| | 1 | | // Copyright (c) Microsoft Corporation. All rights reserved. |
| | 2 | | // Licensed under the MIT License. |
| | 3 | |
|
| | 4 | | using Azure.Core; |
| | 5 | | using Azure.Core.Pipeline; |
| | 6 | | using System; |
| | 7 | | using System.Threading; |
| | 8 | | using System.Threading.Tasks; |
| | 9 | |
|
| | 10 | | namespace Azure.Security.KeyVault.Keys.Cryptography |
| | 11 | | { |
| | 12 | | internal class RemoteCryptographyClient : ICryptographyProvider |
| | 13 | | { |
| | 14 | | private readonly Uri _keyId; |
| | 15 | |
|
| 36 | 16 | | protected RemoteCryptographyClient() |
| | 17 | | { |
| 36 | 18 | | } |
| | 19 | |
|
| 284 | 20 | | internal RemoteCryptographyClient(Uri keyId, TokenCredential credential, CryptographyClientOptions options) |
| | 21 | | { |
| 284 | 22 | | Argument.AssertNotNull(keyId, nameof(keyId)); |
| 284 | 23 | | Argument.AssertNotNull(credential, nameof(credential)); |
| | 24 | |
|
| 284 | 25 | | _keyId = keyId; |
| 284 | 26 | | options ??= new CryptographyClientOptions(); |
| 284 | 27 | | string apiVersion = options.GetVersionString(); |
| | 28 | |
|
| 284 | 29 | | HttpPipeline pipeline = HttpPipelineBuilder.Build(options, |
| 284 | 30 | | new ChallengeBasedAuthenticationPolicy(credential)); |
| | 31 | |
|
| 284 | 32 | | Pipeline = new KeyVaultPipeline(keyId, apiVersion, pipeline, new ClientDiagnostics(options)); |
| 284 | 33 | | } |
| | 34 | |
|
| 16 | 35 | | internal RemoteCryptographyClient(KeyVaultPipeline pipeline) |
| | 36 | | { |
| 16 | 37 | | Pipeline = pipeline; |
| 16 | 38 | | } |
| | 39 | |
|
| 1508 | 40 | | internal KeyVaultPipeline Pipeline { get; } |
| | 41 | |
|
| 396 | 42 | | public bool SupportsOperation(KeyOperation operation) => true; |
| | 43 | |
|
| | 44 | | public virtual async Task<Response<EncryptResult>> EncryptAsync(EncryptionAlgorithm algorithm, byte[] plaintext, |
| | 45 | | { |
| 12 | 46 | | var parameters = new KeyEncryptParameters() |
| 12 | 47 | | { |
| 12 | 48 | | Algorithm = algorithm.ToString(), |
| 12 | 49 | | Value = plaintext, |
| 12 | 50 | | }; |
| | 51 | |
|
| 12 | 52 | | using DiagnosticScope scope = Pipeline.CreateScope($"{nameof(RemoteCryptographyClient)}.{nameof(Encrypt)}"); |
| 12 | 53 | | scope.AddAttribute("key", _keyId); |
| 12 | 54 | | scope.Start(); |
| | 55 | |
|
| | 56 | | try |
| | 57 | | { |
| 24 | 58 | | return await Pipeline.SendRequestAsync(RequestMethod.Post, parameters, () => new EncryptResult { Algorit |
| | 59 | | } |
| 0 | 60 | | catch (Exception e) |
| | 61 | | { |
| 0 | 62 | | scope.Failed(e); |
| 0 | 63 | | throw; |
| | 64 | | } |
| 12 | 65 | | } |
| | 66 | |
|
| | 67 | | public virtual Response<EncryptResult> Encrypt(EncryptionAlgorithm algorithm, byte[] plaintext, CancellationToke |
| | 68 | | { |
| 12 | 69 | | var parameters = new KeyEncryptParameters() |
| 12 | 70 | | { |
| 12 | 71 | | Algorithm = algorithm.ToString(), |
