| | | 1 | | // Copyright (c) Microsoft Corporation. All rights reserved. |
| | | 2 | | // Licensed under the MIT License. |
| | | 3 | | |
| | | 4 | | using Azure.Core; |
| | | 5 | | using Azure.Core.Pipeline; |
| | | 6 | | using System; |
| | | 7 | | using System.Threading; |
| | | 8 | | using System.Threading.Tasks; |
| | | 9 | | |
| | | 10 | | namespace Azure.Security.KeyVault.Keys.Cryptography |
| | | 11 | | { |
| | | 12 | | internal class RemoteCryptographyClient : ICryptographyProvider |
| | | 13 | | { |
| | | 14 | | private readonly Uri _keyId; |
| | | 15 | | |
| | 36 | 16 | | protected RemoteCryptographyClient() |
| | | 17 | | { |
| | 36 | 18 | | } |
| | | 19 | | |
| | 284 | 20 | | internal RemoteCryptographyClient(Uri keyId, TokenCredential credential, CryptographyClientOptions options) |
| | | 21 | | { |
| | 284 | 22 | | Argument.AssertNotNull(keyId, nameof(keyId)); |
| | 284 | 23 | | Argument.AssertNotNull(credential, nameof(credential)); |
| | | 24 | | |
| | 284 | 25 | | _keyId = keyId; |
| | 284 | 26 | | options ??= new CryptographyClientOptions(); |
| | 284 | 27 | | string apiVersion = options.GetVersionString(); |
| | | 28 | | |
| | 284 | 29 | | HttpPipeline pipeline = HttpPipelineBuilder.Build(options, |
| | 284 | 30 | | new ChallengeBasedAuthenticationPolicy(credential)); |
| | | 31 | | |
| | 284 | 32 | | Pipeline = new KeyVaultPipeline(keyId, apiVersion, pipeline, new ClientDiagnostics(options)); |
| | 284 | 33 | | } |
| | | 34 | | |
| | 16 | 35 | | internal RemoteCryptographyClient(KeyVaultPipeline pipeline) |
| | | 36 | | { |
| | 16 | 37 | | Pipeline = pipeline; |
| | 16 | 38 | | } |
| | | 39 | | |
| | 1508 | 40 | | internal KeyVaultPipeline Pipeline { get; } |
| | | 41 | | |
| | 396 | 42 | | public bool SupportsOperation(KeyOperation operation) => true; |
| | | 43 | | |
| | | 44 | | public virtual async Task<Response<EncryptResult>> EncryptAsync(EncryptionAlgorithm algorithm, byte[] plaintext, |
| | | 45 | | { |
| | 12 | 46 | | var parameters = new KeyEncryptParameters() |
| | 12 | 47 | | { |
| | 12 | 48 | | Algorithm = algorithm.ToString(), |
| | 12 | 49 | | Value = plaintext, |
| | 12 | 50 | | }; |
| | | 51 | | |
| | 12 | 52 | | using DiagnosticScope scope = Pipeline.CreateScope($"{nameof(RemoteCryptographyClient)}.{nameof(Encrypt)}"); |
| | 12 | 53 | | scope.AddAttribute("key", _keyId); |
| | 12 | 54 | | scope.Start(); |
| | | 55 | | |
| | | 56 | | try |
| | | 57 | | { |
| | 24 | 58 | | return await Pipeline.SendRequestAsync(RequestMethod.Post, parameters, () => new EncryptResult { Algorit |
| | | 59 | | } |
| | 0 | 60 | | catch (Exception e) |
| | | 61 | | { |
| | 0 | 62 | | scope.Failed(e); |
| | 0 | 63 | | throw; |
| | | 64 | | } |
| | 12 | 65 | | } |
| | | 66 | | |
| | | 67 | | public virtual Response<EncryptResult> Encrypt(EncryptionAlgorithm algorithm, byte[] plaintext, CancellationToke |
| | | 68 | | { |
| | 12 | 69 | | var parameters = new KeyEncryptParameters() |
| | 12 | 70 | | { |
