| | 1 | | // Copyright (c) Microsoft Corporation. All rights reserved. |
| | 2 | | // Licensed under the MIT License. See License.txt in the project root for |
| | 3 | | // license information. |
| | 4 | |
|
| | 5 | | using System; |
| | 6 | | using System.Security.Cryptography; |
| | 7 | |
|
| | 8 | | namespace Microsoft.Azure.KeyVault.Cryptography.Algorithms |
| | 9 | | { |
| | 10 | | /// <summary> |
| | 11 | | /// Abstract AES Key Wrap algoritm. |
| | 12 | | /// </summary> |
| | 13 | | public abstract class AesKw : KeyWrapAlgorithm |
| | 14 | | { |
| | 15 | | const int BlockSizeInBits = 64; |
| | 16 | | const int BlockSizeInBytes = BlockSizeInBits >> 3; |
| | 17 | |
|
| 2 | 18 | | static readonly byte[] _defaultIv = new byte[] { 0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6 }; |
| | 19 | |
|
| 2 | 20 | | protected static RandomNumberGenerator Rng = RandomNumberGenerator.Create(); |
| | 21 | |
|
| | 22 | | internal static Aes Create( byte[] key ) |
| | 23 | | { |
| 48 | 24 | | var aes = Aes.Create(); |
| | 25 | |
|
| 48 | 26 | | aes.Mode = CipherMode.ECB; |
| 48 | 27 | | aes.Padding = PaddingMode.None; |
| 48 | 28 | | aes.KeySize = key.Length * 8; |
| 48 | 29 | | aes.Key = key; |
| | 30 | |
|
| 48 | 31 | | return aes; |
| | 32 | | } |
| | 33 | |
|
| 18 | 34 | | protected AesKw( string name ) : base( name ) |
| | 35 | | { |
| | 36 | |
|
| 18 | 37 | | } |
| | 38 | |
|
| | 39 | | public ICryptoTransform CreateEncryptor( byte[] key ) |
| | 40 | | { |
| 12 | 41 | | return CreateEncryptor( key, null ); |
| | 42 | | } |
| | 43 | |
|
| | 44 | | public override ICryptoTransform CreateEncryptor( byte[] key, byte[] iv ) |
| | 45 | | { |
| 24 | 46 | | if ( key == null ) |
| 0 | 47 | | throw new ArgumentNullException( "key" ); |
| | 48 | |
|
| 24 | 49 | | if ( key.Length != 128 >> 3 && key.Length != 192 >> 3 && key.Length != 256 >> 3 ) |
| 0 | 50 | | throw new ArgumentException( "key length must be 128, 192 or 256 bits" ); |
| | 51 | |
|
| 24 | 52 | | if ( iv != null && iv.Length != 8 ) |
| 0 | 53 | | throw new ArgumentException( "iv length must be 64 bits" ); |
| | 54 | |
|
| 24 | 55 | | return new AesKwEncryptor( key, iv ?? DefaultIv ); |
| | 56 | | } |
| | 57 | |
|
| | 58 | | public ICryptoTransform CreateDecryptor( byte[] key ) |
| | 59 | | { |
| 12 | 60 | | return CreateDecryptor( key, null ); |
| | 61 | | } |
| | 62 | |
|
| | 63 | | public override ICryptoTransform CreateDecryptor( byte[] key, byte[] iv) |
| | 64 | | { |
| 24 | 65 | | if ( key == null ) |
| 0 | 66 | | throw new ArgumentNullException( "key" ); |
| | 67 | |
|
| 24 | 68 | | if ( key.Length != 128 >> 3 && key.Length != 192 >> 3 && key.Length != 256 >> 3 ) |
| 0 | 69 | | throw new ArgumentException( "key length must be 128, 192 or 256 bits" ); |
| | 70 | |
|
| 24 | 71 | | if ( iv != null && iv.Length != 8 ) |
| 0 | 72 | | throw new ArgumentException( "iv length must be 64 bits" ); |
| | 73 | |
|
| 24 | 74 | | return new AesKwDecryptor( key, iv ?? DefaultIv ); |
| | 75 | | } |
| | 76 | |
|
| | 77 | | private static byte[] DefaultIv |