| 12 | 72 | | Value = plaintext, |
| 12 | 73 | | }; |
| | 74 | |
|
| 12 | 75 | | using DiagnosticScope scope = Pipeline.CreateScope($"{nameof(RemoteCryptographyClient)}.{nameof(Encrypt)}"); |
| 12 | 76 | | scope.AddAttribute("key", _keyId); |
| 12 | 77 | | scope.Start(); |
| | 78 | |
|
| | 79 | | try |
| | 80 | | { |
| 24 | 81 | | return Pipeline.SendRequest(RequestMethod.Post, parameters, () => new EncryptResult { Algorithm = algori |
| | 82 | | } |
| 0 | 83 | | catch (Exception e) |
| | 84 | | { |
| 0 | 85 | | scope.Failed(e); |
| 0 | 86 | | throw; |
| | 87 | | } |
| 12 | 88 | | } |
| | 89 | |
|
| | 90 | | public virtual async Task<Response<DecryptResult>> DecryptAsync(EncryptionAlgorithm algorithm, byte[] ciphertext |
| | 91 | | { |
| 14 | 92 | | var parameters = new KeyEncryptParameters() |
| 14 | 93 | | { |
| 14 | 94 | | Algorithm = algorithm.ToString(), |
| 14 | 95 | | Value = ciphertext, |
| 14 | 96 | | }; |
| | 97 | |
|
| 14 | 98 | | using DiagnosticScope scope = Pipeline.CreateScope($"{nameof(RemoteCryptographyClient)}.{nameof(Decrypt)}"); |
| 14 | 99 | | scope.AddAttribute("key", _keyId); |
| 14 | 100 | | scope.Start(); |
| | 101 | |
|
| | 102 | | try |
| | 103 | | { |
| 28 | 104 | | return await Pipeline.SendRequestAsync(RequestMethod.Post, parameters, () => new DecryptResult { Algorit |
| | 105 | | } |
| 0 | 106 | | catch (Exception e) |
| | 107 | | { |
| 0 | 108 | | scope.Failed(e); |
| 0 | 109 | | throw; |
| | 110 | | } |
| 14 | 111 | | } |
| | 112 | |
|
| | 113 | | public virtual Response<DecryptResult> Decrypt(EncryptionAlgorithm algorithm, byte[] ciphertext, CancellationTok |
| | 114 | | { |
| 14 | 115 | | var parameters = new KeyEncryptParameters() |
| 14 | 116 | | { |
| 14 | 117 | | Algorithm = algorithm.ToString(), |
| 14 | 118 | | Value = ciphertext, |
| 14 | 119 | | }; |
| | 120 | |
|
| 14 | 121 | | using DiagnosticScope scope = Pipeline.CreateScope($"{nameof(RemoteCryptographyClient)}.{nameof(Decrypt)}"); |
| 14 | 122 | | scope.AddAttribute("key", _keyId); |
| 14 | 123 | | scope.Start(); |
| | 124 | |
|
| | 125 | | try |
| | 126 | | { |
| 28 | 127 | | return Pipeline.SendRequest(RequestMethod.Post, parameters, () => new DecryptResult { Algorithm = algori |
| | 128 | | } |
| 0 | 129 | | catch (Exception e) |
| | 130 | | { |
| 0 | 131 | | scope.Failed(e); |
| 0 | 132 | | throw; |
| | 133 | | } |
| 14 | 134 | | } |
| | 135 | |
|
| | 136 | | public virtual async Task<Response<WrapResult>> WrapKeyAsync(KeyWrapAlgorithm algorithm, byte[] key, Cancellatio |
| | 137 | | { |
| 14 | 138 | | var parameters = new KeyWrapParameters() |
| 14 | 139 | | { |
| 14 | 140 | | Algorithm = algorithm.ToString(), |
| 14 | 141 | | Key = key |
| 14 | 142 | | }; |
| | 143 | |
|
| 14 | 144 | | using DiagnosticScope scope = Pipeline.CreateScope($"{nameof(RemoteCryptographyClient)}.{nameof(WrapKey)}"); |
