream exposes a WebSocket as a Stream, and macOS clients can opt into TLS 1.3.
• Compression and numerics: async ZIP APIs such as ZipFile.ExtractToDirectoryAsync arrived, and the System.Numerics.Tensors APIs are no longer experimental.