| | 1 | | // Copyright (c) Microsoft Corporation. All rights reserved. |
| | 2 | | // Licensed under the MIT License. See License.txt in the project root for |
| | 3 | | // license information. |
| | 4 | |
|
| | 5 | | using System; |
| | 6 | | using System.Security.Cryptography; |
| | 7 | | using System.Threading; |
| | 8 | | using System.Threading.Tasks; |
| | 9 | | using Microsoft.Azure.KeyVault.Core; |
| | 10 | | using Microsoft.Azure.KeyVault.Cryptography; |
| | 11 | | using Microsoft.Azure.KeyVault.Cryptography.Algorithms; |
| | 12 | |
|
| | 13 | | #if NETSTANDARD |
| | 14 | | using TaskException = System.Threading.Tasks.Task; |
| | 15 | | #endif |
| | 16 | |
|
| | 17 | | namespace Microsoft.Azure.KeyVault |
| | 18 | | { |
| | 19 | | /// <summary> |
| | 20 | | /// An RSA key. |
| | 21 | | /// </summary> |
| | 22 | | public class RsaKey : IKey, IDisposable |
| | 23 | | { |
| | 24 | | public const int KeySize1024 = 1024; |
| | 25 | | public const int KeySize2048 = 2048; |
| | 26 | |
|
| 2 | 27 | | private static readonly int DefaultKeySize = KeySize2048; |
| | 28 | |
|
| | 29 | | private RSA _csp; |
| | 30 | |
|
| | 31 | | /// <summary> |
| | 32 | | /// Key Identifier |
| | 33 | | /// </summary> |
| 98 | 34 | | public string Kid { get; private set; } |
| | 35 | |
|
| | 36 | | /// <summary> |
| | 37 | | /// Constructor, creates a 2048 bit key with a GUID identifier. |
| | 38 | | /// </summary> |
| 0 | 39 | | public RsaKey() : this( Guid.NewGuid().ToString( "D" ), DefaultKeySize ) |
| | 40 | | { |
| 0 | 41 | | } |
| | 42 | |
|
| | 43 | | /// <summary> |
| | 44 | | /// Constructor, creates a 2048 bit RSA key. |
| | 45 | | /// </summary> |
| | 46 | | /// <param name="kid">The key identifier to use</param> |
| 26 | 47 | | public RsaKey( string kid ) : this( kid, DefaultKeySize ) |
| | 48 | | { |
| 26 | 49 | | } |
| | 50 | |
|
| | 51 | | /// <summary> |
| | 52 | | /// Constructor. |
| | 53 | | /// </summary> |
| | 54 | | /// <param name="kid">The key identifier to use</param> |
| | 55 | | /// <param name="keySize">The size of the key</param> |
| 26 | 56 | | public RsaKey( string kid, int keySize ) |
| | 57 | | { |
| 26 | 58 | | if ( string.IsNullOrWhiteSpace( kid ) ) |
| 0 | 59 | | throw new ArgumentNullException( "kid" ); |
| | 60 | |
|
| 26 | 61 | | Kid = kid; |
| | 62 | |
|
| 26 | 63 | | _csp = RSA.Create(); |
| | 64 | |
|
| 26 | 65 | | _csp.KeySize = keySize; |
| 26 | 66 | | } |
| | 67 | |
|
| | 68 | | /// <summary> |
| | 69 | | /// Constructor |
| | 70 | | /// </summary> |
| | 71 | | /// <param name="kid">The key identifier to use</param> |
| | 72 | | /// <param name="keyParameters">The RSA parameters for the key</param> |
| 0 | 73 | | public RsaKey( string kid, RSAParameters keyParameters ) |
| | 74 | | { |
| 0 | 75 | | if ( string.IsNullOrWhiteSpace( kid ) ) |
| 0 | 76 | | throw new ArgumentNullException( "kid" ); |
| | 77 | |
|
| 0 | 78 | | Kid = kid; |
| | 79 | |
|
