/// <summary>
/// Deviate byte data based on supported types.
/// </summary>
/// <param name="data">Data of any encoding type.</param>
/// <param name="salt">Divination salt.</param>
/// <param name="length">Divination returned byte size.</param>
/// <returns>SaltedData</returns>
public static SaltedData ToKeyDevination(this byte[] data, byte[] salt = null, int length = 32)
{
var salting = salt ?? 16.ToRandomBytes();
var pbkdf2 = new Rfc2898DeriveBytes(data, salting, PBKDF2_ITERATIONS);
var derived = pbkdf2.GetBytes(length);
pbkdf2.Reset();
return new SaltedData() { Salt = salting, Data = derived };
}
public void SplitCalls_Reset ()
{
Rfc2898DeriveBytes keygen = new Rfc2898DeriveBytes ("password", salt, 12345);
byte [] big = keygen.GetBytes (48);
keygen.Reset ();
byte [] a = keygen.GetBytes (16);
byte [] b = keygen.GetBytes (32);
CompareBuffers (big, a, b);
}
public void RFC3211_TC2_Reset ()
{
byte[] expected = { 0x6A, 0x89, 0x70, 0xBF, 0x68, 0xC9, 0x2C, 0xAE };
Rfc2898DeriveBytes pkcs5 = new Rfc2898DeriveBytes ("All n-entities must communicate with other n-entities via n-1 entiteeheehees", salt, 500);
byte[] key1 = pkcs5.GetBytes (8);
Assert.AreEqual (expected, key1, "RFC3211_TC2_part1");
pkcs5.Reset ();
byte[] key2 = pkcs5.GetBytes (8);
Assert.AreEqual (expected, key2, "RFC3211_TC2_part2");
}
//----------------------------------------------------------------------------------
public static void SetEncryptedPrivateKey
(
RSACryptoServiceProvider rsa
, byte[] data
, string password
)
{
byte[] OIDpkcs5PBES2 = { 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x05, 0x0D };
byte[] OIDpkcs5PBKDF2 = { 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x05, 0x0C };
byte[] OIDdesEDE3CBC = { 0x06, 0x08, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x03, 0x07 };
using (MemoryStream ms = new MemoryStream(data))
{
using (BinaryReader br = new BinaryReader(ms))
{
int n = br.ReadUInt16();
if (n == 0x8130)
{
br.ReadByte();
}
else if (n == 0x8230)
{
br.ReadInt16();
}
else
{
throw new CryptographicException(OpenSSL.MSG_WRONG_OSSL_DATA);
}
if ((n = br.ReadUInt16()) == 0x8130)
{
br.ReadByte();
}
else if (n == 0x8230)
{
br.ReadInt16();
}
byte[] b = br.ReadBytes(11);
if (!OpenSSL.CompareByteArray(b, OIDpkcs5PBES2))
{
throw new CryptographicException(OpenSSL.MSG_WRONG_OSSL_DATA);
}
Array.Clear(b, 0, b.Length);
if ((n = br.ReadUInt16()) == 0x8130)
{
br.ReadByte();
}
else if (n == 0x8230)
{
br.ReadInt16();
}
if ((n = br.ReadUInt16()) == 0x8130)
{
br.ReadByte();
}
else if (n == 0x8230)
{
br.ReadInt16();
}
b = br.ReadBytes(11);
if (!OpenSSL.CompareByteArray(b, OIDpkcs5PBKDF2))
{
throw new CryptographicException(OpenSSL.MSG_WRONG_OSSL_DATA);
}
Array.Clear(b, 0, b.Length);
if ((n = br.ReadUInt16()) == 0x8130)
{
br.ReadByte();
}
else if (n == 0x8230)
{
br.ReadInt16();
}
if (br.ReadByte() != 0x04)
{
throw new CryptographicException(OpenSSL.MSG_WRONG_OSSL_DATA);
}
byte[] salt = br.ReadBytes(br.ReadByte());
if (br.ReadByte() != 0x02)
{
throw new CryptographicException(OpenSSL.MSG_WRONG_OSSL_DATA);
}
int iterations = 0;
if ((n = br.ReadByte()) == 1)
{
iterations = br.ReadByte();
}
else if (n == 2)
{
iterations = 256 * br.ReadByte() + br.ReadByte();
}
else
{
throw new CryptographicException(OpenSSL.MSG_WRONG_OSSL_DATA);
}
if ((n = br.ReadUInt16()) == 0x8130)
{
br.ReadByte();