| 14 | 145 | | scope.AddAttribute("key", _keyId); |
| 14 | 146 | | scope.Start(); |
| | 147 | |
|
| | 148 | | try |
| | 149 | | { |
| 28 | 150 | | return await Pipeline.SendRequestAsync(RequestMethod.Post, parameters, () => new WrapResult { Algorithm |
| | 151 | | } |
| 0 | 152 | | catch (Exception e) |
| | 153 | | { |
| 0 | 154 | | scope.Failed(e); |
| 0 | 155 | | throw; |
| | 156 | | } |
| 14 | 157 | | } |
| | 158 | |
|
| | 159 | | public virtual Response<WrapResult> WrapKey(KeyWrapAlgorithm algorithm, byte[] key, CancellationToken cancellati |
| | 160 | | { |
| 14 | 161 | | var parameters = new KeyWrapParameters() |
| 14 | 162 | | { |
| 14 | 163 | | Algorithm = algorithm.ToString(), |
| 14 | 164 | | Key = key |
| 14 | 165 | | }; |
| | 166 | |
|
| 14 | 167 | | using DiagnosticScope scope = Pipeline.CreateScope($"{nameof(RemoteCryptographyClient)}.{nameof(WrapKey)}"); |
| 14 | 168 | | scope.AddAttribute("key", _keyId); |
| 14 | 169 | | scope.Start(); |
| | 170 | |
|
| | 171 | | try |
| | 172 | | { |
| 28 | 173 | | return Pipeline.SendRequest(RequestMethod.Post, parameters, () => new WrapResult { Algorithm = algorithm |
| | 174 | | } |
| 0 | 175 | | catch (Exception e) |
| | 176 | | { |
| 0 | 177 | | scope.Failed(e); |
| 0 | 178 | | throw; |
| | 179 | | } |
| 14 | 180 | | } |
| | 181 | |
|
| | 182 | | public virtual async Task<Response<UnwrapResult>> UnwrapKeyAsync(KeyWrapAlgorithm algorithm, byte[] encryptedKey |
| | 183 | | { |
| 22 | 184 | | var parameters = new KeyWrapParameters() |
| 22 | 185 | | { |
| 22 | 186 | | Algorithm = algorithm.ToString(), |
| 22 | 187 | | Key = encryptedKey |
| 22 | 188 | | }; |
| | 189 | |
|
| 22 | 190 | | using DiagnosticScope scope = Pipeline.CreateScope($"{nameof(RemoteCryptographyClient)}.{nameof(UnwrapKey)}" |
| 22 | 191 | | scope.AddAttribute("key", _keyId); |
| 22 | 192 | | scope.Start(); |
| | 193 | |
|
| | 194 | | try |
| | 195 | | { |
| 40 | 196 | | return await Pipeline.SendRequestAsync(RequestMethod.Post, parameters, () => new UnwrapResult { Algorith |
| | 197 | | } |
| 4 | 198 | | catch (Exception e) |
| | 199 | | { |
| 4 | 200 | | scope.Failed(e); |
| 4 | 201 | | throw; |
| | 202 | | } |
| 18 | 203 | | } |
| | 204 | |
|
| | 205 | | public virtual Response<UnwrapResult> UnwrapKey(KeyWrapAlgorithm algorithm, byte[] encryptedKey, CancellationTok |
| | 206 | | { |
| 18 | 207 | | var parameters = new KeyWrapParameters() |
| 18 | 208 | | { |
| 18 | 209 | | Algorithm = algorithm.ToString(), |
| 18 | 210 | | Key = encryptedKey |
| 18 | 211 | | }; |
| | 212 | |
|
| 18 | 213 | | using DiagnosticScope scope = Pipeline.CreateScope($"{nameof(RemoteCryptographyClient)}.{nameof(UnwrapKey)}" |
| 18 | 214 | | scope.AddAttribute("key", _keyId); |
| 18 | 215 | | scope.Start(); |
| | 216 | |
|
| | 217 | | try |
| | 218 | | { |
