| | | 1 | | // Copyright (c) Microsoft Corporation. All rights reserved. |
| | | 2 | | // Licensed under the MIT License. See License.txt in the project root for |
| | | 3 | | // license information. |
| | | 4 | | |
| | | 5 | | using System; |
| | | 6 | | using System.Security.Cryptography; |
| | | 7 | | |
| | | 8 | | namespace Microsoft.Azure.KeyVault.Cryptography.Algorithms |
| | | 9 | | { |
| | | 10 | | /// <summary> |
| | | 11 | | /// Abstract AES Key Wrap algoritm. |
| | | 12 | | /// </summary> |
| | | 13 | | public abstract class AesKw : KeyWrapAlgorithm |
| | | 14 | | { |
| | | 15 | | const int BlockSizeInBits = 64; |
| | | 16 | | const int BlockSizeInBytes = BlockSizeInBits >> 3; |
| | | 17 | | |
| | 2 | 18 | | static readonly byte[] _defaultIv = new byte[] { 0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6 }; |
| | | 19 | | |
| | 2 | 20 | | protected static RandomNumberGenerator Rng = RandomNumberGenerator.Create(); |
| | | 21 | | |
| | | 22 | | internal static Aes Create( byte[] key ) |
| | | 23 | | { |
| | 48 | 24 | | var aes = Aes.Create(); |
| | | 25 | | |
| | 48 | 26 | | aes.Mode = CipherMode.ECB; |
| | 48 | 27 | | aes.Padding = PaddingMode.None; |
| | 48 | 28 | | aes.KeySize = key.Length * 8; |
| | 48 | 29 | | aes.Key = key; |
| | | 30 | | |
| | 48 | 31 | | return aes; |
| | | 32 | | } |
| | | 33 | | |
| | 18 | 34 | | protected AesKw( string name ) : base( name ) |
| | | 35 | | { |
| | | 36 | | |
| | 18 | 37 | | } |
| | | 38 | | |
| | | 39 | | public ICryptoTransform CreateEncryptor( byte[] key ) |
| | | 40 | | { |
| | 12 | 41 | | return CreateEncryptor( key, null ); |
| | | 42 | | } |
| | | 43 | | |
| | | 44 | | public override ICryptoTransform CreateEncryptor( byte[] key, byte[] iv ) |
| | | 45 | | { |
| | 24 | 46 | | if ( key == null ) |
| | 0 | 47 | | throw new ArgumentNullException( "key" ); |
| | | 48 | | |
| | 24 | 49 | | if ( key.Length != 128 >> 3 && key.Length != 192 >> 3 && key.Length != 256 >> 3 ) |
| | 0 | 50 | | throw new ArgumentException( "key length must be 128, 192 or 256 bits" ); |
| | | 51 | | |
| | 24 | 52 | | if ( iv != null && iv.Length != 8 ) |
| | 0 | 53 | | throw new ArgumentException( "iv length must be 64 bits" ); |
| | | 54 | | |
| | 24 | 55 | | return new AesKwEncryptor( key, iv ?? DefaultIv ); |
| | | 56 | | } |
| | | 57 | | |
| | | 58 | | public ICryptoTransform CreateDecryptor( byte[] key ) |
| | | 59 | | { |
| | 12 | 60 | | return CreateDecryptor( key, null ); |
| | | 61 | | } |
| | | 62 | | |
| | | 63 | | public override ICryptoTransform CreateDecryptor( byte[] key, byte[] iv) |
| | | 64 | | { |
| | 24 | 65 | | if ( key == null ) |
| | 0 | 66 | | throw new ArgumentNullException( "key" ); |
| | | 67 | | |
| | 24 | 68 | | if ( key.Length != 128 >> 3 && key.Length != 192 >> 3 && key.Length != 256 >> 3 ) |
| | 0 | 69 | | throw new ArgumentException( "key length must be 128, 192 or 256 bits" ); |
| | | 70 | | |
| | 24 | 71 | | if ( iv != null && iv.Length != 8 ) |
| | 0 | 72 | | throw new ArgumentException( "iv length must be 64 bits" ); |
| | | 73 | | |
| | 24 | 74 | | return new AesKwDecryptor( key, iv ?? DefaultIv ); |
| | | 75 | | } |
| | | 76 | | |
| | | 77 | | private static byte[] DefaultIv |
