Skip to content
This repository was archived by the owner on Oct 17, 2018. It is now read-only.

Commit 6db8037

Browse files
ajaybhargavbajaybhargavb
committed
Addressed comments from Levi
1 parent b00b20d commit 6db8037

23 files changed

+240
-221
lines changed

‎samples/NonDISample/Program.cs

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
using System.IO;
66
using System.Runtime.InteropServices;
77
using Microsoft.AspNetCore.DataProtection;
8+
using Microsoft.AspNetCore.DataProtection.AuthenticatedEncryption.ConfigurationModel;
89

910
namespace NonDISample
1011
{

‎src/Microsoft.AspNetCore.DataProtection/AuthenticatedEncryption/AuthenticatedEncryptorFactory.cs

Lines changed: 102 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22
// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
33

44
using System;
5+
using System.Security.Cryptography;
6+
using Microsoft.AspNetCore.Cryptography;
57
using Microsoft.AspNetCore.Cryptography.Cng;
68
using Microsoft.AspNetCore.DataProtection.AuthenticatedEncryption.ConfigurationModel;
79
using Microsoft.AspNetCore.DataProtection.KeyManagement;
@@ -26,7 +28,7 @@ public IAuthenticatedEncryptor CreateEncryptorInstance(IKey key)
2628
return null;
2729
}
2830

29-
return CreateAuthenticatedEncryptorInstance(descriptor.MasterKey, descriptor.Settings);
31+
return CreateAuthenticatedEncryptorInstance(descriptor.MasterKey, descriptor.Configuration);
3032
}
3133

3234
internal IAuthenticatedEncryptor CreateAuthenticatedEncryptorInstance(
@@ -38,7 +40,7 @@ internal IAuthenticatedEncryptor CreateAuthenticatedEncryptorInstance(
3840
return null;
3941
}
4042

41-
if (authenticatedConfiguration.IsGcmAlgorithm())
43+
if (IsGcmAlgorithm(authenticatedConfiguration.EncryptionAlgorithm))
4244
{
4345
// GCM requires CNG, and CNG is only supported on Windows.
4446
if (!OSVersionUtil.IsWindows())
@@ -48,8 +50,8 @@ internal IAuthenticatedEncryptor CreateAuthenticatedEncryptorInstance(
4850

4951
var configuration = new CngGcmAuthenticatedEncryptorConfiguration()
5052
{
51-
EncryptionAlgorithm = authenticatedConfiguration.GetBCryptAlgorithmNameFromEncryptionAlgorithm(),
52-
EncryptionAlgorithmKeySize = authenticatedConfiguration.GetAlgorithmKeySizeInBits()
53+
EncryptionAlgorithm = GetBCryptAlgorithmNameFromEncryptionAlgorithm(authenticatedConfiguration.EncryptionAlgorithm),
54+
EncryptionAlgorithmKeySize = GetAlgorithmKeySizeInBits(authenticatedConfiguration.EncryptionAlgorithm)
5355
};
5456

5557
return new CngGcmAuthenticatedEncryptorFactory(_loggerFactory).CreateAuthenticatedEncryptorInstance(secret, configuration);
@@ -61,9 +63,9 @@ internal IAuthenticatedEncryptor CreateAuthenticatedEncryptorInstance(
6163
// CNG preferred over managed implementations if running on Windows
6264
var configuration = new CngCbcAuthenticatedEncryptorConfiguration()
6365
{
64-
EncryptionAlgorithm = authenticatedConfiguration.GetBCryptAlgorithmNameFromEncryptionAlgorithm(),
65-
EncryptionAlgorithmKeySize = authenticatedConfiguration.GetAlgorithmKeySizeInBits(),
66-
HashAlgorithm = authenticatedConfiguration.GetBCryptAlgorithmNameFromValidationAlgorithm()
66+
EncryptionAlgorithm = GetBCryptAlgorithmNameFromEncryptionAlgorithm(authenticatedConfiguration.EncryptionAlgorithm),
67+
EncryptionAlgorithmKeySize = GetAlgorithmKeySizeInBits(authenticatedConfiguration.EncryptionAlgorithm),
68+
HashAlgorithm = GetBCryptAlgorithmNameFromValidationAlgorithm(authenticatedConfiguration.ValidationAlgorithm)
6769
};
6870

