public EnvelopeEncryptionJsonImpl(
     AppEncryptionPartition partition,
     IMetastorePersistence <JObject> metastorePersistence,
     SecureCryptoKeyDictionary <DateTimeOffset> systemKeyCache,
     SecureCryptoKeyDictionaryFactory <DateTimeOffset> intermediateKeyCacheFactory,
     AeadEnvelopeCrypto aeadEnvelopeCrypto,
     CryptoPolicy cryptoPolicy,
     KeyManagementService keyManagementService)
 {
     this.partition            = partition;
     this.metastorePersistence = metastorePersistence;
     this.systemKeyCache       = systemKeyCache;
     intermediateKeyCache      = intermediateKeyCacheFactory.CreateSecureCryptoKeyDictionary();
     crypto                    = aeadEnvelopeCrypto;
     this.cryptoPolicy         = cryptoPolicy;
     this.keyManagementService = keyManagementService;
 }
Beispiel #2
0
            private object[] GenerateMocks(KeyState cacheIK, KeyState metaIK, KeyState cacheSK, KeyState metaSK)
            {
                Partition partition = new DefaultPartition(
                    cacheIK + "CacheIK_" + metaIK + "MetaIK_" + DateTimeUtils.GetCurrentTimeAsUtcIsoDateTimeOffset() +
                    "_" + Random.Next(),
                    cacheSK + "CacheSK_" + metaSK + "MetaSK_" + DateTimeUtils.GetCurrentTimeAsUtcIsoDateTimeOffset() + "_" + Random.Next(),
                    DefaultProductId);

                KeyManagementService kms = configFixture.KeyManagementService;

                CryptoKeyHolder cryptoKeyHolder = CryptoKeyHolder.GenerateIKSK();

                Mock <IMetastore <JObject> > metastoreMock = MetastoreMock.CreateMetastoreMock(
                    partition, kms, metaIK, metaSK, cryptoKeyHolder, configFixture.Metastore);

                CacheMock cacheMock = CacheMock.CreateCacheMock(cacheIK, cacheSK, cryptoKeyHolder);

                // Mimics (mostly) the old TimeBasedCryptoPolicyImpl settings
                CryptoPolicy cryptoPolicy = BasicExpiringCryptoPolicy.NewBuilder()
                                            .WithKeyExpirationDays(KeyExpiryDays)
                                            .WithRevokeCheckMinutes(int.MaxValue)
                                            .WithCanCacheIntermediateKeys(false)
                                            .WithCanCacheSystemKeys(false)
                                            .Build();

                SecureCryptoKeyDictionary <DateTimeOffset> intermediateKeyCache = cacheMock.IntermediateKeyCache;
                SecureCryptoKeyDictionary <DateTimeOffset> systemKeyCache       = cacheMock.SystemKeyCache;

                EnvelopeEncryptionJsonImpl envelopeEncryptionJson = new EnvelopeEncryptionJsonImpl(
                    partition,
                    metastoreMock.Object,
                    systemKeyCache,
                    intermediateKeyCache,
                    new BouncyAes256GcmCrypto(),
                    cryptoPolicy,
                    kms);

                IEnvelopeEncryption <byte[]> envelopeEncryptionByteImpl =
                    new EnvelopeEncryptionBytesImpl(envelopeEncryptionJson);

                return(new object[]
                {
                    envelopeEncryptionByteImpl, metastoreMock, cacheIK, metaIK, cacheSK, metaSK,
                    partition,
                });
            }
        private void TestSessionCacheGetSessionAfterUseAndNotExpiredShouldNotEvict()
        {
            CryptoPolicy policy = BasicExpiringCryptoPolicy.NewBuilder()
                                  .WithKeyExpirationDays(1)
                                  .WithRevokeCheckMinutes(30)
                                  .WithCanCacheSessions(true)
                                  .Build();

            using (SessionFactory factory = SessionFactory.NewBuilder(TestProductId, TestServiceId)
                                            .WithMetastore(metastoreSpy.Object)
                                            .WithCryptoPolicy(policy)
                                            .WithStaticKeyManagementService(TestStaticMasterKey)
                                            .Build())
            {
                byte[] payload = { 0, 1, 2, 3, 4, 5, 6, 7 };
                byte[] drr     = null;

                using (Session <byte[], byte[]> sessionBytes = factory.GetSessionBytes(TestPartitionId))
                {
                    drr = sessionBytes.Encrypt(payload);
                    byte[] decryptedPayload = sessionBytes.Decrypt(drr);

