| | | 1 | | // Copyright (c) Microsoft Corporation. All rights reserved. |
| | | 2 | | // Licensed under the MIT License. See License.txt in the project root for |
| | | 3 | | // license information. |
| | | 4 | | |
| | | 5 | | using System; |
| | | 6 | | using System.Security.Cryptography; |
| | | 7 | | using System.Threading; |
| | | 8 | | using System.Threading.Tasks; |
| | | 9 | | using Microsoft.Azure.KeyVault.Core; |
| | | 10 | | using Microsoft.Azure.KeyVault.Cryptography; |
| | | 11 | | using Microsoft.Azure.KeyVault.Cryptography.Algorithms; |
| | | 12 | | |
| | | 13 | | #if NETSTANDARD |
| | | 14 | | using TaskException = System.Threading.Tasks.Task; |
| | | 15 | | #endif |
| | | 16 | | |
| | | 17 | | namespace Microsoft.Azure.KeyVault |
| | | 18 | | { |
| | | 19 | | /// <summary> |
| | | 20 | | /// An RSA key. |
| | | 21 | | /// </summary> |
| | | 22 | | public class RsaKey : IKey, IDisposable |
| | | 23 | | { |
| | | 24 | | public const int KeySize1024 = 1024; |
| | | 25 | | public const int KeySize2048 = 2048; |
| | | 26 | | |
| | 2 | 27 | | private static readonly int DefaultKeySize = KeySize2048; |
| | | 28 | | |
| | | 29 | | private RSA _csp; |
| | | 30 | | |
| | | 31 | | /// <summary> |
| | | 32 | | /// Key Identifier |
| | | 33 | | /// </summary> |
| | 98 | 34 | | public string Kid { get; private set; } |
| | | 35 | | |
| | | 36 | | /// <summary> |
| | | 37 | | /// Constructor, creates a 2048 bit key with a GUID identifier. |
| | | 38 | | /// </summary> |
| | 0 | 39 | | public RsaKey() : this( Guid.NewGuid().ToString( "D" ), DefaultKeySize ) |
| | | 40 | | { |
| | 0 | 41 | | } |
| | | 42 | | |
| | | 43 | | /// <summary> |
| | | 44 | | /// Constructor, creates a 2048 bit RSA key. |
| | | 45 | | /// </summary> |
| | | 46 | | /// <param name="kid">The key identifier to use</param> |
| | 26 | 47 | | public RsaKey( string kid ) : this( kid, DefaultKeySize ) |
| | | 48 | | { |
| | 26 | 49 | | } |
| | | 50 | | |
| | | 51 | | /// <summary> |
| | | 52 | | /// Constructor. |
| | | 53 | | /// </summary> |
| | | 54 | | /// <param name="kid">The key identifier to use</param> |
| | | 55 | | /// <param name="keySize">The size of the key</param> |
| | 26 | 56 | | public RsaKey( string kid, int keySize ) |
| | | 57 | | { |
| | 26 | 58 | | if ( string.IsNullOrWhiteSpace( kid ) ) |
| | 0 | 59 | | throw new ArgumentNullException( "kid" ); |
| | | 60 | | |
| | 26 | 61 | | Kid = kid; |
| | | 62 | | |
| | 26 | 63 | | _csp = RSA.Create(); |
| | | 64 | | |
| | 26 | 65 | | _csp.KeySize = keySize; |
| | 26 | 66 | | } |
| | | 67 | | |
| | | 68 | | /// <summary> |
| | | 69 | | /// Constructor |
| | | 70 | | /// </summary> |
| | | 71 | | /// <param name="kid">The key identifier to use</param> |
| | | 72 | | /// <param name="keyParameters">The RSA parameters for the key</param> |
| | 0 | 73 | | public RsaKey( string kid, RSAParameters keyParameters ) |
| | | 74 | | { |
| | 0 | 75 | | if ( string.IsNullOrWhiteSpace( kid ) ) |
| | 0 | 76 | | throw new ArgumentNullException( "kid" ); |
| | | 77 | | |
| | 0 | 78 | | Kid = kid; |
| | | 79 | | |
