For compliance reasons, we have to use the FIPS version of BouncyCastle, available from here: https://www.bouncycastle.org/download/bouncy-castle-c-fips/#latest

However we also use other libraries, which pull in the non-fips version of BouncyCastle.Cryptography from: https://www.nuget.org/packages/BouncyCastle.Cryptography

Both these libraries use the same namespace, resulting in errors such as:

The type 'CryptoServicesRegistrar' exists in both 'BouncyCastle.Cryptography, Version=2.0.0.0, Culture=neutral, PublicKeyToken=072edcf4a5328938' and 'bc-fips-1.0.1, Version=0.1.6017.4594, Culture=neutral, PublicKeyToken=null'

The way we are consuming the FIPS library is via an abstraction, and it’s own package (e.g. MyCompany.Crypto.nupkg). Therefor we only need to expose our abstraction, and the FIPS .dll can be a private implementation detail.

So is there a way to contain the FIPS dll to only the MyCompany.Crypto package? And prevent it from leaking it’s namespace into other consumers? I tried PrivateAssets="all" when consuming MyCompany.Crypto, but it didn’t help.

This question is very similar to: BouncyCastle version conflict FIPS C#

However the key difference is that I am not consuming BouncyCastle.Cyptography directly, it is a transient dependency from a third party package we do not control. Therefor I cannot alias the package.

Using Net Core 8