| | 12 | 71 | | Algorithm = algorithm.ToString(), |
| | 12 | 72 | | Value = plaintext, |
| | 12 | 73 | | }; |
| | | 74 | | |
| | 12 | 75 | | using DiagnosticScope scope = Pipeline.CreateScope($"{nameof(RemoteCryptographyClient)}.{nameof(Encrypt)}"); |
| | 12 | 76 | | scope.AddAttribute("key", _keyId); |
| | 12 | 77 | | scope.Start(); |
| | | 78 | | |
| | | 79 | | try |
| | | 80 | | { |
| | 24 | 81 | | return Pipeline.SendRequest(RequestMethod.Post, parameters, () => new EncryptResult { Algorithm = algori |
| | | 82 | | } |
| | 0 | 83 | | catch (Exception e) |
| | | 84 | | { |
| | 0 | 85 | | scope.Failed(e); |
| | 0 | 86 | | throw; |
| | | 87 | | } |
| | 12 | 88 | | } |
| | | 89 | | |
| | | 90 | | public virtual async Task<Response<DecryptResult>> DecryptAsync(EncryptionAlgorithm algorithm, byte[] ciphertext |
| | | 91 | | { |
| | 14 | 92 | | var parameters = new KeyEncryptParameters() |
| | 14 | 93 | | { |
| | 14 | 94 | | Algorithm = algorithm.ToString(), |
| | 14 | 95 | | Value = ciphertext, |
| | 14 | 96 | | }; |
| | | 97 | | |
| | 14 | 98 | | using DiagnosticScope scope = Pipeline.CreateScope($"{nameof(RemoteCryptographyClient)}.{nameof(Decrypt)}"); |
| | 14 | 99 | | scope.AddAttribute("key", _keyId); |
| | 14 | 100 | | scope.Start(); |
| | | 101 | | |
| | | 102 | | try |
| | | 103 | | { |
| | 28 | 104 | | return await Pipeline.SendRequestAsync(RequestMethod.Post, parameters, () => new DecryptResult { Algorit |
| | | 105 | | } |
| | 0 | 106 | | catch (Exception e) |
| | | 107 | | { |
| | 0 | 108 | | scope.Failed(e); |
| | 0 | 109 | | throw; |
| | | 110 | | } |
| | 14 | 111 | | } |
| | | 112 | | |
| | | 113 | | public virtual Response<DecryptResult> Decrypt(EncryptionAlgorithm algorithm, byte[] ciphertext, CancellationTok |
| | | 114 | | { |
| | 14 | 115 | | var parameters = new KeyEncryptParameters() |
| | 14 | 116 | | { |
| | 14 | 117 | | Algorithm = algorithm.ToString(), |
| | 14 | 118 | | Value = ciphertext, |
| | 14 | 119 | | }; |
| | | 120 | | |
| | 14 | 121 | | using DiagnosticScope scope = Pipeline.CreateScope($"{nameof(RemoteCryptographyClient)}.{nameof(Decrypt)}"); |
| | 14 | 122 | | scope.AddAttribute("key", _keyId); |
| | 14 | 123 | | scope.Start(); |
| | | 124 | | |
| | | 125 | | try |
| | | 126 | | { |
| | 28 | 127 | | return Pipeline.SendRequest(RequestMethod.Post, parameters, () => new DecryptResult { Algorithm = algori |
| | | 128 | | } |
| | 0 | 129 | | catch (Exception e) |
| | | 130 | | { |
| | 0 | 131 | | scope.Failed(e); |
| | 0 | 132 | | throw; |
| | | 133 | | } |
| | 14 | 134 | | } |
| | | 135 | | |
| | | 136 | | public virtual async Task<Response<WrapResult>> WrapKeyAsync(KeyWrapAlgorithm algorithm, byte[] key, Cancellatio |
| | | 137 | | { |
| | 14 | 138 | | var parameters = new KeyWrapParameters() |
| | 14 | 139 | | { |
| | 14 | 140 | | Algorithm = algorithm.ToString(), |
| | 14 | 141 | | Key = key |
| | 14 | 142 | | }; |
| | | 143 | | |
| | 14 | 144 | | using DiagnosticScope scope = Pipeline.CreateScope($"{nameof(RemoteCryptographyClient)}.{nameof(WrapKey)}"); |