                    Assert.Equal(payload, decryptedPayload);
                }

                // Note we do not sleep

                // Reset so we can examine 2nd session's interactions
                metastoreSpy.Reset();

                // Use same partition to get the same cached session while it's still in use
                using (Session <byte[], byte[]> sessionBytes = factory.GetSessionBytes(TestPartitionId))
                {
                    byte[] decryptedPayload = sessionBytes.Decrypt(drr);

                    Assert.Equal(payload, decryptedPayload);

                    // verify no metastore interactions in the decrypt flow (since IKs cached via session caching)
                    metastoreSpy.Verify(
                        x => x.Load(It.IsAny <string>(), It.IsAny <DateTimeOffset>()), Times.Never);
                }

                // Verify that nothing is evicted from cache since the session is still in use.
                Assert.Equal(1, factory.SessionCache.Count);
            }
        }
        private void TestSessionCacheMultiThreadedWithMaxSessionReachedSameSession()
        {
            long         sessionCacheMaxSize = 1;
            CryptoPolicy policy = BasicExpiringCryptoPolicy.NewBuilder()
                                  .WithKeyExpirationDays(1)
                                  .WithRevokeCheckMinutes(30)
                                  .WithCanCacheSessions(true)
                                  .WithSessionCacheMaxSize(sessionCacheMaxSize)
                                  .Build();

            using (SessionFactory factory = SessionFactory.NewBuilder(TestProductId, TestServiceId)
                                            .WithInMemoryMetastore()
                                            .WithCryptoPolicy(policy)
                                            .WithStaticKeyManagementService(TestStaticMasterKey)
                                            .Build())
            {
                int numThreads  = 100;
                int numRequests = 100;

                // Get the current settings and try to force minWorkers
                ThreadPool.GetMinThreads(out _, out var currentMinIOC);
                Assert.True(ThreadPool.SetMinThreads(numThreads, currentMinIOC));

                long completedTasks = 0;
                Parallel.ForEach(Enumerable.Range(0, numRequests), i =>
                {
                    using (Session <byte[], byte[]> sessionBytes = factory.GetSessionBytes(TestPartitionId))
                    {
                        byte[] payload          = { 0, 1, 2, 3, 4, 5, 6, 7 };
                        byte[] drr              = sessionBytes.Encrypt(payload);
                        byte[] decryptedPayload = sessionBytes.Decrypt(drr);

                        Assert.Equal(payload, decryptedPayload);
                        Interlocked.Increment(ref completedTasks);
                    }
                });

                // Wait for all threads to complete
                Assert.Equal(numRequests, completedTasks);
                Assert.Equal(1, factory.SessionCache.Count);
            }
        }
Beispiel #5
0
 public IKeyManagementServiceStep WithCryptoPolicy(CryptoPolicy policy)
 {
     cryptoPolicy = policy;
     return(this);
 }
Beispiel #6
0
 public IKeyManagementServiceStep WithNeverExpiredCryptoPolicy()
 {
     cryptoPolicy = new NeverExpiredCryptoPolicy();
     return(this);
 }
Beispiel #7
0
        private static async void App(Options options)
        {
            IMetastore <JObject> metastore            = null;
            KeyManagementService keyManagementService = null;

            if (options.Metastore == Metastore.ADO)
            {
                if (options.AdoConnectionString != null)
                {
                    logger.LogInformation("using ADO-based metastore...");
                    metastore = AdoMetastoreImpl
                                .NewBuilder(MySqlClientFactory.Instance, options.AdoConnectionString)
                                .Build();
                }
                else
                {
                    logger.LogError("ADO connection string is a mandatory parameter with Metastore Type: ADO");
                    Console.WriteLine(HelpText.AutoBuild(cmdOptions, null, null));
                    return;
                }
            }
            else if (options.Metastore == Metastore.DYNAMODB)
            {
                logger.LogInformation("using DynamoDB-based metastore...");
                AWSConfigs.AWSRegion = "us-west-2";
                metastore            = DynamoDbMetastoreImpl.NewBuilder().Build();
            }
            else
            {
                logger.LogInformation("using in-memory metastore...");
                metastore = new InMemoryMetastoreImpl <JObject>();
            }

