| | | 1 | | // Copyright (c) Microsoft Corporation. All rights reserved. |
| | | 2 | | // Licensed under the MIT License. |
| | | 3 | | |
| | | 4 | | using System; |
| | | 5 | | using System.IO; |
| | | 6 | | using System.Security.Cryptography; |
| | | 7 | | using System.Threading.Tasks; |
| | | 8 | | using System.Xml.Linq; |
| | | 9 | | using Azure.Core.Cryptography; |
| | | 10 | | using Azure.Security.KeyVault.Keys.Cryptography; |
| | | 11 | | using Microsoft.AspNetCore.DataProtection.XmlEncryption; |
| | | 12 | | |
| | | 13 | | namespace Azure.Extensions.AspNetCore.DataProtection.Keys |
| | | 14 | | { |
| | | 15 | | internal class AzureKeyVaultXmlEncryptor : IXmlEncryptor |
| | | 16 | | { |
| | 2 | 17 | | internal static readonly string DefaultKeyEncryption = KeyWrapAlgorithm.RsaOaep.ToString(); |
| | 2 | 18 | | internal static readonly Func<SymmetricAlgorithm> DefaultSymmetricAlgorithmFactory = Aes.Create; |
| | | 19 | | |
| | | 20 | | private readonly RandomNumberGenerator _randomNumberGenerator; |
| | | 21 | | private readonly IKeyEncryptionKeyResolver _client; |
| | | 22 | | private readonly string _keyId; |
| | | 23 | | |
| | | 24 | | public AzureKeyVaultXmlEncryptor(IKeyEncryptionKeyResolver client, string keyId) |
| | 0 | 25 | | : this(client, keyId, RandomNumberGenerator.Create()) |
| | | 26 | | { |
| | 0 | 27 | | } |
| | | 28 | | |
| | 2 | 29 | | internal AzureKeyVaultXmlEncryptor(IKeyEncryptionKeyResolver client, string keyId, |
| | 2 | 30 | | RandomNumberGenerator randomNumberGenerator) |
| | | 31 | | { |
| | 2 | 32 | | _client = client; |
| | 2 | 33 | | _keyId = keyId; |
| | 2 | 34 | | _randomNumberGenerator = randomNumberGenerator; |
| | 2 | 35 | | } |
| | | 36 | | |
| | | 37 | | public EncryptedXmlInfo Encrypt(XElement plaintextElement) |
| | | 38 | | { |
| | 4 | 39 | | return Task.Run(() => EncryptAsync(plaintextElement)).GetAwaiter().GetResult(); |
| | | 40 | | } |
| | | 41 | | |
| | | 42 | | private async Task<EncryptedXmlInfo> EncryptAsync(XElement plaintextElement) |
| | | 43 | | { |
| | | 44 | | byte[] value; |
| | 2 | 45 | | using (var memoryStream = new MemoryStream()) |
| | | 46 | | { |
| | 2 | 47 | | plaintextElement.Save(memoryStream, SaveOptions.DisableFormatting); |
| | 2 | 48 | | value = memoryStream.ToArray(); |
| | 2 | 49 | | } |
| | | 50 | | |
| | 2 | 51 | | using (var symmetricAlgorithm = DefaultSymmetricAlgorithmFactory()) |
| | | 52 | | { |
| | 2 | 53 | | var symmetricBlockSize = symmetricAlgorithm.BlockSize / 8; |
| | 2 | 54 | | var symmetricKey = new byte[symmetricBlockSize]; |
| | 2 | 55 | | var symmetricIV = new byte[symmetricBlockSize]; |
| | 2 | 56 | | _randomNumberGenerator.GetBytes(symmetricKey); |
| | 2 | 57 | | _randomNumberGenerator.GetBytes(symmetricIV); |
| | | 58 | | |
| | | 59 | | byte[] encryptedValue; |
| | 2 | 60 | | using (var encryptor = symmetricAlgorithm.CreateEncryptor(symmetricKey, symmetricIV)) |
| | | 61 | | { |
| | 2 | 62 | | encryptedValue = encryptor.TransformFinalBlock(value, 0, value.Length); |
| | 2 | 63 | | } |
| | | 64 | | |
| | 2 | 65 | | var key = await _client.ResolveAsync(_keyId).ConfigureAwait(false); |
| | 2 | 66 | | var wrappedKey = await key.WrapKeyAsync(DefaultKeyEncryption, symmetricKey).ConfigureAwait(false); |
| | | 67 | | |
| | 2 | 68 | | var element = new XElement("encryptedKey", |
| | 2 | 69 | | new XComment(" This key is encrypted with Azure KeyVault. "), |
| | 2 | 70 | | new XElement("kid", key.KeyId), |
| | 2 | 71 | | new XElement("key", Convert.ToBase64String(wrappedKey)), |
| | 2 | 72 | | new XElement("iv", Convert.ToBase64String(symmetricIV)), |
| | 2 | 73 | | new XElement("value", Convert.ToBase64String(encryptedValue))); |
| | | 74 | | |
| | 2 | 75 | | return new EncryptedXmlInfo(element, typeof(AzureKeyVaultXmlDecryptor)); |
| | | 76 | | } |
| | | 77 | | |
| | 2 | 78 | | } |
| | | 79 | | } |
| | | 80 | | } |