| | 78 | | { |
| 48 | 79 | | get { return (byte[])_defaultIv.Clone(); } |
| | 80 | | } |
| | 81 | |
|
| | 82 | | static byte[] GetBytes( UInt64 i ) |
| | 83 | | { |
| 576 | 84 | | byte[] temp = BitConverter.GetBytes( i ); |
| | 85 | |
|
| 576 | 86 | | if ( BitConverter.IsLittleEndian ) |
| | 87 | | { |
| 576 | 88 | | Array.Reverse( temp ); |
| | 89 | | } |
| | 90 | |
|
| 576 | 91 | | return temp; |
| | 92 | | } |
| | 93 | |
|
| | 94 | | class AesKwEncryptor : ICryptoTransform |
| | 95 | | { |
| | 96 | | private Aes _aes; |
| | 97 | | private byte[] _iv; |
| | 98 | |
|
| 24 | 99 | | internal AesKwEncryptor( byte[] keyBytes, byte[] iv ) |
| | 100 | | { |
| | 101 | | // Create the AES provider |
| 24 | 102 | | _aes = AesKw.Create( keyBytes ); |
| | 103 | |
|
| | 104 | | // Set the AES IV to Zeroes |
| 24 | 105 | | var aesIv = new byte[_aes.BlockSize >> 3]; |
| | 106 | |
|
| 24 | 107 | | aesIv.Zero(); |
| | 108 | |
|
| 24 | 109 | | _aes.IV = aesIv; |
| | 110 | |
|
| | 111 | | // Remember the real IV |
| 24 | 112 | | _iv = iv.Clone() as byte[]; |
| 24 | 113 | | } |
| | 114 | |
|
| | 115 | | public bool CanReuseTransform |
| | 116 | | { |
| 0 | 117 | | get { throw new NotImplementedException(); } |
| | 118 | | } |
| | 119 | |
|
| | 120 | | public bool CanTransformMultipleBlocks |
| | 121 | | { |
| 0 | 122 | | get { throw new NotImplementedException(); } |
| | 123 | | } |
| | 124 | |
|
| | 125 | | public int InputBlockSize |
| | 126 | | { |
| 0 | 127 | | get { throw new NotImplementedException(); } |
| | 128 | | } |
| | 129 | |
|
| | 130 | | public int OutputBlockSize |
| | 131 | | { |
| 0 | 132 | | get { throw new NotImplementedException(); } |
| | 133 | | } |
| | 134 | |
|
| | 135 | | public int TransformBlock( byte[] inputBuffer, int inputOffset, int inputCount, byte[] outputBuffer, int out |
| | 136 | | { |
| | 137 | | // No support for block-by-block transformation |
| 0 | 138 | | throw new NotImplementedException(); |
| | 139 | | } |
| | 140 | |
|
| | 141 | | public byte[] TransformFinalBlock( byte[] inputBuffer, int inputOffset, int inputCount ) |
| | 142 | | { |
| 24 | 143 | | if ( inputBuffer == null ) |
| 0 | 144 | | throw new ArgumentNullException( "inputBuffer" ); |
| | 145 | |
|
| 24 | 146 | | if ( inputBuffer.Length == 0 ) |
| 0 | 147 | | throw new ArgumentNullException( "inputBuffer", "The length of the inputBuffer parameter cannot be z |
| | 148 | |
|
| 24 | 149 | | if ( inputCount <= 0 ) |
| 0 | 150 | | throw new ArgumentOutOfRangeException( "inputCount", "The inputCount parameter must not be zero or n |
| | 151 | |
|
| 24 | 152 | | if ( inputCount % 8 != 0 ) |
| 0 | 153 | | throw new ArgumentOutOfRangeException( "inputCount", "The inputCount parameter must be a multiple of |
| | 154 | |
|
| 24 | 155 | | if ( inputOffset < 0 ) |
| 0 | 156 | | throw new ArgumentOutOfRangeException( "inputOffset", "The inputOffset parameter must not be negativ |
| | 157 | |
|
| 24 | 158 | | if ( inputOffset + inputCount > inputBuffer.Length ) |