| | 0 | 80 | | _csp = RSA.Create(); |
| | 0 | 81 | | _csp.ImportParameters( keyParameters ); |
| | 0 | 82 | | } |
| | | 83 | | |
| | | 84 | | /// <summary> |
| | | 85 | | /// Constructor. |
| | | 86 | | /// </summary> |
| | | 87 | | /// <param name="kid">The key identifier to use</param> |
| | | 88 | | /// <param name="csp">The RSA object for the key</param> |
| | | 89 | | /// <remarks>The RSA object is IDisposable, this class will hold a |
| | | 90 | | /// reference to the RSA object but will not dispose it, the caller |
| | | 91 | | /// of this constructor is responsible for the lifetime of this |
| | | 92 | | /// parameter.</remarks> |
| | 16 | 93 | | public RsaKey( string kid, RSA csp ) |
| | | 94 | | { |
| | 16 | 95 | | if ( string.IsNullOrWhiteSpace( kid ) ) |
| | 0 | 96 | | throw new ArgumentNullException( "kid" ); |
| | | 97 | | |
| | 16 | 98 | | if ( csp == null ) |
| | 0 | 99 | | throw new ArgumentNullException( "csp" ); |
| | | 100 | | |
| | 16 | 101 | | Kid = kid; |
| | | 102 | | |
| | | 103 | | // NOTE: RSA is disposable and that may lead to runtime errors later. |
| | 16 | 104 | | _csp = csp; |
| | 16 | 105 | | } |
| | | 106 | | |
| | | 107 | | // Intentionally excluded. |
| | | 108 | | //~RsaKey() |
| | | 109 | | //{ |
| | | 110 | | // Dispose( false ); |
| | | 111 | | //} |
| | | 112 | | |
| | | 113 | | public void Dispose() |
| | | 114 | | { |
| | 14 | 115 | | Dispose( true ); |
| | 14 | 116 | | GC.SuppressFinalize( this ); |
| | 14 | 117 | | } |
| | | 118 | | |
| | | 119 | | protected virtual void Dispose( bool disposing ) |
| | | 120 | | { |
| | | 121 | | // Clean up managed resources if Dispose was called |
| | 14 | 122 | | if ( disposing ) |
| | | 123 | | { |
| | 14 | 124 | | if ( _csp != null ) |
| | | 125 | | { |
| | 14 | 126 | | _csp.Dispose(); |
| | 14 | 127 | | _csp = null; |
| | | 128 | | } |
| | | 129 | | } |
| | | 130 | | |
| | | 131 | | // Clean up native resources always |
| | 14 | 132 | | } |
| | | 133 | | |
| | | 134 | | #region IKey implementation |
| | | 135 | | |
| | | 136 | | public string DefaultEncryptionAlgorithm |
| | | 137 | | { |
| | 6 | 138 | | get { return RsaOaep.AlgorithmName; } |
| | | 139 | | } |
| | | 140 | | |
| | | 141 | | public string DefaultKeyWrapAlgorithm |
| | | 142 | | { |
| | 6 | 143 | | get { return RsaOaep.AlgorithmName; } |
| | | 144 | | } |
| | | 145 | | |
| | | 146 | | public string DefaultSignatureAlgorithm |
| | | 147 | | { |
| | 2 | 148 | | get { return Rs256.AlgorithmName; } |
| | | 149 | | } |
| | | 150 | | |
| | | 151 | | public Task<byte[]> DecryptAsync( byte[] ciphertext, byte[] iv, byte[] authenticationData = null, byte[] authent |
| | | 152 | | { |
| | 6 | 153 | | if ( _csp == null ) |
| | 0 | 154 | | throw new ObjectDisposedException( string.Format( "RsaKey {0} is disposed", Kid ) ); |
| | | 155 | | |
| | 6 | 156 | | if ( string.IsNullOrWhiteSpace( algorithm ) ) |
| | 2 | 157 | | algorithm = DefaultEncryptionAlgorithm; |
| | | 158 | | |
| | 6 | 159 | | if ( ciphertext == null || ciphertext.Length == 0 ) |
| | 0 | 160 | | throw new ArgumentNullException( "ciphertext" ); |