6971
return new CngCbcAuthenticatedEncryptorFactory(_loggerFactory).CreateAuthenticatedEncryptorInstance(secret, configuration);
@@ -73,14 +75,104 @@ internal IAuthenticatedEncryptor CreateAuthenticatedEncryptorInstance(
7375
// Use managed implementations as a fallback
7476
var configuration = new ManagedAuthenticatedEncryptorConfiguration()
7577
{
76-
EncryptionAlgorithmType = authenticatedConfiguration.GetManagedTypeFromEncryptionAlgorithm(),
77-
EncryptionAlgorithmKeySize = authenticatedConfiguration.GetAlgorithmKeySizeInBits(),
78-
ValidationAlgorithmType = authenticatedConfiguration.GetManagedTypeFromValidationAlgorithm()
78+
EncryptionAlgorithmType = GetManagedTypeFromEncryptionAlgorithm(authenticatedConfiguration.EncryptionAlgorithm),
79+
EncryptionAlgorithmKeySize = GetAlgorithmKeySizeInBits(authenticatedConfiguration.EncryptionAlgorithm),
80+
ValidationAlgorithmType = GetManagedTypeFromValidationAlgorithm(authenticatedConfiguration.ValidationAlgorithm)
7981
};
8082

8183
return new ManagedAuthenticatedEncryptorFactory(_loggerFactory).CreateAuthenticatedEncryptorInstance(secret, configuration);
8284
}
8385
}
8486
}
87+
88+
internal static bool IsGcmAlgorithm(EncryptionAlgorithm algorithm)
89+
{
90+
return (EncryptionAlgorithm.AES_128_GCM <= algorithm && algorithm <= EncryptionAlgorithm.AES_256_GCM);
91+
}
92+
93+
private static int GetAlgorithmKeySizeInBits(EncryptionAlgorithm algorithm)
94+
{
95+
switch (algorithm)
96+
{
97+
case EncryptionAlgorithm.AES_128_CBC:
98+
case EncryptionAlgorithm.AES_128_GCM:
99+
return 128;
100+
101+
case EncryptionAlgorithm.AES_192_CBC:
102+
case EncryptionAlgorithm.AES_192_GCM:
103+
return 192;
104+
105+
case EncryptionAlgorithm.AES_256_CBC:
106+
case EncryptionAlgorithm.AES_256_GCM:
107+
return 256;
108+
109+
default:
110+
throw new ArgumentOutOfRangeException(nameof(EncryptionAlgorithm));
111+
}
112+
}
113+
114+
private static string GetBCryptAlgorithmNameFromEncryptionAlgorithm(EncryptionAlgorithm algorithm)
115+
{
116+
switch (algorithm)
117+
{
118+
case EncryptionAlgorithm.AES_128_CBC:
119+
case EncryptionAlgorithm.AES_192_CBC:
120+
case EncryptionAlgorithm.AES_256_CBC:
121+
case EncryptionAlgorithm.AES_128_GCM:
122+
case EncryptionAlgorithm.AES_192_GCM:
123+
case EncryptionAlgorithm.AES_256_GCM:
124+
return Constants.BCRYPT_AES_ALGORITHM;
125+
126+
default:
127+
throw new ArgumentOutOfRangeException(nameof(EncryptionAlgorithm));
128+
}
129+
}
130+
131+
private static string GetBCryptAlgorithmNameFromValidationAlgorithm(ValidationAlgorithm algorithm)
132+
{
133+
switch (algorithm)
134+
{
135+
case ValidationAlgorithm.HMACSHA256:
136+
return Constants.BCRYPT_SHA256_ALGORITHM;
137+
138+
case ValidationAlgorithm.HMACSHA512:
139+
return Constants.BCRYPT_SHA512_ALGORITHM;
140+
141+
default:
142+
throw new ArgumentOutOfRangeException(nameof(ValidationAlgorithm));
143+
}
144+
}
145+
146+
private static Type GetManagedTypeFromEncryptionAlgorithm(EncryptionAlgorithm algorithm)
147+
{
148+
switch (algorithm)
149+
{
150+
case EncryptionAlgorithm.AES_128_CBC:
151+
case EncryptionAlgorithm.AES_192_CBC:
152+
case EncryptionAlgorithm.AES_256_CBC:
153+
case EncryptionAlgorithm.AES_128_GCM:
154+
case EncryptionAlgorithm.AES_192_GCM:
155+
case EncryptionAlgorithm.AES_256_GCM:
156+
return typeof(Aes);
157+
158+
default:
159+
throw new ArgumentOutOfRangeException(nameof(EncryptionAlgorithm));
160+
}
161+
}
162+
163+
private static Type GetManagedTypeFromValidationAlgorithm(ValidationAlgorithm algorithm)
164+
{
165+
switch (algorithm)
166+
{
167+
case ValidationAlgorithm.HMACSHA256:
168+
return typeof(HMACSHA256);
169+
170+
case ValidationAlgorithm.HMACSHA512:
171+
return typeof(HMACSHA512);
172+
173+
default:
174+
throw new ArgumentOutOfRangeException(nameof(ValidationAlgorithm));
175+
}
176+
}
85177
}
86178
}