| 0 | 159 | | throw new ArgumentOutOfRangeException( "inputCount", "The sum of inputCount and inputOffset paramete |
| | 160 | |
|
| | 161 | |
|
| | 162 | | /* |
| | 163 | | 1) Initialize variables. |
| | 164 | |
|
| | 165 | | Set A = IV, an initial value (see 2.2.3) |
| | 166 | | For i = 1 to n |
| | 167 | | R[i] = P[i] |
| | 168 | |
|
| | 169 | | 2) Calculate intermediate values. |
| | 170 | |
|
| | 171 | | For j = 0 to 5 |
| | 172 | | For i=1 to n |
| | 173 | | B = AES(K, A | R[i]) |
| | 174 | | A = MSB(64, B) ^ t where t = (n*j)+i |
| | 175 | | R[i] = LSB(64, B) |
| | 176 | |
|
| | 177 | | 3) Output the results. |
| | 178 | |
|
| | 179 | | Set C[0] = A |
| | 180 | | For i = 1 to n |
| | 181 | | C[i] = R[i] |
| | 182 | | */ |
| | 183 | |
|
| | 184 | | // The default initialization vector from RFC3394 |
| 24 | 185 | | byte[] a = _iv; |
| | 186 | |
|
| | 187 | | // The number of input blocks |
| 24 | 188 | | var n = inputCount >> 3; |
| | 189 | |
|
| | 190 | | // The set of input blocks |
| 24 | 191 | | byte[] r = new byte[n << 3]; |
| | 192 | |
|
| 24 | 193 | | Array.Copy( inputBuffer, inputOffset, r, 0, inputCount ); |
| | 194 | |
|
| 24 | 195 | | var encryptor = _aes.CreateEncryptor(); |
| 24 | 196 | | byte[] block = new byte[16]; |
| | 197 | |
|
| | 198 | | // Calculate intermediate values |
| 336 | 199 | | for ( var j = 0; j < 6; j++ ) |
| | 200 | | { |
| 864 | 201 | | for ( var i = 0; i < n; i++ ) |
| | 202 | | { |
| | 203 | | // T = ( n * j ) + i |
| 288 | 204 | | var t = (ulong)( ( n * j ) + i + 1 ); |
| | 205 | |
|
| | 206 | | // B = AES( K, A | R[i] ) |
| | 207 | |
|
| | 208 | | // First, block = A | R[i] |
| 288 | 209 | | Array.Copy( a, block, a.Length ); |
| 288 | 210 | | Array.Copy( r, i << 3, block, 64 >> 3, 64 >> 3 ); |
| | 211 | |
|
| | 212 | | // Second, AES( K, block ) |
| 288 | 213 | | var b = encryptor.TransformFinalBlock( block, 0, 16 ); |
| | 214 | |
|
| | 215 | | // A = MSB( 64, B ) |
| 288 | 216 | | Array.Copy( b, a, 64 >> 3 ); |
| | 217 | |
|
| | 218 | | // A = A ^ t |
| 288 | 219 | | a.Xor( GetBytes( t ), true ); |
| | 220 | |
|
| | 221 | | // R[i] = LSB( 64, B ) |
| 288 | 222 | | Array.Copy( b, 64 >> 3, r, i << 3, 64 >> 3 ); |
| | 223 | | } |
| | 224 | | } |
| | 225 | |
|
| 24 | 226 | | var c = new byte[( n + 1 ) << 3]; |
| | 227 | |
|
| 24 | 228 | | Array.Copy( a, c, a.Length ); |
| | 229 | |
|
| 144 | 230 | | for ( var i = 0; i < n; i++ ) |
| | 231 | | { |
| 48 | 232 | | Array.Copy( r, i << 3, c, ( i + 1 ) << 3, 8 ); |
| | 233 | | } |
| | 234 | |
|
| 24 | 235 | | return c; |
| | 236 | | } |
| | 237 | |
|
| | 238 | | public void Dispose() |
| | 239 | | { |
| 24 | 240 | | Dispose( true ); |
| 24 | 241 | | GC.SuppressFinalize( this ); |
| 24 | 242 | | } |
| | 243 | |
|
| | 244 | | protected virtual void Dispose( bool disposing ) |
| | 245 | | { |
| 24 | 246 | | if ( disposing ) |
| | 247 | | { |
| 24 | 248 | | if ( _aes != null ) |
| | 249 | | { |
| 24 | 250 | | _aes.Dispose(); |
| 24 | 251 | | _aes = null; |
| | 252 | | } |
| | 253 | | } |
| 24 | 254 | | } |
| | 255 | | } |
| | 256 | |
|