| | | 78 | | { |
| | 48 | 79 | | get { return (byte[])_defaultIv.Clone(); } |
| | | 80 | | } |
| | | 81 | | |
| | | 82 | | static byte[] GetBytes( UInt64 i ) |
| | | 83 | | { |
| | 576 | 84 | | byte[] temp = BitConverter.GetBytes( i ); |
| | | 85 | | |
| | 576 | 86 | | if ( BitConverter.IsLittleEndian ) |
| | | 87 | | { |
| | 576 | 88 | | Array.Reverse( temp ); |
| | | 89 | | } |
| | | 90 | | |
| | 576 | 91 | | return temp; |
| | | 92 | | } |
| | | 93 | | |
| | | 94 | | class AesKwEncryptor : ICryptoTransform |
| | | 95 | | { |
| | | 96 | | private Aes _aes; |
| | | 97 | | private byte[] _iv; |
| | | 98 | | |
| | 24 | 99 | | internal AesKwEncryptor( byte[] keyBytes, byte[] iv ) |
| | | 100 | | { |
| | | 101 | | // Create the AES provider |
| | 24 | 102 | | _aes = AesKw.Create( keyBytes ); |
| | | 103 | | |
| | | 104 | | // Set the AES IV to Zeroes |
| | 24 | 105 | | var aesIv = new byte[_aes.BlockSize >> 3]; |
| | | 106 | | |
| | 24 | 107 | | aesIv.Zero(); |
| | | 108 | | |
| | 24 | 109 | | _aes.IV = aesIv; |
| | | 110 | | |
| | | 111 | | // Remember the real IV |
| | 24 | 112 | | _iv = iv.Clone() as byte[]; |
| | 24 | 113 | | } |
| | | 114 | | |
| | | 115 | | public bool CanReuseTransform |
| | | 116 | | { |
| | 0 | 117 | | get { throw new NotImplementedException(); } |
| | | 118 | | } |
| | | 119 | | |
| | | 120 | | public bool CanTransformMultipleBlocks |
| | | 121 | | { |
| | 0 | 122 | | get { throw new NotImplementedException(); } |
| | | 123 | | } |
| | | 124 | | |
| | | 125 | | public int InputBlockSize |
| | | 126 | | { |
| | 0 | 127 | | get { throw new NotImplementedException(); } |
| | | 128 | | } |
| | | 129 | | |
| | | 130 | | public int OutputBlockSize |
| | | 131 | | { |
| | 0 | 132 | | get { throw new NotImplementedException(); } |
| | | 133 | | } |
| | | 134 | | |
| | | 135 | | public int TransformBlock( byte[] inputBuffer, int inputOffset, int inputCount, byte[] outputBuffer, int out |
| | | 136 | | { |
| | | 137 | | // No support for block-by-block transformation |
| | 0 | 138 | | throw new NotImplementedException(); |
| | | 139 | | } |
| | | 140 | | |
| | | 141 | | public byte[] TransformFinalBlock( byte[] inputBuffer, int inputOffset, int inputCount ) |
| | | 142 | | { |
| | 24 | 143 | | if ( inputBuffer == null ) |
| | 0 | 144 | | throw new ArgumentNullException( "inputBuffer" ); |
| | | 145 | | |
| | 24 | 146 | | if ( inputBuffer.Length == 0 ) |
| | 0 | 147 | | throw new ArgumentNullException( "inputBuffer", "The length of the inputBuffer parameter cannot be z |
| | | 148 | | |
| | 24 | 149 | | if ( inputCount <= 0 ) |
| | 0 | 150 | | throw new ArgumentOutOfRangeException( "inputCount", "The inputCount parameter must not be zero or n |
| | | 151 | | |
| | 24 | 152 | | if ( inputCount % 8 != 0 ) |
| | 0 | 153 | | throw new ArgumentOutOfRangeException( "inputCount", "The inputCount parameter must be a multiple of |
| | | 154 | | |
| | 24 | 155 | | if ( inputOffset < 0 ) |
| | 0 | 156 | | throw new ArgumentOutOfRangeException( "inputOffset", "The inputOffset parameter must not be negativ |
| | | 157 | | |
| | 24 | 158 | | if ( inputOffset + inputCount > inputBuffer.Length ) |
| | 0 | 159 | | throw new ArgumentOutOfRangeException( "inputCount", "The sum of inputCount and inputOffset paramete |