| 0 | 80 | | _csp = RSA.Create(); |
| 0 | 81 | | _csp.ImportParameters( keyParameters ); |
| 0 | 82 | | } |
| | 83 | |
|
| | 84 | | /// <summary> |
| | 85 | | /// Constructor. |
| | 86 | | /// </summary> |
| | 87 | | /// <param name="kid">The key identifier to use</param> |
| | 88 | | /// <param name="csp">The RSA object for the key</param> |
| | 89 | | /// <remarks>The RSA object is IDisposable, this class will hold a |
| | 90 | | /// reference to the RSA object but will not dispose it, the caller |
| | 91 | | /// of this constructor is responsible for the lifetime of this |
| | 92 | | /// parameter.</remarks> |
| 16 | 93 | | public RsaKey( string kid, RSA csp ) |
| | 94 | | { |
| 16 | 95 | | if ( string.IsNullOrWhiteSpace( kid ) ) |
| 0 | 96 | | throw new ArgumentNullException( "kid" ); |
| | 97 | |
|
| 16 | 98 | | if ( csp == null ) |
| 0 | 99 | | throw new ArgumentNullException( "csp" ); |
| | 100 | |
|
| 16 | 101 | | Kid = kid; |
| | 102 | |
|
| | 103 | | // NOTE: RSA is disposable and that may lead to runtime errors later. |
| 16 | 104 | | _csp = csp; |
| 16 | 105 | | } |
| | 106 | |
|
| | 107 | | // Intentionally excluded. |
| | 108 | | //~RsaKey() |
| | 109 | | //{ |
| | 110 | | // Dispose( false ); |
| | 111 | | //} |
| | 112 | |
|
| | 113 | | public void Dispose() |
| | 114 | | { |
| 14 | 115 | | Dispose( true ); |
| 14 | 116 | | GC.SuppressFinalize( this ); |
| 14 | 117 | | } |
| | 118 | |
|
| | 119 | | protected virtual void Dispose( bool disposing ) |
| | 120 | | { |
| | 121 | | // Clean up managed resources if Dispose was called |
| 14 | 122 | | if ( disposing ) |
| | 123 | | { |
| 14 | 124 | | if ( _csp != null ) |
| | 125 | | { |
| 14 | 126 | | _csp.Dispose(); |
| 14 | 127 | | _csp = null; |
| | 128 | | } |
| | 129 | | } |
| | 130 | |
|
| | 131 | | // Clean up native resources always |
| 14 | 132 | | } |
| | 133 | |
|
| | 134 | | #region IKey implementation |
| | 135 | |
|
| | 136 | | public string DefaultEncryptionAlgorithm |
| | 137 | | { |
| 6 | 138 | | get { return RsaOaep.AlgorithmName; } |
| | 139 | | } |
| | 140 | |
|
| | 141 | | public string DefaultKeyWrapAlgorithm |
| | 142 | | { |
| 6 | 143 | | get { return RsaOaep.AlgorithmName; } |
| | 144 | | } |
| | 145 | |
|
| | 146 | | public string DefaultSignatureAlgorithm |
| | 147 | | { |
| 2 | 148 | | get { return Rs256.AlgorithmName; } |
| | 149 | | } |
| | 150 | |
|
| | 151 | | public Task<byte[]> DecryptAsync( byte[] ciphertext, byte[] iv, byte[] authenticationData = null, byte[] authent |
| | 152 | | { |
| 6 | 153 | | if ( _csp == null ) |
| 0 | 154 | | throw new ObjectDisposedException( string.Format( "RsaKey {0} is disposed", Kid ) ); |
| | 155 | |
|
| 6 | 156 | | if ( string.IsNullOrWhiteSpace( algorithm ) ) |
| 2 | 157 | | algorithm = DefaultEncryptionAlgorithm; |
| | 158 | |
|
| 6 | 159 | | if ( ciphertext == null || ciphertext.Length == 0 ) |
| 0 | 160 | | throw new ArgumentNullException( "ciphertext" ); |
| | 161 | |