| | 257 | | class AesKwDecryptor : ICryptoTransform |
| | 258 | | { |
| | 259 | | private Aes _aes; |
| | 260 | | private byte[] _iv; |
| | 261 | |
|
| 24 | 262 | | internal AesKwDecryptor( byte[] keyBytes, byte[] iv ) |
| | 263 | | { |
| | 264 | | // Create the AES provider |
| 24 | 265 | | _aes = AesKw.Create( keyBytes ); |
| | 266 | |
|
| | 267 | | // Set the AES IV to Zeroes |
| 24 | 268 | | var aesIv = new byte[_aes.BlockSize >> 3]; |
| | 269 | |
|
| 24 | 270 | | aesIv.Zero(); |
| | 271 | |
|
| 24 | 272 | | _aes.IV = aesIv; |
| | 273 | |
|
| | 274 | | // Remember the real IV |
| 24 | 275 | | _iv = iv.Clone() as byte[]; |
| 24 | 276 | | } |
| | 277 | |
|
| | 278 | | public bool CanReuseTransform |
| | 279 | | { |
| 0 | 280 | | get { throw new NotImplementedException(); } |
| | 281 | | } |
| | 282 | |
|
| | 283 | | public bool CanTransformMultipleBlocks |
| | 284 | | { |
| 0 | 285 | | get { throw new NotImplementedException(); } |
| | 286 | | } |
| | 287 | |
|
| | 288 | | public int InputBlockSize |
| | 289 | | { |
| 0 | 290 | | get { throw new NotImplementedException(); } |
| | 291 | | } |
| | 292 | |
|
| | 293 | | public int OutputBlockSize |
| | 294 | | { |
| 0 | 295 | | get { throw new NotImplementedException(); } |
| | 296 | | } |
| | 297 | |
|
| | 298 | | public int TransformBlock( byte[] inputBuffer, int inputOffset, int inputCount, byte[] outputBuffer, int out |
| | 299 | | { |
| | 300 | | // No support for block-by-block transformation |
| 0 | 301 | | throw new NotImplementedException(); |
| | 302 | | } |
| | 303 | |
|
| | 304 | | public byte[] TransformFinalBlock( byte[] inputBuffer, int inputOffset, int inputCount ) |
| | 305 | | { |
| 24 | 306 | | if ( inputBuffer == null ) |
| 0 | 307 | | throw new ArgumentNullException( "inputBuffer" ); |
| | 308 | |
|
| 24 | 309 | | if ( inputBuffer.Length == 0 ) |
| 0 | 310 | | throw new ArgumentNullException( "inputBuffer", "The length of the inputBuffer parameter cannot be z |
| | 311 | |
|
| 24 | 312 | | if ( inputCount <= 0 ) |
| 0 | 313 | | throw new ArgumentOutOfRangeException( "inputCount", "The inputCount parameter must not be zero or n |
| | 314 | |
|
| 24 | 315 | | if ( inputCount % 8 != 0 ) |
| 0 | 316 | | throw new ArgumentOutOfRangeException( "inputCount", "The inputCount parameter must be a multiple of |
| | 317 | |
|
| 24 | 318 | | if ( inputOffset < 0 ) |
| 0 | 319 | | throw new ArgumentOutOfRangeException( "inputOffset", "The inputOffset parameter must not be negativ |
| | 320 | |
|
| 24 | 321 | | if ( inputOffset + inputCount > inputBuffer.Length ) |
| 0 | 322 | | throw new ArgumentOutOfRangeException( "inputCount", "The sum of inputCount and inputOffset paramete |
| | 323 | |
|
| | 324 | |
|
| | 325 | | /* |
| | 326 | | 1) Initialize variables. |
| | 327 | |
|
| | 328 | | Set A = C[0] |
| | 329 | | For i = 1 to n |
| | 330 | | R[i] = C[i] |
| | 331 | |
|
| | 332 | | 2) Compute intermediate values. |
| | 333 | |
|
| | 334 | | For j = 5 to 0 |
| | 335 | | For i = n to 1 |
| | 336 | | B = AES-1(K, (A ^ t) | R[i]) where t = n*j+i |