}
else if (n == 0x8230)
{
br.ReadInt16();
}
b = br.ReadBytes(10);
if (!OpenSSL.CompareByteArray(b, OIDdesEDE3CBC))
{
throw new CryptographicException(OpenSSL.MSG_WRONG_OSSL_DATA);
}
Array.Clear(b, 0, b.Length);
if (br.ReadByte() != 0x04)
{
throw new CryptographicException(OpenSSL.MSG_WRONG_OSSL_DATA);
}
byte[] iv = br.ReadBytes(br.ReadByte());
if (br.ReadByte() != 0x04)
{
throw new CryptographicException(OpenSSL.MSG_WRONG_OSSL_DATA);
}
if ((n = br.ReadByte()) == 0x81)
{
n = br.ReadByte();
}
else if (n == 0x82)
{
n = 256 * br.ReadByte() + br.ReadByte();
}
data = br.ReadBytes(n);
Rfc2898DeriveBytes db = new Rfc2898DeriveBytes(password, salt, iterations);
byte[] bk = db.GetBytes(24);
using (TripleDES td = TripleDES.Create())
b = OpenSSL.Decrypt(td, bk, iv, data);
OpenSSL.SetPrivateKey(rsa, b);
db.Reset();
Array.Clear(b, 0, b.Length);
Array.Clear(data, 0, data.Length);
Array.Clear(salt, 0, salt.Length);
Array.Clear(iv, 0, iv.Length);
Array.Clear(bk, 0, bk.Length);
}
}
}
public void MsdnExample()
{
const string pwd1 = "b@nana!123";
const int myIterations = 1000;
// data1 can be a string or contents of a file.
const string data1 = "Some test data";
// Create a byte array to hold the random value.
byte[] randomSalt = new byte[8];
using (RNGCryptoServiceProvider rngCsp = new RNGCryptoServiceProvider())
{
// Fill the array with a random value.
rngCsp.GetBytes(randomSalt);
}
//// try
//// {
// The default iteration count is 1000 so the two methods use the same iteration count.
Rfc2898DeriveBytes k1 = new Rfc2898DeriveBytes(pwd1, randomSalt, myIterations);
Rfc2898DeriveBytes k2 = new Rfc2898DeriveBytes(pwd1, randomSalt);
// Encrypt the data.
SymmetricAlgorithm encAlg = TripleDES.Create();
encAlg.Key = k1.GetBytes(16);
MemoryStream encryptionStream = new MemoryStream();
CryptoStream encrypt = new CryptoStream(
encryptionStream, encAlg.CreateEncryptor(), CryptoStreamMode.Write);
byte[] utfD1 = new UTF8Encoding(false).GetBytes(data1);
encrypt.Write(utfD1, 0, utfD1.Length);
encrypt.FlushFinalBlock();
encrypt.Close();
byte[] edata1 = encryptionStream.ToArray();
// Erase memory for optimum secrecy?
k1.Reset();
// Try to decrypt, thus showing it can be round-tripped.
SymmetricAlgorithm decAlg = TripleDES.Create();
decAlg.Key = k2.GetBytes(16);
// Relay the one-time INITIALIZATION VECTOR
// generated by the original encryption.
// Could this have been initialized via the Rfc k1/k2?
decAlg.IV = encAlg.IV;
MemoryStream decryptionStreamBacking = new MemoryStream();
CryptoStream decrypt = new CryptoStream(
decryptionStreamBacking, decAlg.CreateDecryptor(), CryptoStreamMode.Write);
decrypt.Write(edata1, 0, edata1.Length);
decrypt.Flush();
decrypt.Close();
// Erase memory for optimum secrecy?
k2.Reset();
string data2 = new UTF8Encoding(false).GetString(decryptionStreamBacking.ToArray());
if (!data1.Equals(data2))
{
Console.WriteLine("Error: The two values are not equal.");
}
else
{
Console.WriteLine("The two values are equal.");
Console.WriteLine("k1 iterations: {0}", k1.IterationCount);
Console.WriteLine("k2 iterations: {0}", k2.IterationCount);
}
//// }
//// catch (Exception e)
//// {
//// Console.WriteLine("Error: {0}", e);
//// }
Assert.AreEqual(data2, data1);
Assert.IsTrue(data1.Equals(data2));
}
/// <summary>
/// Decripts a byte array with a given password and salt.