| | | 161 | | |
| | 6 | 162 | | if ( iv != null ) |
| | 0 | 163 | | throw new ArgumentException( "Initialization vector must be null", "iv" ); |
| | | 164 | | |
| | 6 | 165 | | if ( authenticationData != null ) |
| | 0 | 166 | | throw new ArgumentException( "Authentication data must be null", "authenticationData" ); |
| | | 167 | | |
| | | 168 | | // TODO: Not available via the RSA class |
| | | 169 | | //if ( _csp.PublicOnly ) |
| | | 170 | | // throw new NotSupportedException( "Decrypt is not supported because no private key is available" ); |
| | | 171 | | |
| | 6 | 172 | | AsymmetricEncryptionAlgorithm algo = AlgorithmResolver.Default[algorithm] as AsymmetricEncryptionAlgorithm; |
| | | 173 | | |
| | 6 | 174 | | if ( algo == null ) |
| | 0 | 175 | | throw new NotSupportedException( "algorithm is not supported" ); |
| | | 176 | | |
| | 6 | 177 | | using ( var encryptor = algo.CreateDecryptor( _csp ) ) |
| | | 178 | | { |
| | | 179 | | try |
| | | 180 | | { |
| | 6 | 181 | | var result = encryptor.TransformFinalBlock( ciphertext, 0, ciphertext.Length ); |
| | | 182 | | |
| | 6 | 183 | | return Task.FromResult( result ); |
| | | 184 | | } |
| | | 185 | | catch ( Exception ex ) |
| | | 186 | | { |
| | 0 | 187 | | return TaskException.FromException<byte[]>( ex ); |
| | | 188 | | } |
| | | 189 | | } |
| | 6 | 190 | | } |
| | | 191 | | |
| | | 192 | | public Task<Tuple<byte[], byte[], string>> EncryptAsync( byte[] plaintext, byte[] iv = null, byte[] authenticati |
| | | 193 | | { |
| | 6 | 194 | | if ( _csp == null ) |
| | 0 | 195 | | throw new ObjectDisposedException( string.Format( "RsaKey {0} is disposed", Kid ) ); |
| | | 196 | | |
| | 6 | 197 | | if ( string.IsNullOrWhiteSpace( algorithm ) ) |
| | 2 | 198 | | algorithm = DefaultEncryptionAlgorithm; |
| | | 199 | | |
| | 6 | 200 | | if ( plaintext == null || plaintext.Length == 0 ) |
| | 0 | 201 | | throw new ArgumentNullException( "plaintext" ); |
| | | 202 | | |
| | 6 | 203 | | if ( iv != null ) |
| | 0 | 204 | | throw new ArgumentException( "Initialization vector must be null", "iv" ); |
| | | 205 | | |
| | 6 | 206 | | if ( authenticationData != null ) |
| | 0 | 207 | | throw new ArgumentException( "Authentication data must be null", "authenticationData" ); |
| | | 208 | | |
| | 6 | 209 | | AsymmetricEncryptionAlgorithm algo = AlgorithmResolver.Default[algorithm] as AsymmetricEncryptionAlgorithm; |
| | | 210 | | |
| | 6 | 211 | | if ( algo == null ) |
| | 0 | 212 | | throw new NotSupportedException( "algorithm is not supported" ); |
| | | 213 | | |
| | 6 | 214 | | using ( var encryptor = algo.CreateEncryptor( _csp ) ) |
| | | 215 | | { |
| | | 216 | | try |
| | | 217 | | { |
| | 6 | 218 | | var result = new Tuple<byte[], byte[], string>( encryptor.TransformFinalBlock( plaintext, 0, plainte |
| | | 219 | | |
| | 6 | 220 | | return Task.FromResult( result ); |
| | | 221 | | } |
| | | 222 | | catch ( Exception ex ) |
| | | 223 | | { |
| | 0 | 224 | | return TaskException.FromException<Tuple<byte[], byte[], string>>( ex ); |
| | | 225 | | } |
| | | 226 | | } |