| | | 160 | | |
| | | 161 | | |
| | | 162 | | /* |
| | | 163 | | 1) Initialize variables. |
| | | 164 | | |
| | | 165 | | Set A = IV, an initial value (see 2.2.3) |
| | | 166 | | For i = 1 to n |
| | | 167 | | R[i] = P[i] |
| | | 168 | | |
| | | 169 | | 2) Calculate intermediate values. |
| | | 170 | | |
| | | 171 | | For j = 0 to 5 |
| | | 172 | | For i=1 to n |
| | | 173 | | B = AES(K, A | R[i]) |
| | | 174 | | A = MSB(64, B) ^ t where t = (n*j)+i |
| | | 175 | | R[i] = LSB(64, B) |
| | | 176 | | |
| | | 177 | | 3) Output the results. |
| | | 178 | | |
| | | 179 | | Set C[0] = A |
| | | 180 | | For i = 1 to n |
| | | 181 | | C[i] = R[i] |
| | | 182 | | */ |
| | | 183 | | |
| | | 184 | | // The default initialization vector from RFC3394 |
| | 24 | 185 | | byte[] a = _iv; |
| | | 186 | | |
| | | 187 | | // The number of input blocks |
| | 24 | 188 | | var n = inputCount >> 3; |
| | | 189 | | |
| | | 190 | | // The set of input blocks |
| | 24 | 191 | | byte[] r = new byte[n << 3]; |
| | | 192 | | |
| | 24 | 193 | | Array.Copy( inputBuffer, inputOffset, r, 0, inputCount ); |
| | | 194 | | |
| | 24 | 195 | | var encryptor = _aes.CreateEncryptor(); |
| | 24 | 196 | | byte[] block = new byte[16]; |
| | | 197 | | |
| | | 198 | | // Calculate intermediate values |
| | 336 | 199 | | for ( var j = 0; j < 6; j++ ) |
| | | 200 | | { |
| | 864 | 201 | | for ( var i = 0; i < n; i++ ) |
| | | 202 | | { |
| | | 203 | | // T = ( n * j ) + i |
| | 288 | 204 | | var t = (ulong)( ( n * j ) + i + 1 ); |
| | | 205 | | |
| | | 206 | | // B = AES( K, A | R[i] ) |
| | | 207 | | |
| | | 208 | | // First, block = A | R[i] |
| | 288 | 209 | | Array.Copy( a, block, a.Length ); |
| | 288 | 210 | | Array.Copy( r, i << 3, block, 64 >> 3, 64 >> 3 ); |
| | | 211 | | |
| | | 212 | | // Second, AES( K, block ) |
| | 288 | 213 | | var b = encryptor.TransformFinalBlock( block, 0, 16 ); |
| | | 214 | | |
| | | 215 | | // A = MSB( 64, B ) |
| | 288 | 216 | | Array.Copy( b, a, 64 >> 3 ); |
| | | 217 | | |
| | | 218 | | // A = A ^ t |
| | 288 | 219 | | a.Xor( GetBytes( t ), true ); |
| | | 220 | | |
| | | 221 | | // R[i] = LSB( 64, B ) |
| | 288 | 222 | | Array.Copy( b, 64 >> 3, r, i << 3, 64 >> 3 ); |
| | | 223 | | } |
| | | 224 | | } |
| | | 225 | | |
| | 24 | 226 | | var c = new byte[( n + 1 ) << 3]; |
| | | 227 | | |
| | 24 | 228 | | Array.Copy( a, c, a.Length ); |
| | | 229 | | |
| | 144 | 230 | | for ( var i = 0; i < n; i++ ) |
| | | 231 | | { |
| | 48 | 232 | | Array.Copy( r, i << 3, c, ( i + 1 ) << 3, 8 ); |
| | | 233 | | } |
| | | 234 | | |
| | 24 | 235 | | return c; |
| | | 236 | | } |
| | | 237 | | |
| | | 238 | | public void Dispose() |
| | | 239 | | { |
| | 24 | 240 | | Dispose( true ); |
| | 24 | 241 | | GC.SuppressFinalize( this ); |
| | 24 | 242 | | } |
| | | 243 | | |
| | | 244 | | protected virtual void Dispose( bool disposing ) |
| | | 245 | | { |
| | 24 | 246 | | if ( disposing ) |
| | | 247 | | { |
| | 24 | 248 | | if ( _aes != null ) |
| | | 249 | | { |
| | 24 | 250 | | _aes.Dispose(); |
| | 24 | 251 | | _aes = null; |
| | | 252 | | } |
| | | 253 | | } |
| | 24 | 254 | | } |
| | | 255 | | } |
| | | 256 | | |