|
| 6 | 162 | | if ( iv != null ) |
| 0 | 163 | | throw new ArgumentException( "Initialization vector must be null", "iv" ); |
| | 164 | |
|
| 6 | 165 | | if ( authenticationData != null ) |
| 0 | 166 | | throw new ArgumentException( "Authentication data must be null", "authenticationData" ); |
| | 167 | |
|
| | 168 | | // TODO: Not available via the RSA class |
| | 169 | | //if ( _csp.PublicOnly ) |
| | 170 | | // throw new NotSupportedException( "Decrypt is not supported because no private key is available" ); |
| | 171 | |
|
| 6 | 172 | | AsymmetricEncryptionAlgorithm algo = AlgorithmResolver.Default[algorithm] as AsymmetricEncryptionAlgorithm; |
| | 173 | |
|
| 6 | 174 | | if ( algo == null ) |
| 0 | 175 | | throw new NotSupportedException( "algorithm is not supported" ); |
| | 176 | |
|
| 6 | 177 | | using ( var encryptor = algo.CreateDecryptor( _csp ) ) |
| | 178 | | { |
| | 179 | | try |
| | 180 | | { |
| 6 | 181 | | var result = encryptor.TransformFinalBlock( ciphertext, 0, ciphertext.Length ); |
| | 182 | |
|
| 6 | 183 | | return Task.FromResult( result ); |
| | 184 | | } |
| | 185 | | catch ( Exception ex ) |
| | 186 | | { |
| 0 | 187 | | return TaskException.FromException<byte[]>( ex ); |
| | 188 | | } |
| | 189 | | } |
| 6 | 190 | | } |
| | 191 | |
|
| | 192 | | public Task<Tuple<byte[], byte[], string>> EncryptAsync( byte[] plaintext, byte[] iv = null, byte[] authenticati |
| | 193 | | { |
| 6 | 194 | | if ( _csp == null ) |
| 0 | 195 | | throw new ObjectDisposedException( string.Format( "RsaKey {0} is disposed", Kid ) ); |
| | 196 | |
|
| 6 | 197 | | if ( string.IsNullOrWhiteSpace( algorithm ) ) |
| 2 | 198 | | algorithm = DefaultEncryptionAlgorithm; |
| | 199 | |
|
| 6 | 200 | | if ( plaintext == null || plaintext.Length == 0 ) |
| 0 | 201 | | throw new ArgumentNullException( "plaintext" ); |
| | 202 | |
|
| 6 | 203 | | if ( iv != null ) |
| 0 | 204 | | throw new ArgumentException( "Initialization vector must be null", "iv" ); |
| | 205 | |
|
| 6 | 206 | | if ( authenticationData != null ) |
| 0 | 207 | | throw new ArgumentException( "Authentication data must be null", "authenticationData" ); |
| | 208 | |
|
| 6 | 209 | | AsymmetricEncryptionAlgorithm algo = AlgorithmResolver.Default[algorithm] as AsymmetricEncryptionAlgorithm; |
| | 210 | |
|
| 6 | 211 | | if ( algo == null ) |
| 0 | 212 | | throw new NotSupportedException( "algorithm is not supported" ); |
| | 213 | |
|
| 6 | 214 | | using ( var encryptor = algo.CreateEncryptor( _csp ) ) |
| | 215 | | { |
| | 216 | | try |
| | 217 | | { |
| 6 | 218 | | var result = new Tuple<byte[], byte[], string>( encryptor.TransformFinalBlock( plaintext, 0, plainte |
| | 219 | |
|
| 6 | 220 | | return Task.FromResult( result ); |
| | 221 | | } |
| | 222 | | catch ( Exception ex ) |
| | 223 | | { |
| 0 | 224 | | return TaskException.FromException<Tuple<byte[], byte[], string>>( ex ); |
| | 225 | | } |
| | 226 | | } |
| 6 | 227 | | } |