| | 6 | 227 | | } |
| | | 228 | | |
| | | 229 | | public Task<Tuple<byte[], string>> WrapKeyAsync( byte[] key, string algorithm = RsaOaep.AlgorithmName, Cancellat |
| | | 230 | | { |
| | 6 | 231 | | if ( _csp == null ) |
| | 0 | 232 | | throw new ObjectDisposedException( string.Format( "RsaKey {0} is disposed", Kid ) ); |
| | | 233 | | |
| | 6 | 234 | | if ( string.IsNullOrWhiteSpace( algorithm ) ) |
| | 2 | 235 | | algorithm = DefaultKeyWrapAlgorithm; |
| | | 236 | | |
| | 6 | 237 | | if ( key == null || key.Length == 0 ) |
| | 0 | 238 | | throw new ArgumentNullException( "key" ); |
| | | 239 | | |
| | 6 | 240 | | AsymmetricEncryptionAlgorithm algo = AlgorithmResolver.Default[algorithm] as AsymmetricEncryptionAlgorithm; |
| | | 241 | | |
| | 6 | 242 | | if ( algo == null ) |
| | 0 | 243 | | throw new NotSupportedException( "algorithm is not supported" ); |
| | | 244 | | |
| | 6 | 245 | | using ( var encryptor = algo.CreateEncryptor( _csp ) ) |
| | | 246 | | { |
| | | 247 | | try |
| | | 248 | | { |
| | 6 | 249 | | var result = new Tuple<byte[], string>( encryptor.TransformFinalBlock( key, 0, key.Length ), algorit |
| | | 250 | | |
| | 6 | 251 | | return Task.FromResult( result ); |
| | | 252 | | } |
| | | 253 | | catch ( Exception ex ) |
| | | 254 | | { |
| | 0 | 255 | | return TaskException.FromException<Tuple<byte[], string>>( ex ); |
| | | 256 | | } |
| | | 257 | | } |
| | 6 | 258 | | } |
| | | 259 | | |
| | | 260 | | public Task<byte[]> UnwrapKeyAsync( byte[] encryptedKey, string algorithm = RsaOaep.AlgorithmName, CancellationT |
| | | 261 | | { |
| | 6 | 262 | | if ( _csp == null ) |
| | 0 | 263 | | throw new ObjectDisposedException( string.Format( "RsaKey {0} is disposed", Kid ) ); |
| | | 264 | | |
| | 6 | 265 | | if ( string.IsNullOrWhiteSpace( algorithm ) ) |
| | 2 | 266 | | algorithm = DefaultKeyWrapAlgorithm; |
| | | 267 | | |
| | 6 | 268 | | if ( encryptedKey == null || encryptedKey.Length == 0 ) |
| | 0 | 269 | | throw new ArgumentNullException( "encryptedKey" ); |
| | | 270 | | |
| | | 271 | | // TODO: Not available via the RSA class |
| | | 272 | | //if ( _csp.PublicOnly ) |
| | | 273 | | // throw new NotSupportedException( "UnwrapKey is not supported because no private key is available" ); |
| | | 274 | | |
| | 6 | 275 | | AsymmetricEncryptionAlgorithm algo = AlgorithmResolver.Default[algorithm] as AsymmetricEncryptionAlgorithm; |
| | | 276 | | |
| | 6 | 277 | | if ( algo == null ) |
| | 0 | 278 | | throw new NotSupportedException( "algorithm is not supported" ); |
| | | 279 | | |
| | 6 | 280 | | using ( var encryptor = algo.CreateDecryptor( _csp ) ) |
| | | 281 | | { |
| | | 282 | | try |
| | | 283 | | { |
| | 6 | 284 | | var result = encryptor.TransformFinalBlock( encryptedKey, 0, encryptedKey.Length ); |
| | | 285 | | |
| | 6 | 286 | | return Task.FromResult( result ); |
| | | 287 | | } |
| | | 288 | | catch ( Exception ex ) |
| | | 289 | | { |
| | 0 | 290 | | return TaskException.FromException<byte[]>( ex ); |
| | | 291 | | } |
| | | 292 | | } |
| | 6 | 293 | | } |
| | | 294 | | |