| | | 257 | | class AesKwDecryptor : ICryptoTransform |
| | | 258 | | { |
| | | 259 | | private Aes _aes; |
| | | 260 | | private byte[] _iv; |
| | | 261 | | |
| | 24 | 262 | | internal AesKwDecryptor( byte[] keyBytes, byte[] iv ) |
| | | 263 | | { |
| | | 264 | | // Create the AES provider |
| | 24 | 265 | | _aes = AesKw.Create( keyBytes ); |
| | | 266 | | |
| | | 267 | | // Set the AES IV to Zeroes |
| | 24 | 268 | | var aesIv = new byte[_aes.BlockSize >> 3]; |
| | | 269 | | |
| | 24 | 270 | | aesIv.Zero(); |
| | | 271 | | |
| | 24 | 272 | | _aes.IV = aesIv; |
| | | 273 | | |
| | | 274 | | // Remember the real IV |
| | 24 | 275 | | _iv = iv.Clone() as byte[]; |
| | 24 | 276 | | } |
| | | 277 | | |
| | | 278 | | public bool CanReuseTransform |
| | | 279 | | { |
| | 0 | 280 | | get { throw new NotImplementedException(); } |
| | | 281 | | } |
| | | 282 | | |
| | | 283 | | public bool CanTransformMultipleBlocks |
| | | 284 | | { |
| | 0 | 285 | | get { throw new NotImplementedException(); } |
| | | 286 | | } |
| | | 287 | | |
| | | 288 | | public int InputBlockSize |
| | | 289 | | { |
| | 0 | 290 | | get { throw new NotImplementedException(); } |
| | | 291 | | } |
| | | 292 | | |
| | | 293 | | public int OutputBlockSize |
| | | 294 | | { |
| | 0 | 295 | | get { throw new NotImplementedException(); } |
| | | 296 | | } |
| | | 297 | | |
| | | 298 | | public int TransformBlock( byte[] inputBuffer, int inputOffset, int inputCount, byte[] outputBuffer, int out |
| | | 299 | | { |
| | | 300 | | // No support for block-by-block transformation |
| | 0 | 301 | | throw new NotImplementedException(); |
| | | 302 | | } |
| | | 303 | | |
| | | 304 | | public byte[] TransformFinalBlock( byte[] inputBuffer, int inputOffset, int inputCount ) |
| | | 305 | | { |
| | 24 | 306 | | if ( inputBuffer == null ) |
| | 0 | 307 | | throw new ArgumentNullException( "inputBuffer" ); |
| | | 308 | | |
| | 24 | 309 | | if ( inputBuffer.Length == 0 ) |
| | 0 | 310 | | throw new ArgumentNullException( "inputBuffer", "The length of the inputBuffer parameter cannot be z |
| | | 311 | | |
| | 24 | 312 | | if ( inputCount <= 0 ) |
| | 0 | 313 | | throw new ArgumentOutOfRangeException( "inputCount", "The inputCount parameter must not be zero or n |
| | | 314 | | |
| | 24 | 315 | | if ( inputCount % 8 != 0 ) |
| | 0 | 316 | | throw new ArgumentOutOfRangeException( "inputCount", "The inputCount parameter must be a multiple of |
| | | 317 | | |
| | 24 | 318 | | if ( inputOffset < 0 ) |
| | 0 | 319 | | throw new ArgumentOutOfRangeException( "inputOffset", "The inputOffset parameter must not be negativ |
| | | 320 | | |
| | 24 | 321 | | if ( inputOffset + inputCount > inputBuffer.Length ) |
| | 0 | 322 | | throw new ArgumentOutOfRangeException( "inputCount", "The sum of inputCount and inputOffset paramete |
| | | 323 | | |
| | | 324 | | |
| | | 325 | | /* |
| | | 326 | | 1) Initialize variables. |
| | | 327 | | |
| | | 328 | | Set A = C[0] |
| | | 329 | | For i = 1 to n |
| | | 330 | | R[i] = C[i] |
| | | 331 | | |
| | | 332 | | 2) Compute intermediate values. |
| | | 333 | | |
| | | 334 | | For j = 5 to 0 |
| | | 335 | | For i = n to 1 |
| | | 336 | | B = AES-1(K, (A ^ t) | R[i]) where t = n*j+i |
| | | 337 | | A = MSB(64, B) |