‎src/Microsoft.AspNetCore.DataProtection/AuthenticatedEncryption/CngCbcAuthenticatedEncryptorFactory.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ public IAuthenticatedEncryptor CreateEncryptorInstance(IKey key)
2929
return null;
3030
}
3131

32-
return CreateAuthenticatedEncryptorInstance(descriptor.MasterKey, descriptor.Settings);
32+
return CreateAuthenticatedEncryptorInstance(descriptor.MasterKey, descriptor.Configuration);
3333
}
3434

3535
internal CbcAuthenticatedEncryptor CreateAuthenticatedEncryptorInstance(

‎src/Microsoft.AspNetCore.DataProtection/AuthenticatedEncryption/CngGcmAuthenticatedEncryptorFactory.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ public IAuthenticatedEncryptor CreateEncryptorInstance(IKey key)
2929
return null;
3030
}
3131

32-
return CreateAuthenticatedEncryptorInstance(descriptor.MasterKey, descriptor.Settings);
32+
return CreateAuthenticatedEncryptorInstance(descriptor.MasterKey, descriptor.Configuration);
3333
}
3434

3535
internal GcmAuthenticatedEncryptor CreateAuthenticatedEncryptorInstance(

‎src/Microsoft.AspNetCore.DataProtection/AuthenticatedEncryption/ConfigurationModel/AlgorithmConfiguration.cs

Lines changed: 1 addition & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
// Copyright (c) .NET Foundation. All rights reserved.
22
// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
33

4-
using System.Xml.Linq;
4+
using System;
55

66
namespace Microsoft.AspNetCore.DataProtection.AuthenticatedEncryption.ConfigurationModel
77
{
@@ -16,20 +16,5 @@ public abstract class AlgorithmConfiguration
1616
/// </summary>
1717
/// <returns>A unique <see cref="IAuthenticatedEncryptorDescriptor"/>.</returns>
1818
public abstract IAuthenticatedEncryptorDescriptor CreateNewDescriptor();
19-
20-
/// <summary>
21-
/// Creates a new <see cref="IAuthenticatedEncryptorDescriptor"/> instance from this configuration
22-
/// fiven specific secret key material.
23-
/// </summary>
24-
/// <remarks>
25-
/// This type is not public because we don't want to lock ourselves into a contract stating
26-
/// that a descriptor is simply a configuration plus a single serializable, reproducible secret.
27-
/// </remarks>
28-
internal abstract IAuthenticatedEncryptorDescriptor CreateDescriptorFromSecret(ISecret secret);
29-
30-
/// <summary>
31-
/// Performs a self-test of the algorithm specified by the configuration object.
32-
/// </summary>
33-
internal abstract void Validate();
3419
}
3520
}

‎src/Microsoft.AspNetCore.DataProtection/AuthenticatedEncryption/ConfigurationModel/AuthenticatedEncryptorConfiguration.cs