| | 14 | 145 | | scope.AddAttribute("key", _keyId); |
| | 14 | 146 | | scope.Start(); |
| | | 147 | | |
| | | 148 | | try |
| | | 149 | | { |
| | 28 | 150 | | return await Pipeline.SendRequestAsync(RequestMethod.Post, parameters, () => new WrapResult { Algorithm |
| | | 151 | | } |
| | 0 | 152 | | catch (Exception e) |
| | | 153 | | { |
| | 0 | 154 | | scope.Failed(e); |
| | 0 | 155 | | throw; |
| | | 156 | | } |
| | 14 | 157 | | } |
| | | 158 | | |
| | | 159 | | public virtual Response<WrapResult> WrapKey(KeyWrapAlgorithm algorithm, byte[] key, CancellationToken cancellati |
| | | 160 | | { |
| | 14 | 161 | | var parameters = new KeyWrapParameters() |
| | 14 | 162 | | { |
| | 14 | 163 | | Algorithm = algorithm.ToString(), |
| | 14 | 164 | | Key = key |
| | 14 | 165 | | }; |
| | | 166 | | |
| | 14 | 167 | | using DiagnosticScope scope = Pipeline.CreateScope($"{nameof(RemoteCryptographyClient)}.{nameof(WrapKey)}"); |
| | 14 | 168 | | scope.AddAttribute("key", _keyId); |
| | 14 | 169 | | scope.Start(); |
| | | 170 | | |
| | | 171 | | try |
| | | 172 | | { |
| | 28 | 173 | | return Pipeline.SendRequest(RequestMethod.Post, parameters, () => new WrapResult { Algorithm = algorithm |
| | | 174 | | } |
| | 0 | 175 | | catch (Exception e) |
| | | 176 | | { |
| | 0 | 177 | | scope.Failed(e); |
| | 0 | 178 | | throw; |
| | | 179 | | } |
| | 14 | 180 | | } |
| | | 181 | | |
| | | 182 | | public virtual async Task<Response<UnwrapResult>> UnwrapKeyAsync(KeyWrapAlgorithm algorithm, byte[] encryptedKey |
| | | 183 | | { |
| | 22 | 184 | | var parameters = new KeyWrapParameters() |
| | 22 | 185 | | { |
| | 22 | 186 | | Algorithm = algorithm.ToString(), |
| | 22 | 187 | | Key = encryptedKey |
| | 22 | 188 | | }; |
| | | 189 | | |
| | 22 | 190 | | using DiagnosticScope scope = Pipeline.CreateScope($"{nameof(RemoteCryptographyClient)}.{nameof(UnwrapKey)}" |
| | 22 | 191 | | scope.AddAttribute("key", _keyId); |
| | 22 | 192 | | scope.Start(); |
| | | 193 | | |
| | | 194 | | try |
| | | 195 | | { |
| | 40 | 196 | | return await Pipeline.SendRequestAsync(RequestMethod.Post, parameters, () => new UnwrapResult { Algorith |
| | | 197 | | } |
| | 4 | 198 | | catch (Exception e) |
| | | 199 | | { |
| | 4 | 200 | | scope.Failed(e); |
| | 4 | 201 | | throw; |
| | | 202 | | } |
| | 18 | 203 | | } |
| | | 204 | | |
| | | 205 | | public virtual Response<UnwrapResult> UnwrapKey(KeyWrapAlgorithm algorithm, byte[] encryptedKey, CancellationTok |
| | | 206 | | { |
| | 18 | 207 | | var parameters = new KeyWrapParameters() |
| | 18 | 208 | | { |
| | 18 | 209 | | Algorithm = algorithm.ToString(), |
| | 18 | 210 | | Key = encryptedKey |
| | 18 | 211 | | }; |
| | | 212 | | |
| | 18 | 213 | | using DiagnosticScope scope = Pipeline.CreateScope($"{nameof(RemoteCryptographyClient)}.{nameof(UnwrapKey)}" |
| | 18 | 214 | | scope.AddAttribute("key", _keyId); |
| | 18 | 215 | | scope.Start(); |
| | | 216 | | |
| | | 217 | | try |
| | | 218 | | { |