| | 228 | |
|
| | 229 | | public Task<Tuple<byte[], string>> WrapKeyAsync( byte[] key, string algorithm = RsaOaep.AlgorithmName, Cancellat |
| | 230 | | { |
| 6 | 231 | | if ( _csp == null ) |
| 0 | 232 | | throw new ObjectDisposedException( string.Format( "RsaKey {0} is disposed", Kid ) ); |
| | 233 | |
|
| 6 | 234 | | if ( string.IsNullOrWhiteSpace( algorithm ) ) |
| 2 | 235 | | algorithm = DefaultKeyWrapAlgorithm; |
| | 236 | |
|
| 6 | 237 | | if ( key == null || key.Length == 0 ) |
| 0 | 238 | | throw new ArgumentNullException( "key" ); |
| | 239 | |
|
| 6 | 240 | | AsymmetricEncryptionAlgorithm algo = AlgorithmResolver.Default[algorithm] as AsymmetricEncryptionAlgorithm; |
| | 241 | |
|
| 6 | 242 | | if ( algo == null ) |
| 0 | 243 | | throw new NotSupportedException( "algorithm is not supported" ); |
| | 244 | |
|
| 6 | 245 | | using ( var encryptor = algo.CreateEncryptor( _csp ) ) |
| | 246 | | { |
| | 247 | | try |
| | 248 | | { |
| 6 | 249 | | var result = new Tuple<byte[], string>( encryptor.TransformFinalBlock( key, 0, key.Length ), algorit |
| | 250 | |
|
| 6 | 251 | | return Task.FromResult( result ); |
| | 252 | | } |
| | 253 | | catch ( Exception ex ) |
| | 254 | | { |
| 0 | 255 | | return TaskException.FromException<Tuple<byte[], string>>( ex ); |
| | 256 | | } |
| | 257 | | } |
| 6 | 258 | | } |
| | 259 | |
|
| | 260 | | public Task<byte[]> UnwrapKeyAsync( byte[] encryptedKey, string algorithm = RsaOaep.AlgorithmName, CancellationT |
| | 261 | | { |
| 6 | 262 | | if ( _csp == null ) |
| 0 | 263 | | throw new ObjectDisposedException( string.Format( "RsaKey {0} is disposed", Kid ) ); |
| | 264 | |
|
| 6 | 265 | | if ( string.IsNullOrWhiteSpace( algorithm ) ) |
| 2 | 266 | | algorithm = DefaultKeyWrapAlgorithm; |
| | 267 | |
|
| 6 | 268 | | if ( encryptedKey == null || encryptedKey.Length == 0 ) |
| 0 | 269 | | throw new ArgumentNullException( "encryptedKey" ); |
| | 270 | |
|
| | 271 | | // TODO: Not available via the RSA class |
| | 272 | | //if ( _csp.PublicOnly ) |
| | 273 | | // throw new NotSupportedException( "UnwrapKey is not supported because no private key is available" ); |
| | 274 | |
|
| 6 | 275 | | AsymmetricEncryptionAlgorithm algo = AlgorithmResolver.Default[algorithm] as AsymmetricEncryptionAlgorithm; |
| | 276 | |
|
| 6 | 277 | | if ( algo == null ) |
| 0 | 278 | | throw new NotSupportedException( "algorithm is not supported" ); |
| | 279 | |
|
| 6 | 280 | | using ( var encryptor = algo.CreateDecryptor( _csp ) ) |
| | 281 | | { |
| | 282 | | try |
| | 283 | | { |
| 6 | 284 | | var result = encryptor.TransformFinalBlock( encryptedKey, 0, encryptedKey.Length ); |
| | 285 | |
|
| 6 | 286 | | return Task.FromResult( result ); |
| | 287 | | } |
| | 288 | | catch ( Exception ex ) |
| | 289 | | { |
| 0 | 290 | | return TaskException.FromException<byte[]>( ex ); |
| | 291 | | } |
| | 292 | | } |
| 6 | 293 | | } |
| | 294 | |
|