| | | 338 | | R[i] = LSB(64, B) |
| | | 339 | | |
| | | 340 | | 3) Output results. |
| | | 341 | | |
| | | 342 | | If A is an appropriate initial value (see 2.2.3), |
| | | 343 | | Then |
| | | 344 | | For i = 1 to n |
| | | 345 | | P[i] = R[i] |
| | | 346 | | Else |
| | | 347 | | Return an error |
| | | 348 | | */ |
| | | 349 | | |
| | | 350 | | // A = C[0] |
| | 24 | 351 | | byte[] a = new byte[BlockSizeInBytes]; |
| | | 352 | | |
| | 24 | 353 | | Array.Copy( inputBuffer, inputOffset, a, 0, BlockSizeInBytes ); |
| | | 354 | | |
| | | 355 | | // The number of input blocks |
| | 24 | 356 | | var n = ( inputCount - BlockSizeInBytes ) >> 3; |
| | | 357 | | |
| | | 358 | | // The set of input blocks |
| | 24 | 359 | | byte[] r = new byte[n << 3]; |
| | | 360 | | |
| | 24 | 361 | | Array.Copy( inputBuffer, inputOffset + BlockSizeInBytes, r, 0, inputCount - BlockSizeInBytes ); |
| | | 362 | | |
| | 24 | 363 | | var encryptor = _aes.CreateDecryptor(); |
| | 24 | 364 | | byte[] block = new byte[16]; |
| | | 365 | | |
| | | 366 | | // Calculate intermediate values |
| | 336 | 367 | | for ( var j = 5; j >= 0; j-- ) |
| | | 368 | | { |
| | 864 | 369 | | for ( var i = n; i > 0; i-- ) |
| | | 370 | | { |
| | | 371 | | // T = ( n * j ) + i |
| | 288 | 372 | | var t = (ulong)( ( n * j ) + i ); |
| | | 373 | | |
| | | 374 | | // B = AES-1(K, (A ^ t) | R[i] ) |
| | | 375 | | |
| | | 376 | | // First, A = ( A ^ t ) |
| | 288 | 377 | | a.Xor( GetBytes( t ), true ); |
| | | 378 | | |
| | | 379 | | // Second, block = ( A | R[i] ) |
| | 288 | 380 | | Array.Copy( a, block, BlockSizeInBytes ); |
| | 288 | 381 | | Array.Copy( r, ( i - 1 ) << 3, block, BlockSizeInBytes, BlockSizeInBytes ); |
| | | 382 | | |
| | | 383 | | // Third, b = AES-1( block ) |
| | 288 | 384 | | var b = encryptor.TransformFinalBlock( block, 0, 16 ); |
| | | 385 | | |
| | | 386 | | // A = MSB(64, B) |
| | 288 | 387 | | Array.Copy( b, a, BlockSizeInBytes ); |
| | | 388 | | |
| | | 389 | | // R[i] = LSB(64, B) |
| | 288 | 390 | | Array.Copy( b, BlockSizeInBytes, r, ( i - 1 ) << 3, BlockSizeInBytes ); |
| | | 391 | | } |
| | | 392 | | } |
| | | 393 | | |
| | 24 | 394 | | if ( a.SequenceEqualConstantTime( _iv ) ) |
| | | 395 | | { |
| | 24 | 396 | | var c = new byte[n << 3]; |
| | | 397 | | |
| | 144 | 398 | | for ( var i = 0; i < n; i++ ) |
| | | 399 | | { |
| | 48 | 400 | | Array.Copy( r, i << 3, c, i << 3, 8 ); |
| | | 401 | | } |
| | | 402 | | |
| | 24 | 403 | | return c; |
| | | 404 | | } |
| | | 405 | | else |
| | | 406 | | { |
| | 0 | 407 | | throw new CryptographicException( "Data is not authentic" ); |
| | | 408 | | } |
| | | 409 | | } |
| | | 410 | | |
| | | 411 | | public void Dispose() |
| | | 412 | | { |
| | 24 | 413 | | Dispose( true ); |
| | 24 | 414 | | GC.SuppressFinalize( this ); |
| | 24 | 415 | | } |
| | | 416 | | |
| | | 417 | | protected virtual void Dispose( bool disposing ) |
| | | 418 | | { |
| | 24 | 419 | | if ( disposing ) |
| | | 420 | | { |
| | 24 | 421 | | if ( _aes != null ) |
| | | 422 | | { |
| | 24 | 423 | | _aes.Dispose(); |
| | 24 | 424 | | _aes = null; |
| | | 425 | | } |
| | | 426 | | } |
| | 24 | 427 | | } |
| | | 428 | | } |
| | | 429 | | } |
| | | 430 | | } |