| | 36 | 219 | | return Pipeline.SendRequest(RequestMethod.Post, parameters, () => new UnwrapResult { Algorithm = algorit |
| | | 220 | | } |
| | 0 | 221 | | catch (Exception e) |
| | | 222 | | { |
| | 0 | 223 | | scope.Failed(e); |
| | 0 | 224 | | throw; |
| | | 225 | | } |
| | 18 | 226 | | } |
| | | 227 | | |
| | | 228 | | public virtual async Task<Response<SignResult>> SignAsync(SignatureAlgorithm algorithm, byte[] digest, Cancellat |
| | | 229 | | { |
| | 110 | 230 | | var parameters = new KeySignParameters |
| | 110 | 231 | | { |
| | 110 | 232 | | Algorithm = algorithm.ToString(), |
| | 110 | 233 | | Digest = digest |
| | 110 | 234 | | }; |
| | | 235 | | |
| | 110 | 236 | | using DiagnosticScope scope = Pipeline.CreateScope($"{nameof(RemoteCryptographyClient)}.{nameof(Sign)}"); |
| | 110 | 237 | | scope.AddAttribute("key", _keyId); |
| | 110 | 238 | | scope.Start(); |
| | | 239 | | |
| | | 240 | | try |
| | | 241 | | { |
| | 220 | 242 | | return await Pipeline.SendRequestAsync(RequestMethod.Post, parameters, () => new SignResult { Algorithm |
| | | 243 | | } |
| | 0 | 244 | | catch (Exception e) |
| | | 245 | | { |
| | 0 | 246 | | scope.Failed(e); |
| | 0 | 247 | | throw; |
| | | 248 | | } |
| | 110 | 249 | | } |
| | | 250 | | |
| | | 251 | | public virtual Response<SignResult> Sign(SignatureAlgorithm algorithm, byte[] digest, CancellationToken cancella |
| | | 252 | | { |
| | 110 | 253 | | var parameters = new KeySignParameters |
| | 110 | 254 | | { |
| | 110 | 255 | | Algorithm = algorithm.ToString(), |
| | 110 | 256 | | Digest = digest |
| | 110 | 257 | | }; |
| | | 258 | | |
| | 110 | 259 | | using DiagnosticScope scope = Pipeline.CreateScope($"{nameof(RemoteCryptographyClient)}.{nameof(Sign)}"); |
| | 110 | 260 | | scope.AddAttribute("key", _keyId); |
| | 110 | 261 | | scope.Start(); |
| | | 262 | | |
| | | 263 | | try |
| | | 264 | | { |
| | 220 | 265 | | return Pipeline.SendRequest(RequestMethod.Post, parameters, () => new SignResult { Algorithm = algorithm |
| | | 266 | | } |
| | 0 | 267 | | catch (Exception e) |
| | | 268 | | { |
| | 0 | 269 | | scope.Failed(e); |
| | 0 | 270 | | throw; |
| | | 271 | | } |
| | 110 | 272 | | } |
| | | 273 | | |
| | | 274 | | public virtual async Task<Response<VerifyResult>> VerifyAsync(SignatureAlgorithm algorithm, byte[] digest, byte[ |
| | | 275 | | { |
| | 106 | 276 | | var parameters = new KeyVerifyParameters |
| | 106 | 277 | | { |
| | 106 | 278 | | Algorithm = algorithm.ToString(), |
| | 106 | 279 | | Digest = digest, |
| | 106 | 280 | | Signature = signature |
| | 106 | 281 | | }; |
| | | 282 | | |
| | 106 | 283 | | using DiagnosticScope scope = Pipeline.CreateScope($"{nameof(RemoteCryptographyClient)}.{nameof(Verify)}"); |
| | 106 | 284 | | scope.AddAttribute("key", _keyId); |
| | 106 | 285 | | scope.Start(); |
| | | 286 | | |
| | | 287 | | try |
| | | 288 | | { |
| | 212 | 289 | | return await Pipeline.SendRequestAsync(RequestMethod.Post, parameters, () => new VerifyResult { Algorith |
| | | 290 | | } |