Lines changed: 5 additions & 94 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ namespace Microsoft.AspNetCore.DataProtection.AuthenticatedEncryption.Configurat
1010
/// <summary>
1111
/// Represents a generalized authenticated encryption mechanism.
1212
/// </summary>
13-
public sealed class AuthenticatedEncryptorConfiguration : AlgorithmConfiguration
13+
public sealed class AuthenticatedEncryptorConfiguration : AlgorithmConfiguration, IInternalAlgorithmConfiguration
1414
{
1515
/// <summary>
1616
/// The algorithm to use for symmetric encryption (confidentiality).
@@ -31,15 +31,16 @@ public sealed class AuthenticatedEncryptorConfiguration : AlgorithmConfiguration
3131

3232
public override IAuthenticatedEncryptorDescriptor CreateNewDescriptor()
3333
{
34-
return CreateDescriptorFromSecret(Secret.Random(KDK_SIZE_IN_BYTES));
34+
var internalConfiguration = (IInternalAlgorithmConfiguration)this;
35+
return internalConfiguration.CreateDescriptorFromSecret(Secret.Random(KDK_SIZE_IN_BYTES));
3536
}
3637

37-
internal override IAuthenticatedEncryptorDescriptor CreateDescriptorFromSecret(ISecret secret)
38+
IAuthenticatedEncryptorDescriptor IInternalAlgorithmConfiguration.CreateDescriptorFromSecret(ISecret secret)
3839
{
3940
return new AuthenticatedEncryptorDescriptor(this, secret);
4041
}
4142

42-
internal override void Validate()
43+
void IInternalAlgorithmConfiguration.Validate()
4344
{
4445
var factory = new AuthenticatedEncryptorFactory(DataProtectionProviderFactory.GetDefaultLoggerFactory());
4546
// Run a sample payload through an encrypt -> decrypt operation to make sure data round-trips properly.
@@ -53,95 +54,5 @@ internal override void Validate()
5354
(encryptor as IDisposable)?.Dispose();
5455
}
5556
}
56-
57-
public bool IsGcmAlgorithm()
58-
{
59-
return (EncryptionAlgorithm.AES_128_GCM <= EncryptionAlgorithm && EncryptionAlgorithm <= EncryptionAlgorithm.AES_256_GCM);
60-
}
61-
62-
public int GetAlgorithmKeySizeInBits()
63-
{
64-
switch (EncryptionAlgorithm)
65-
{
66-
case EncryptionAlgorithm.AES_128_CBC:
67-
case EncryptionAlgorithm.AES_128_GCM:
68-
return 128;
69-
70-
case EncryptionAlgorithm.AES_192_CBC:
71-
case EncryptionAlgorithm.AES_192_GCM:
72-
return 192;
73-
74-
case EncryptionAlgorithm.AES_256_CBC:
75-
case EncryptionAlgorithm.AES_256_GCM:
76-
return 256;
77-
78-
default:
79-
throw new ArgumentOutOfRangeException(nameof(EncryptionAlgorithm));
80-
}
81-
}
82-
83-
public string GetBCryptAlgorithmNameFromEncryptionAlgorithm()
84-
{
85-
switch (EncryptionAlgorithm)
86-
{
87-
case EncryptionAlgorithm.AES_128_CBC:
88-
case EncryptionAlgorithm.AES_192_CBC:
89-
case EncryptionAlgorithm.AES_256_CBC:
90-
case EncryptionAlgorithm.AES_128_GCM:
91-
case EncryptionAlgorithm.AES_192_GCM:
92-
case EncryptionAlgorithm.AES_256_GCM:
93-
return Constants.BCRYPT_AES_ALGORITHM;
94-
95-
default:
96-
throw new ArgumentOutOfRangeException(nameof(EncryptionAlgorithm));
97-
}
98-
}
99-
100-
public string GetBCryptAlgorithmNameFromValidationAlgorithm()
101-
{
102-
switch (ValidationAlgorithm)
103-
{
104-
case ValidationAlgorithm.HMACSHA256:
105-
return Constants.BCRYPT_SHA256_ALGORITHM;
106-
107-
case ValidationAlgorithm.HMACSHA512:
108-
return Constants.BCRYPT_SHA512_ALGORITHM;
109-
110-
default:
111-
throw new ArgumentOutOfRangeException(nameof(ValidationAlgorithm));
112-
}
113-
}
114-
115-
public Type GetManagedTypeFromEncryptionAlgorithm()
116-
{
117-
switch (EncryptionAlgorithm)
118-
{
119-
case EncryptionAlgorithm.AES_128_CBC:
120-
case EncryptionAlgorithm.AES_192_CBC:
121-
case EncryptionAlgorithm.AES_256_CBC:
122-
case EncryptionAlgorithm.AES_128_GCM:
123-
case EncryptionAlgorithm.AES_192_GCM:
124-
case EncryptionAlgorithm.AES_256_GCM:
125-
return typeof(Aes);
126-
127-
default:
128-
throw new ArgumentOutOfRangeException(nameof(EncryptionAlgorithm));
129-
}
130-
}
131-
132-
public Type GetManagedTypeFromValidationAlgorithm()
133-
{
134-
switch (ValidationAlgorithm)
135-
{
136-
case ValidationAlgorithm.HMACSHA256:
137-
return typeof(HMACSHA256);
138-
139-
case ValidationAlgorithm.HMACSHA512:
140-
return typeof(HMACSHA512);
141-
142-
default:
143-
throw new ArgumentOutOfRangeException(nameof(ValidationAlgorithm));
144-
}
145-
}
14657
}
14758
}