| 36 | 219 | | return Pipeline.SendRequest(RequestMethod.Post, parameters, () => new UnwrapResult { Algorithm = algorit |
| | 220 | | } |
| 0 | 221 | | catch (Exception e) |
| | 222 | | { |
| 0 | 223 | | scope.Failed(e); |
| 0 | 224 | | throw; |
| | 225 | | } |
| 18 | 226 | | } |
| | 227 | |
|
| | 228 | | public virtual async Task<Response<SignResult>> SignAsync(SignatureAlgorithm algorithm, byte[] digest, Cancellat |
| | 229 | | { |
| 110 | 230 | | var parameters = new KeySignParameters |
| 110 | 231 | | { |
| 110 | 232 | | Algorithm = algorithm.ToString(), |
| 110 | 233 | | Digest = digest |
| 110 | 234 | | }; |
| | 235 | |
|
| 110 | 236 | | using DiagnosticScope scope = Pipeline.CreateScope($"{nameof(RemoteCryptographyClient)}.{nameof(Sign)}"); |
| 110 | 237 | | scope.AddAttribute("key", _keyId); |
| 110 | 238 | | scope.Start(); |
| | 239 | |
|
| | 240 | | try |
| | 241 | | { |
| 220 | 242 | | return await Pipeline.SendRequestAsync(RequestMethod.Post, parameters, () => new SignResult { Algorithm |
| | 243 | | } |
| 0 | 244 | | catch (Exception e) |
| | 245 | | { |
| 0 | 246 | | scope.Failed(e); |
| 0 | 247 | | throw; |
| | 248 | | } |
| 110 | 249 | | } |
| | 250 | |
|
| | 251 | | public virtual Response<SignResult> Sign(SignatureAlgorithm algorithm, byte[] digest, CancellationToken cancella |
| | 252 | | { |
| 110 | 253 | | var parameters = new KeySignParameters |
| 110 | 254 | | { |
| 110 | 255 | | Algorithm = algorithm.ToString(), |
| 110 | 256 | | Digest = digest |
| 110 | 257 | | }; |
| | 258 | |
|
| 110 | 259 | | using DiagnosticScope scope = Pipeline.CreateScope($"{nameof(RemoteCryptographyClient)}.{nameof(Sign)}"); |
| 110 | 260 | | scope.AddAttribute("key", _keyId); |
| 110 | 261 | | scope.Start(); |
| | 262 | |
|
| | 263 | | try |
| | 264 | | { |
| 220 | 265 | | return Pipeline.SendRequest(RequestMethod.Post, parameters, () => new SignResult { Algorithm = algorithm |
| | 266 | | } |
| 0 | 267 | | catch (Exception e) |
| | 268 | | { |
| 0 | 269 | | scope.Failed(e); |
| 0 | 270 | | throw; |
| | 271 | | } |
| 110 | 272 | | } |
| | 273 | |
|
| | 274 | | public virtual async Task<Response<VerifyResult>> VerifyAsync(SignatureAlgorithm algorithm, byte[] digest, byte[ |
| | 275 | | { |
| 106 | 276 | | var parameters = new KeyVerifyParameters |
| 106 | 277 | | { |
| 106 | 278 | | Algorithm = algorithm.ToString(), |
| 106 | 279 | | Digest = digest, |
| 106 | 280 | | Signature = signature |
| 106 | 281 | | }; |
| | 282 | |
|
| 106 | 283 | | using DiagnosticScope scope = Pipeline.CreateScope($"{nameof(RemoteCryptographyClient)}.{nameof(Verify)}"); |
| 106 | 284 | | scope.AddAttribute("key", _keyId); |
| 106 | 285 | | scope.Start(); |
| | 286 | |
|
| | 287 | | try |
| | 288 | | { |
| 212 | 289 | | return await Pipeline.SendRequestAsync(RequestMethod.Post, parameters, () => new VerifyResult { Algorith |
| | 290 | | } |