| | 0 | 291 | | catch (Exception e) |
| | | 292 | | { |
| | 0 | 293 | | scope.Failed(e); |
| | 0 | 294 | | throw; |
| | | 295 | | } |
| | 106 | 296 | | } |
| | | 297 | | |
| | | 298 | | public virtual Response<VerifyResult> Verify(SignatureAlgorithm algorithm, byte[] digest, byte[] signature, Canc |
| | | 299 | | { |
| | 106 | 300 | | var parameters = new KeyVerifyParameters |
| | 106 | 301 | | { |
| | 106 | 302 | | Algorithm = algorithm.ToString(), |
| | 106 | 303 | | Digest = digest, |
| | 106 | 304 | | Signature = signature |
| | 106 | 305 | | }; |
| | | 306 | | |
| | 106 | 307 | | using DiagnosticScope scope = Pipeline.CreateScope($"{nameof(RemoteCryptographyClient)}.{nameof(Verify)}"); |
| | 106 | 308 | | scope.AddAttribute("key", _keyId); |
| | 106 | 309 | | scope.Start(); |
| | | 310 | | |
| | | 311 | | try |
| | | 312 | | { |
| | 212 | 313 | | return Pipeline.SendRequest(RequestMethod.Post, parameters, () => new VerifyResult { Algorithm = algorit |
| | | 314 | | } |
| | 0 | 315 | | catch (Exception e) |
| | | 316 | | { |
| | 0 | 317 | | scope.Failed(e); |
| | 0 | 318 | | throw; |
| | | 319 | | } |
| | 106 | 320 | | } |
| | | 321 | | |
| | | 322 | | internal virtual async Task<Response<KeyVaultKey>> GetKeyAsync(CancellationToken cancellationToken = default) |
| | | 323 | | { |
| | 30 | 324 | | using DiagnosticScope scope = Pipeline.CreateScope($"{nameof(RemoteCryptographyClient)}.{nameof(GetKey)}"); |
| | 30 | 325 | | scope.AddAttribute("key", _keyId); |
| | 30 | 326 | | scope.Start(); |
| | | 327 | | |
| | | 328 | | try |
| | | 329 | | { |
| | 60 | 330 | | return await Pipeline.SendRequestAsync(RequestMethod.Get, () => new KeyVaultKey(), cancellationToken).Co |
| | | 331 | | } |
| | 0 | 332 | | catch (Exception e) |
| | | 333 | | { |
| | 0 | 334 | | scope.Failed(e); |
| | 0 | 335 | | throw; |
| | | 336 | | } |
| | 30 | 337 | | } |
| | | 338 | | |
| | | 339 | | internal virtual Response<KeyVaultKey> GetKey(CancellationToken cancellationToken = default) |
| | | 340 | | { |
| | 30 | 341 | | using DiagnosticScope scope = Pipeline.CreateScope($"{nameof(RemoteCryptographyClient)}.{nameof(GetKey)}"); |
| | 30 | 342 | | scope.AddAttribute("key", _keyId); |
| | 30 | 343 | | scope.Start(); |
| | | 344 | | |
| | | 345 | | try |
| | | 346 | | { |
| | 60 | 347 | | return Pipeline.SendRequest(RequestMethod.Get, () => new KeyVaultKey(), cancellationToken); |
| | | 348 | | } |
| | 0 | 349 | | catch (Exception e) |
| | | 350 | | { |
| | 0 | 351 | | scope.Failed(e); |
| | 0 | 352 | | throw; |
| | | 353 | | } |
| | 30 | 354 | | } |
| | | 355 | | |
| | 0 | 356 | | bool ICryptographyProvider.ShouldRemote => false; |
| | | 357 | | |
| | | 358 | | async Task<EncryptResult> ICryptographyProvider.EncryptAsync(EncryptionAlgorithm algorithm, byte[] plaintext, Ca |
| | | 359 | | { |
| | 8 | 360 | | return await EncryptAsync(algorithm, plaintext, cancellationToken).ConfigureAwait(false); |
| | 8 | 361 | | } |
| | | 362 | | |