            if (options.Kms == Kms.AWS)
            {
                if (options.PreferredRegion != null && options.RegionToArnTuples != null)
                {
                    Dictionary <string, string> regionToArnDictionary = new Dictionary <string, string>();
                    foreach (string regionArnPair in options.RegionToArnTuples)
                    {
                        string[] regionArnArray = regionArnPair.Split("=");
                        regionToArnDictionary.Add(regionArnArray[0], regionArnArray[1]);
                    }

                    logger.LogInformation("using AWS KMS...");
                    keyManagementService = AwsKeyManagementServiceImpl
                                           .NewBuilder(regionToArnDictionary, options.PreferredRegion).Build();
                }
                else
                {
                    logger.LogError("Preferred region and <region>=<arn> tuples are mandatory with  KMS Type: AWS");
                    Console.WriteLine(HelpText.AutoBuild(cmdOptions, null, null));
                    return;
                }
            }
            else
            {
                logger.LogInformation("using static KMS...");
                keyManagementService = new StaticKeyManagementServiceImpl("mysupersecretstaticmasterkey!!!!");
            }

            CryptoPolicy cryptoPolicy = BasicExpiringCryptoPolicy
                                        .NewBuilder()
                                        .WithKeyExpirationDays(KeyExpirationDays)
                                        .WithRevokeCheckMinutes(CacheCheckMinutes)
                                        .Build();

            // Setup metrics reporters and always include console.
            IMetricsBuilder metricsBuilder = new MetricsBuilder()
                                             .Report.ToConsole(consoleOptions => consoleOptions.FlushInterval = TimeSpan.FromSeconds(60));

            // CloudWatch metrics generation
            if (options.EnableCloudWatch)
            {
                // Fill in when we open source our App.Metrics cloudwatch reporter separately
            }

            IMetrics metrics = metricsBuilder.Build();

            // Create a session factory for this app. Normally this would be done upon app startup and the
            // same factory would be used anytime a new session is needed for a partition (e.g., shopper).
            // We've split it out into multiple using blocks to underscore this point.
            using (SessionFactory sessionFactory = SessionFactory
                                                   .NewBuilder("productId", "reference_app")
                                                   .WithMetastore(metastore)
                                                   .WithCryptoPolicy(cryptoPolicy)
                                                   .WithKeyManagementService(keyManagementService)
                                                   .WithMetrics(metrics)
                                                   .Build())
            {
                // Now create an actual session for a partition (which in our case is a pretend shopper id). This session is used
                // for a transaction and is disposed automatically after use due to the IDisposable implementation.
                using (Session <byte[], byte[]> sessionBytes =
                           sessionFactory.GetSessionBytes("shopper123"))
                {
                    const string originalPayloadString = "mysupersecretpayload";
                    foreach (int i in Enumerable.Range(0, options.Iterations))
                    {
                        string dataRowString;

                        // If we get a DRR as a command line argument, we want to directly decrypt it
                        if (options.Drr != null)
                        {
                            dataRowString = options.Drr;
                        }
                        else
                        {
                            // Encrypt the payload
                            byte[] dataRowRecordBytes =
                                sessionBytes.Encrypt(Encoding.UTF8.GetBytes(originalPayloadString));

                            // Consider this us "persisting" the DRR
                            dataRowString = Convert.ToBase64String(dataRowRecordBytes);
                        }

                        logger.LogInformation("dataRowRecord as string = {dataRow}", dataRowString);

                        byte[] newDataRowRecordBytes = Convert.FromBase64String(dataRowString);

                        // Decrypt the payload
                        string decryptedPayloadString =
                            Encoding.UTF8.GetString(sessionBytes.Decrypt(newDataRowRecordBytes));

                        logger.LogInformation("decryptedPayloadString = {payload}", decryptedPayloadString);
                        logger.LogInformation("matches = {result}", originalPayloadString.Equals(decryptedPayloadString));
                    }
                }
            }

            // Force final publish of metrics
            await Task.WhenAll(((IMetricsRoot)metrics).ReportRunner.RunAllAsync());
        }
 public SecureCryptoKeyDictionaryFactory(CryptoPolicy cryptoPolicy)
 {
     this.cryptoPolicy = cryptoPolicy;
 }