| | 295 | | public Task<Tuple<byte[], string>> SignAsync( byte[] digest, string algorithm, CancellationToken token = default |
| | 296 | | { |
| 2 | 297 | | if ( _csp == null ) |
| 0 | 298 | | throw new ObjectDisposedException( string.Format( "RsaKey {0} is disposed", Kid ) ); |
| | 299 | |
|
| 2 | 300 | | if ( algorithm == null ) |
| 0 | 301 | | algorithm = DefaultSignatureAlgorithm; |
| | 302 | |
|
| 2 | 303 | | if ( digest == null ) |
| 0 | 304 | | throw new ArgumentNullException( "digest" ); |
| | 305 | |
|
| | 306 | | // TODO: Not available via the RSA class |
| | 307 | | //if ( _csp.PublicOnly ) |
| | 308 | | // throw new NotSupportedException( "Sign is not supported because no private key is available" ); |
| | 309 | |
|
| 2 | 310 | | AsymmetricSignatureAlgorithm algo = AlgorithmResolver.Default[algorithm] as AsymmetricSignatureAlgorith |
| 2 | 311 | | ISignatureTransform transform = algo != null ? algo.CreateSignatureTransform( _csp ) : null; |
| | 312 | |
|
| 2 | 313 | | if ( algo == null || transform == null ) |
| 0 | 314 | | throw new NotSupportedException( "algorithm is not supported" ); |
| | 315 | |
|
| | 316 | | try |
| | 317 | | { |
| 2 | 318 | | var result = new Tuple<byte[], string>( transform.Sign( digest ), algorithm ); |
| | 319 | |
|
| 2 | 320 | | return Task.FromResult( result ); |
| | 321 | | } |
| | 322 | | catch ( Exception ex ) |
| | 323 | | { |
| 0 | 324 | | return TaskException.FromException<Tuple<byte[], string>>( ex ); |
| | 325 | | } |
| 2 | 326 | | } |
| | 327 | |
|
| | 328 | | public Task<bool> VerifyAsync( byte[] digest, byte[] signature, string algorithm, CancellationToken token = defa |
| | 329 | | { |
| 4 | 330 | | if ( _csp == null ) |
| 0 | 331 | | throw new ObjectDisposedException( string.Format( "RsaKey {0} is disposed", Kid ) ); |
| | 332 | |
|
| 4 | 333 | | if ( digest == null ) |
| 0 | 334 | | throw new ArgumentNullException( "digest" ); |
| | 335 | |
|
| 4 | 336 | | if ( signature == null ) |
| 0 | 337 | | throw new ArgumentNullException( "signature" ); |
| | 338 | |
|
| 4 | 339 | | if ( algorithm == null ) |
| 0 | 340 | | algorithm = DefaultSignatureAlgorithm; |
| | 341 | |
|
| 4 | 342 | | AsymmetricSignatureAlgorithm algo = AlgorithmResolver.Default[algorithm] as AsymmetricSignatureAlgorithm; |
| 4 | 343 | | ISignatureTransform transform = algo != null ? algo.CreateSignatureTransform( _csp ) : null; |
| | 344 | |
|
| 4 | 345 | | if ( algo == null || transform == null ) |
| 0 | 346 | | throw new NotSupportedException( "algorithm is not supported" ); |
| | 347 | |
|
| | 348 | | try |
| | 349 | | { |
| 4 | 350 | | var result = transform.Verify( digest, signature ); |
| | 351 | |
|
| 4 | 352 | | return Task.FromResult( result ); |
| | 353 | | } |
| | 354 | | catch ( Exception ex ) |
| | 355 | | { |
| 0 | 356 | | return TaskException.FromException<bool>( ex ); |
| | 357 | | } |
| 4 | 358 | | } |
| | 359 | |
|
| | 360 | | #endregion |
| | 361 | | } |
| | 362 | | } |