/// </summary>
/// <param name="encryptedData">A byte array containing the data you would like decrypted.</param>
/// <param name="password">The password used to derive the key.</param>
/// <param name="salt">The key salt used to derive the key.</param>
/// <returns>A string containing the decrypted data.</returns>
public static string Decrypt(byte[] encryptedData, string password, string salt)
{
AesManaged aes = null;
MemoryStream memoryStream = null;
CryptoStream cryptoStream = null;
string decryptedText = "";
try
{
//Generate a Key based on a Password, Salt and HMACSHA1 pseudo-random number generator
var rfc2898 = new Rfc2898DeriveBytes(password, Encoding.Unicode.GetBytes(salt));
//Create AES algorithm with 256 bit key and 128-bit block size
aes = new AesManaged();
aes.Key = rfc2898.GetBytes(aes.KeySize / 8);
rfc2898.Reset(); //neede to be WinRT compatible
aes.IV = rfc2898.GetBytes(aes.BlockSize / 8);
//Create Memory and Crypto Streams
memoryStream = new MemoryStream();
cryptoStream = new CryptoStream(memoryStream, aes.CreateDecryptor(), CryptoStreamMode.Write);
//Decrypt Data
cryptoStream.Write(encryptedData, 0, encryptedData.Length);
cryptoStream.FlushFinalBlock();
//Return Decrypted String
var decryptBytes = memoryStream.ToArray();
decryptedText = Encoding.Unicode.GetString(decryptBytes, 0, decryptBytes.Length);
}
catch (Exception eDecrypt)
{
}
finally
{
if (cryptoStream != null)
cryptoStream.Close();
if (memoryStream != null)
memoryStream.Close();
if (aes != null)
aes.Clear();
}
return decryptedText;
}
/// <summary>
/// Encrypts a string with a given password and salt.
/// </summary>
/// <param name="plainText">The information to encrypt.</param>
/// <param name="password">The password used to derive the key.</param>
/// <param name="salt">The key salt used to derive the key.</param>
/// <exception cref="System.ArgumentException">
/// The specified salt size is smaller than 8 bytes or the iteration count is less than 1.
/// </exception>
/// <returns>A byte array with the encrypted version of the plainText.</returns>
public static byte[] Encrypt(string plainText, string password, string salt)
{
AesManaged aes = null;
MemoryStream memoryStream = null;
CryptoStream cryptoStream = null;
try
{
//Generate a Key based on a Password, Salt and HMACSHA1 pseudo-random number generator
var rfc2898 = new Rfc2898DeriveBytes(password, Encoding.Unicode.GetBytes(salt));
//Create AES algorithm with 256 bit key and 128-bit block size
aes = new AesManaged();
aes.Key = rfc2898.GetBytes(aes.KeySize / 8);
rfc2898.Reset(); //needed for WinRT compatibility
aes.IV = rfc2898.GetBytes(aes.BlockSize / 8);
//Create Memory and Crypto Streams
memoryStream = new MemoryStream();
cryptoStream = new CryptoStream(memoryStream, aes.CreateEncryptor(), CryptoStreamMode.Write);
//Encrypt Data
var data = Encoding.Unicode.GetBytes(plainText);
cryptoStream.Write(data, 0, data.Length);
cryptoStream.FlushFinalBlock();
//Return encrypted data
return memoryStream.ToArray();
}
catch (Exception eEncrypt)
{
return null;
}
finally
{
if (cryptoStream != null)
cryptoStream.Close();
if (memoryStream != null)
memoryStream.Close();
if (aes != null)
aes.Clear();
}
}