| 0 | 291 | | catch (Exception e) |
| | 292 | | { |
| 0 | 293 | | scope.Failed(e); |
| 0 | 294 | | throw; |
| | 295 | | } |
| 106 | 296 | | } |
| | 297 | |
|
| | 298 | | public virtual Response<VerifyResult> Verify(SignatureAlgorithm algorithm, byte[] digest, byte[] signature, Canc |
| | 299 | | { |
| 106 | 300 | | var parameters = new KeyVerifyParameters |
| 106 | 301 | | { |
| 106 | 302 | | Algorithm = algorithm.ToString(), |
| 106 | 303 | | Digest = digest, |
| 106 | 304 | | Signature = signature |
| 106 | 305 | | }; |
| | 306 | |
|
| 106 | 307 | | using DiagnosticScope scope = Pipeline.CreateScope($"{nameof(RemoteCryptographyClient)}.{nameof(Verify)}"); |
| 106 | 308 | | scope.AddAttribute("key", _keyId); |
| 106 | 309 | | scope.Start(); |
| | 310 | |
|
| | 311 | | try |
| | 312 | | { |
| 212 | 313 | | return Pipeline.SendRequest(RequestMethod.Post, parameters, () => new VerifyResult { Algorithm = algorit |
| | 314 | | } |
| 0 | 315 | | catch (Exception e) |
| | 316 | | { |
| 0 | 317 | | scope.Failed(e); |
| 0 | 318 | | throw; |
| | 319 | | } |
| 106 | 320 | | } |
| | 321 | |
|
| | 322 | | internal virtual async Task<Response<KeyVaultKey>> GetKeyAsync(CancellationToken cancellationToken = default) |
| | 323 | | { |
| 30 | 324 | | using DiagnosticScope scope = Pipeline.CreateScope($"{nameof(RemoteCryptographyClient)}.{nameof(GetKey)}"); |
| 30 | 325 | | scope.AddAttribute("key", _keyId); |
| 30 | 326 | | scope.Start(); |
| | 327 | |
|
| | 328 | | try |
| | 329 | | { |
| 60 | 330 | | return await Pipeline.SendRequestAsync(RequestMethod.Get, () => new KeyVaultKey(), cancellationToken).Co |
| | 331 | | } |
| 0 | 332 | | catch (Exception e) |
| | 333 | | { |
| 0 | 334 | | scope.Failed(e); |
| 0 | 335 | | throw; |
| | 336 | | } |
| 30 | 337 | | } |
| | 338 | |
|
| | 339 | | internal virtual Response<KeyVaultKey> GetKey(CancellationToken cancellationToken = default) |
| | 340 | | { |
| 30 | 341 | | using DiagnosticScope scope = Pipeline.CreateScope($"{nameof(RemoteCryptographyClient)}.{nameof(GetKey)}"); |
| 30 | 342 | | scope.AddAttribute("key", _keyId); |
| 30 | 343 | | scope.Start(); |
| | 344 | |
|
| | 345 | | try |
| | 346 | | { |
| 60 | 347 | | return Pipeline.SendRequest(RequestMethod.Get, () => new KeyVaultKey(), cancellationToken); |
| | 348 | | } |
| 0 | 349 | | catch (Exception e) |
| | 350 | | { |
| 0 | 351 | | scope.Failed(e); |
| 0 | 352 | | throw; |
| | 353 | | } |
| 30 | 354 | | } |
| | 355 | |
|
| 0 | 356 | | bool ICryptographyProvider.ShouldRemote => false; |
| | 357 | |
|
| | 358 | | async Task<EncryptResult> ICryptographyProvider.EncryptAsync(EncryptionAlgorithm algorithm, byte[] plaintext, Ca |
| | 359 | | { |
| 8 | 360 | | return await EncryptAsync(algorithm, plaintext, cancellationToken).ConfigureAwait(false); |
| 8 | 361 | | } |
| | 362 | |
|