| | | 295 | | public Task<Tuple<byte[], string>> SignAsync( byte[] digest, string algorithm, CancellationToken token = default |
| | | 296 | | { |
| | 2 | 297 | | if ( _csp == null ) |
| | 0 | 298 | | throw new ObjectDisposedException( string.Format( "RsaKey {0} is disposed", Kid ) ); |
| | | 299 | | |
| | 2 | 300 | | if ( algorithm == null ) |
| | 0 | 301 | | algorithm = DefaultSignatureAlgorithm; |
| | | 302 | | |
| | 2 | 303 | | if ( digest == null ) |
| | 0 | 304 | | throw new ArgumentNullException( "digest" ); |
| | | 305 | | |
| | | 306 | | // TODO: Not available via the RSA class |
| | | 307 | | //if ( _csp.PublicOnly ) |
| | | 308 | | // throw new NotSupportedException( "Sign is not supported because no private key is available" ); |
| | | 309 | | |
| | 2 | 310 | | AsymmetricSignatureAlgorithm algo = AlgorithmResolver.Default[algorithm] as AsymmetricSignatureAlgorith |
| | 2 | 311 | | ISignatureTransform transform = algo != null ? algo.CreateSignatureTransform( _csp ) : null; |
| | | 312 | | |
| | 2 | 313 | | if ( algo == null || transform == null ) |
| | 0 | 314 | | throw new NotSupportedException( "algorithm is not supported" ); |
| | | 315 | | |
| | | 316 | | try |
| | | 317 | | { |
| | 2 | 318 | | var result = new Tuple<byte[], string>( transform.Sign( digest ), algorithm ); |
| | | 319 | | |
| | 2 | 320 | | return Task.FromResult( result ); |
| | | 321 | | } |
| | | 322 | | catch ( Exception ex ) |
| | | 323 | | { |
| | 0 | 324 | | return TaskException.FromException<Tuple<byte[], string>>( ex ); |
| | | 325 | | } |
| | 2 | 326 | | } |
| | | 327 | | |
| | | 328 | | public Task<bool> VerifyAsync( byte[] digest, byte[] signature, string algorithm, CancellationToken token = defa |
| | | 329 | | { |
| | 4 | 330 | | if ( _csp == null ) |
| | 0 | 331 | | throw new ObjectDisposedException( string.Format( "RsaKey {0} is disposed", Kid ) ); |
| | | 332 | | |
| | 4 | 333 | | if ( digest == null ) |
| | 0 | 334 | | throw new ArgumentNullException( "digest" ); |
| | | 335 | | |
| | 4 | 336 | | if ( signature == null ) |
| | 0 | 337 | | throw new ArgumentNullException( "signature" ); |
| | | 338 | | |
| | 4 | 339 | | if ( algorithm == null ) |
| | 0 | 340 | | algorithm = DefaultSignatureAlgorithm; |
| | | 341 | | |
| | 4 | 342 | | AsymmetricSignatureAlgorithm algo = AlgorithmResolver.Default[algorithm] as AsymmetricSignatureAlgorithm; |
| | 4 | 343 | | ISignatureTransform transform = algo != null ? algo.CreateSignatureTransform( _csp ) : null; |
| | | 344 | | |
| | 4 | 345 | | if ( algo == null || transform == null ) |
| | 0 | 346 | | throw new NotSupportedException( "algorithm is not supported" ); |
| | | 347 | | |
| | | 348 | | try |
| | | 349 | | { |
| | 4 | 350 | | var result = transform.Verify( digest, signature ); |
| | | 351 | | |
| | 4 | 352 | | return Task.FromResult( result ); |
| | | 353 | | } |
| | | 354 | | catch ( Exception ex ) |
| | | 355 | | { |
| | 0 | 356 | | return TaskException.FromException<bool>( ex ); |
| | | 357 | | } |
| | 4 | 358 | | } |
| | | 359 | | |
| | | 360 | | #endregion |
| | | 361 | | } |
| | | 362 | | } |