| | | 363 | | EncryptResult ICryptographyProvider.Encrypt(EncryptionAlgorithm algorithm, byte[] plaintext, CancellationToken c |
| | | 364 | | { |
| | 8 | 365 | | return Encrypt(algorithm, plaintext, cancellationToken); |
| | | 366 | | } |
| | | 367 | | |
| | | 368 | | async Task<DecryptResult> ICryptographyProvider.DecryptAsync(EncryptionAlgorithm algorithm, byte[] ciphertext, C |
| | | 369 | | { |
| | 8 | 370 | | return await DecryptAsync(algorithm, ciphertext, cancellationToken).ConfigureAwait(false); |
| | 8 | 371 | | } |
| | | 372 | | |
| | | 373 | | DecryptResult ICryptographyProvider.Decrypt(EncryptionAlgorithm algorithm, byte[] ciphertext, CancellationToken |
| | | 374 | | { |
| | 8 | 375 | | return Decrypt(algorithm, ciphertext, cancellationToken); |
| | | 376 | | } |
| | | 377 | | |
| | | 378 | | async Task<WrapResult> ICryptographyProvider.WrapKeyAsync(KeyWrapAlgorithm algorithm, byte[] key, CancellationTo |
| | | 379 | | { |
| | 8 | 380 | | return await WrapKeyAsync(algorithm, key, cancellationToken).ConfigureAwait(false); |
| | 8 | 381 | | } |
| | | 382 | | |
| | | 383 | | WrapResult ICryptographyProvider.WrapKey(KeyWrapAlgorithm algorithm, byte[] key, CancellationToken cancellationT |
| | | 384 | | { |
| | 8 | 385 | | return WrapKey(algorithm, key, cancellationToken); |
| | | 386 | | } |
| | | 387 | | |
| | | 388 | | async Task<UnwrapResult> ICryptographyProvider.UnwrapKeyAsync(KeyWrapAlgorithm algorithm, byte[] encryptedKey, C |
| | | 389 | | { |
| | 12 | 390 | | return await UnwrapKeyAsync(algorithm, encryptedKey, cancellationToken).ConfigureAwait(false); |
| | 8 | 391 | | } |
| | | 392 | | |
| | | 393 | | UnwrapResult ICryptographyProvider.UnwrapKey(KeyWrapAlgorithm algorithm, byte[] encryptedKey, CancellationToken |
| | | 394 | | { |
| | 8 | 395 | | return UnwrapKey(algorithm, encryptedKey, cancellationToken); |
| | | 396 | | } |
| | | 397 | | |
| | | 398 | | async Task<SignResult> ICryptographyProvider.SignAsync(SignatureAlgorithm algorithm, byte[] digest, Cancellation |
| | | 399 | | { |
| | 82 | 400 | | return await SignAsync(algorithm, digest, cancellationToken).ConfigureAwait(false); |
| | 82 | 401 | | } |
| | | 402 | | |
| | | 403 | | SignResult ICryptographyProvider.Sign(SignatureAlgorithm algorithm, byte[] digest, CancellationToken cancellatio |
| | | 404 | | { |
| | 82 | 405 | | return Sign(algorithm, digest, cancellationToken); |
| | | 406 | | } |
| | | 407 | | |
| | | 408 | | async Task<VerifyResult> ICryptographyProvider.VerifyAsync(SignatureAlgorithm algorithm, byte[] digest, byte[] s |
| | | 409 | | { |
| | 118 | 410 | | return await VerifyAsync(algorithm, digest, signature, cancellationToken).ConfigureAwait(false); |
| | 118 | 411 | | } |
| | | 412 | | |
| | | 413 | | VerifyResult ICryptographyProvider.Verify(SignatureAlgorithm algorithm, byte[] digest, byte[] signature, Cancell |
| | | 414 | | { |
| | 82 | 415 | | return Verify(algorithm, digest, signature, cancellationToken); |
| | | 416 | | } |
| | | 417 | | } |
| | | 418 | | } |