| | 337 | | A = MSB(64, B) |
| | 338 | | R[i] = LSB(64, B) |
| | 339 | |
|
| | 340 | | 3) Output results. |
| | 341 | |
|
| | 342 | | If A is an appropriate initial value (see 2.2.3), |
| | 343 | | Then |
| | 344 | | For i = 1 to n |
| | 345 | | P[i] = R[i] |
| | 346 | | Else |
| | 347 | | Return an error |
| | 348 | | */ |
| | 349 | |
|
| | 350 | | // A = C[0] |
| 24 | 351 | | byte[] a = new byte[BlockSizeInBytes]; |
| | 352 | |
|
| 24 | 353 | | Array.Copy( inputBuffer, inputOffset, a, 0, BlockSizeInBytes ); |
| | 354 | |
|
| | 355 | | // The number of input blocks |
| 24 | 356 | | var n = ( inputCount - BlockSizeInBytes ) >> 3; |
| | 357 | |
|
| | 358 | | // The set of input blocks |
| 24 | 359 | | byte[] r = new byte[n << 3]; |
| | 360 | |
|
| 24 | 361 | | Array.Copy( inputBuffer, inputOffset + BlockSizeInBytes, r, 0, inputCount - BlockSizeInBytes ); |
| | 362 | |
|
| 24 | 363 | | var encryptor = _aes.CreateDecryptor(); |
| 24 | 364 | | byte[] block = new byte[16]; |
| | 365 | |
|
| | 366 | | // Calculate intermediate values |
| 336 | 367 | | for ( var j = 5; j >= 0; j-- ) |
| | 368 | | { |
| 864 | 369 | | for ( var i = n; i > 0; i-- ) |
| | 370 | | { |
| | 371 | | // T = ( n * j ) + i |
| 288 | 372 | | var t = (ulong)( ( n * j ) + i ); |
| | 373 | |
|
| | 374 | | // B = AES-1(K, (A ^ t) | R[i] ) |
| | 375 | |
|
| | 376 | | // First, A = ( A ^ t ) |
| 288 | 377 | | a.Xor( GetBytes( t ), true ); |
| | 378 | |
|
| | 379 | | // Second, block = ( A | R[i] ) |
| 288 | 380 | | Array.Copy( a, block, BlockSizeInBytes ); |
| 288 | 381 | | Array.Copy( r, ( i - 1 ) << 3, block, BlockSizeInBytes, BlockSizeInBytes ); |
| | 382 | |
|
| | 383 | | // Third, b = AES-1( block ) |
| 288 | 384 | | var b = encryptor.TransformFinalBlock( block, 0, 16 ); |
| | 385 | |
|
| | 386 | | // A = MSB(64, B) |
| 288 | 387 | | Array.Copy( b, a, BlockSizeInBytes ); |
| | 388 | |
|
| | 389 | | // R[i] = LSB(64, B) |
| 288 | 390 | | Array.Copy( b, BlockSizeInBytes, r, ( i - 1 ) << 3, BlockSizeInBytes ); |
| | 391 | | } |
| | 392 | | } |
| | 393 | |
|
| 24 | 394 | | if ( a.SequenceEqualConstantTime( _iv ) ) |
| | 395 | | { |
| 24 | 396 | | var c = new byte[n << 3]; |
| | 397 | |
|
| 144 | 398 | | for ( var i = 0; i < n; i++ ) |
| | 399 | | { |
| 48 | 400 | | Array.Copy( r, i << 3, c, i << 3, 8 ); |
| | 401 | | } |
| | 402 | |
|
| 24 | 403 | | return c; |
| | 404 | | } |
| | 405 | | else |
| | 406 | | { |
| 0 | 407 | | throw new CryptographicException( "Data is not authentic" ); |
| | 408 | | } |
| | 409 | | } |
| | 410 | |
|
| | 411 | | public void Dispose() |
| | 412 | | { |
| 24 | 413 | | Dispose( true ); |
| 24 | 414 | | GC.SuppressFinalize( this ); |
| 24 | 415 | | } |
| | 416 | |
|
| | 417 | | protected virtual void Dispose( bool disposing ) |
| | 418 | | { |
| 24 | 419 | | if ( disposing ) |
| | 420 | | { |
| 24 | 421 | | if ( _aes != null ) |
| | 422 | | { |
| 24 | 423 | | _aes.Dispose(); |
| 24 | 424 | | _aes = null; |
| | 425 | | } |
| | 426 | | } |
| 24 | 427 | | } |
| | 428 | | } |
| | 429 | | } |
| | 430 | | } |