‎src/Microsoft.AspNetCore.DataProtection/AuthenticatedEncryption/ConfigurationModel/AuthenticatedEncryptorDescriptor.cs

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -12,25 +12,25 @@ namespace Microsoft.AspNetCore.DataProtection.AuthenticatedEncryption.Configurat
1212
/// </summary>
1313
public sealed class AuthenticatedEncryptorDescriptor : IAuthenticatedEncryptorDescriptor
1414
{
15-
public AuthenticatedEncryptorDescriptor(AuthenticatedEncryptorConfiguration settings, ISecret masterKey)
15+
public AuthenticatedEncryptorDescriptor(AuthenticatedEncryptorConfiguration configuration, ISecret masterKey)
1616
{
17-
if (settings == null)
17+
if (configuration == null)
1818
{
19-
throw new ArgumentNullException(nameof(settings));
19+
throw new ArgumentNullException(nameof(configuration));
2020
}
2121

2222
if (masterKey == null)
2323
{
2424
throw new ArgumentNullException(nameof(masterKey));
2525
}
2626

27-
Settings = settings;
27+
Configuration = configuration;
2828
MasterKey = masterKey;
2929
}
3030

3131
internal ISecret MasterKey { get; }
3232

33-
internal AuthenticatedEncryptorConfiguration Settings { get; }
33+
internal AuthenticatedEncryptorConfiguration Configuration { get; }
3434

3535
public XmlSerializedDescriptorInfo ExportToXml()
3636
{
@@ -41,12 +41,12 @@ public XmlSerializedDescriptorInfo ExportToXml()
4141
// </descriptor>
4242

4343
var encryptionElement = new XElement("encryption",
44-
new XAttribute("algorithm", Settings.EncryptionAlgorithm));
44+
new XAttribute("algorithm", Configuration.EncryptionAlgorithm));
4545

46-
var validationElement = (Settings.IsGcmAlgorithm())
46+
var validationElement = (AuthenticatedEncryptorFactory.IsGcmAlgorithm(Configuration.EncryptionAlgorithm))
4747
? (object)new XComment(" AES-GCM includes a 128-bit authentication tag, no extra validation algorithm required. ")
4848
: (object)new XElement("validation",
49-
new XAttribute("algorithm", Settings.ValidationAlgorithm));
49+
new XAttribute("algorithm", Configuration.ValidationAlgorithm));
5050

5151
var outerElement = new XElement("descriptor",
5252
encryptionElement,

0 commit comments

Comments
 (0)