| | 363 | | EncryptResult ICryptographyProvider.Encrypt(EncryptionAlgorithm algorithm, byte[] plaintext, CancellationToken c |
| | 364 | | { |
| 8 | 365 | | return Encrypt(algorithm, plaintext, cancellationToken); |
| | 366 | | } |
| | 367 | |
|
| | 368 | | async Task<DecryptResult> ICryptographyProvider.DecryptAsync(EncryptionAlgorithm algorithm, byte[] ciphertext, C |
| | 369 | | { |
| 8 | 370 | | return await DecryptAsync(algorithm, ciphertext, cancellationToken).ConfigureAwait(false); |
| 8 | 371 | | } |
| | 372 | |
|
| | 373 | | DecryptResult ICryptographyProvider.Decrypt(EncryptionAlgorithm algorithm, byte[] ciphertext, CancellationToken |
| | 374 | | { |
| 8 | 375 | | return Decrypt(algorithm, ciphertext, cancellationToken); |
| | 376 | | } |
| | 377 | |
|
| | 378 | | async Task<WrapResult> ICryptographyProvider.WrapKeyAsync(KeyWrapAlgorithm algorithm, byte[] key, CancellationTo |
| | 379 | | { |
| 8 | 380 | | return await WrapKeyAsync(algorithm, key, cancellationToken).ConfigureAwait(false); |
| 8 | 381 | | } |
| | 382 | |
|
| | 383 | | WrapResult ICryptographyProvider.WrapKey(KeyWrapAlgorithm algorithm, byte[] key, CancellationToken cancellationT |
| | 384 | | { |
| 8 | 385 | | return WrapKey(algorithm, key, cancellationToken); |
| | 386 | | } |
| | 387 | |
|
| | 388 | | async Task<UnwrapResult> ICryptographyProvider.UnwrapKeyAsync(KeyWrapAlgorithm algorithm, byte[] encryptedKey, C |
| | 389 | | { |
| 12 | 390 | | return await UnwrapKeyAsync(algorithm, encryptedKey, cancellationToken).ConfigureAwait(false); |
| 8 | 391 | | } |
| | 392 | |
|
| | 393 | | UnwrapResult ICryptographyProvider.UnwrapKey(KeyWrapAlgorithm algorithm, byte[] encryptedKey, CancellationToken |
| | 394 | | { |
| 8 | 395 | | return UnwrapKey(algorithm, encryptedKey, cancellationToken); |
| | 396 | | } |
| | 397 | |
|
| | 398 | | async Task<SignResult> ICryptographyProvider.SignAsync(SignatureAlgorithm algorithm, byte[] digest, Cancellation |
| | 399 | | { |
| 82 | 400 | | return await SignAsync(algorithm, digest, cancellationToken).ConfigureAwait(false); |
| 82 | 401 | | } |
| | 402 | |
|
| | 403 | | SignResult ICryptographyProvider.Sign(SignatureAlgorithm algorithm, byte[] digest, CancellationToken cancellatio |
| | 404 | | { |
| 82 | 405 | | return Sign(algorithm, digest, cancellationToken); |
| | 406 | | } |
| | 407 | |
|
| | 408 | | async Task<VerifyResult> ICryptographyProvider.VerifyAsync(SignatureAlgorithm algorithm, byte[] digest, byte[] s |
| | 409 | | { |
| 118 | 410 | | return await VerifyAsync(algorithm, digest, signature, cancellationToken).ConfigureAwait(false); |
| 118 | 411 | | } |
| | 412 | |
|
| | 413 | | VerifyResult ICryptographyProvider.Verify(SignatureAlgorithm algorithm, byte[] digest, byte[] signature, Cancell |
| | 414 | | { |
| 82 | 415 | | return Verify(algorithm, digest, signature, cancellationToken); |
| | 416 | | } |
| | 417 | | } |
| | 418 | | } |