public async Task HelloWorldAsync() { // Environment variable with the Key Vault endpoint. string keyVaultUrl = Environment.GetEnvironmentVariable("AZURE_KEYVAULT_URL"); // Instantiate a key client that will be used to call the service. Notice that the client is using default Azure // credentials. To make default credentials work, ensure that environment variables 'AZURE_CLIENT_ID', // 'AZURE_CLIENT_KEY' and 'AZURE_TENANT_ID' are set with the service principal credentials. var client = new KeyClient(new Uri(keyVaultUrl), new DefaultAzureCredential()); // Let's create a RSA key valid for 1 year. If the key // already exists in the Key Vault, then a new version of the key is created. string rsaKeyName = $"CloudRsaKey-{Guid.NewGuid()}"; var rsaKey = new CreateRsaKeyOptions(rsaKeyName, hardwareProtected: false) { KeySize = 2048, ExpiresOn = DateTimeOffset.Now.AddYears(1) }; await client.CreateRsaKeyAsync(rsaKey); // Let's Get the Cloud RSA Key from the Key Vault. KeyVaultKey cloudRsaKey = await client.GetKeyAsync(rsaKeyName); Debug.WriteLine($"Key is returned with name {cloudRsaKey.Name} and type {cloudRsaKey.KeyType}"); // After one year, the Cloud RSA Key is still required, we need to update the expiry time of the key. // The update method can be used to update the expiry attribute of the key. cloudRsaKey.Properties.ExpiresOn.Value.AddYears(1); KeyVaultKey updatedKey = await client.UpdateKeyPropertiesAsync(cloudRsaKey.Properties, cloudRsaKey.KeyOperations); Debug.WriteLine($"Key's updated expiry time is {updatedKey.Properties.ExpiresOn}"); // We need the Cloud RSA key with bigger key size, so you want to update the key in Key Vault to ensure // it has the required size. // Calling CreateRsaKey on an existing key creates a new version of the key in the Key Vault // with the new specified size. var newRsaKey = new CreateRsaKeyOptions(rsaKeyName, hardwareProtected: false) { KeySize = 4096, ExpiresOn = DateTimeOffset.Now.AddYears(1) }; await client.CreateRsaKeyAsync(newRsaKey); // The Cloud RSA Key is no longer needed, need to delete it from the Key Vault. await client.DeleteKeyAsync(rsaKeyName); // To ensure secret is deleted on server side. Assert.IsTrue(await WaitForDeletedKeyAsync(client, rsaKeyName)); // If the keyvault is soft-delete enabled, then for permanent deletion, deleted key needs to be purged. await client.PurgeDeletedKeyAsync(rsaKeyName); }
public async Task EncryptDecryptAsync() { // Environment variable with the Key Vault endpoint. string keyVaultUrl = Environment.GetEnvironmentVariable("AZURE_KEYVAULT_URL"); // Instantiate a key client that will be used to create a key. Notice that the client is using default Azure // credentials. To make default credentials work, ensure that environment variables 'AZURE_CLIENT_ID', // 'AZURE_CLIENT_KEY' and 'AZURE_TENANT_ID' are set with the service principal credentials. var keyClient = new KeyClient(new Uri(keyVaultUrl), new DefaultAzureCredential()); // First we create a RSA key which will be used to encrypt and decrypt string rsaKeyName = $"CloudRsaKey-{Guid.NewGuid()}"; var rsaKey = new CreateRsaKeyOptions(rsaKeyName, hardwareProtected: false) { KeySize = 2048, }; KeyVaultKey cloudRsaKey = await keyClient.CreateRsaKeyAsync(rsaKey); Debug.WriteLine($"Key is returned with name {cloudRsaKey.Name} and type {cloudRsaKey.KeyType}"); // Then we create the CryptographyClient which can perform cryptographic operations with the key we just created. // Again we are using the default Azure credential as above. var cryptoClient = new CryptographyClient(cloudRsaKey.Id, new DefaultAzureCredential()); // Next we'll encrypt some arbitrary plain text with the key using the CryptographyClient. Note that RSA encryption // algorithms have no chaining so they can only encrypt a single block of plaintext securely. For RSAOAEP this can be // calculated as (keysize / 8) - 42, or in our case (2048 / 8) - 42 = 214 bytes. byte[] plaintext = Encoding.UTF8.GetBytes("A single block of plaintext"); // First encrypt the data using RSAOAEP with the created key. EncryptResult encryptResult = await cryptoClient.EncryptAsync(EncryptionAlgorithm.RsaOaep, plaintext); Debug.WriteLine($"Encrypted data using the algorithm {encryptResult.Algorithm}, with key {encryptResult.KeyId}. The resulting encrypted data is {Convert.ToBase64String(encryptResult.Ciphertext)}"); // Now decrypt the encrypted data. Note that the same algorithm must always be used for both encrypt and decrypt DecryptResult decryptResult = await cryptoClient.DecryptAsync(EncryptionAlgorithm.RsaOaep, encryptResult.Ciphertext); Debug.WriteLine($"Decrypted data using the algorithm {decryptResult.Algorithm}, with key {decryptResult.KeyId}. The resulting decrypted data is {Encoding.UTF8.GetString(decryptResult.Plaintext)}"); // The Cloud RSA Key is no longer needed, need to delete it from the Key Vault. await keyClient.DeleteKeyAsync(rsaKeyName); // To ensure key is deleted on server side. Assert.IsTrue(await WaitForDeletedKeyAsync(keyClient, rsaKeyName)); // If the keyvault is soft-delete enabled, then for permanent deletion, deleted key needs to be purged. await keyClient.PurgeDeletedKeyAsync(rsaKeyName); }
public async Task WrapUnwrapAsync() { // Environment variable with the Key Vault endpoint. string keyVaultUrl = Environment.GetEnvironmentVariable("AZURE_KEYVAULT_URL"); // Instantiate a key client that will be used to create a key. Notice that the client is using default Azure // credentials. To make default credentials work, ensure that environment variables 'AZURE_CLIENT_ID', // 'AZURE_CLIENT_KEY' and 'AZURE_TENANT_ID' are set with the service principal credentials. var keyClient = new KeyClient(new Uri(keyVaultUrl), new DefaultAzureCredential()); // First create a RSA key which will be used to wrap and unwrap another key string rsaKeyName = $"CloudRsaKey-{Guid.NewGuid()}"; var rsaKey = new CreateRsaKeyOptions(rsaKeyName, hardwareProtected: false) { KeySize = 2048, }; KeyVaultKey cloudRsaKey = await keyClient.CreateRsaKeyAsync(rsaKey); Debug.WriteLine($"Key is returned with name {cloudRsaKey.Name} and type {cloudRsaKey.KeyType}"); // Let's create the CryptographyClient which can perform cryptographic operations with the key we just created. // Again we are using the default Azure credential as above. var cryptoClient = new CryptographyClient(cloudRsaKey.Id, new DefaultAzureCredential()); // Next we'll generate a symmetric key which we will wrap byte[] keyData = AesManaged.Create().Key; Debug.WriteLine($"Generated Key: {Convert.ToBase64String(keyData)}"); // Wrap the key using RSAOAEP with the created key. WrapResult wrapResult = await cryptoClient.WrapKeyAsync(KeyWrapAlgorithm.RsaOaep, keyData); Debug.WriteLine($"Encrypted data using the algorithm {wrapResult.Algorithm}, with key {wrapResult.KeyId}. The resulting encrypted data is {Convert.ToBase64String(wrapResult.EncryptedKey)}"); // Now unwrap the encrypted key. Note that the same algorithm must always be used for both wrap and unwrap UnwrapResult unwrapResult = await cryptoClient.UnwrapKeyAsync(KeyWrapAlgorithm.RsaOaep, wrapResult.EncryptedKey); Debug.WriteLine($"Decrypted data using the algorithm {unwrapResult.Algorithm}, with key {unwrapResult.KeyId}. The resulting decrypted data is {Encoding.UTF8.GetString(unwrapResult.Key)}"); // The Cloud RSA Key is no longer needed, need to delete it from the Key Vault. await keyClient.DeleteKeyAsync(rsaKeyName); // To ensure key is deleted on server side. Assert.IsTrue(await WaitForDeletedKeyAsync(keyClient, rsaKeyName)); // If the keyvault is soft-delete enabled, then for permanent deletion, deleted key needs to be purged. await keyClient.PurgeDeletedKeyAsync(rsaKeyName); }
public async Task BackupAndRestoreAsync() { // Environment variable with the Key Vault endpoint. string keyVaultUrl = Environment.GetEnvironmentVariable("AZURE_KEYVAULT_URL"); // Instantiate a key client that will be used to call the service. Notice that the client is using default Azure // credentials. To make default credentials work, ensure that environment variables 'AZURE_CLIENT_ID', // 'AZURE_CLIENT_KEY' and 'AZURE_TENANT_ID' are set with the service principal credentials. var client = new KeyClient(new Uri(keyVaultUrl), new DefaultAzureCredential()); // Let's create a RSA key valid for 1 year. If the key // already exists in the Key Vault, then a new version of the key is created. string rsaKeyName = $"CloudRsaKey-{Guid.NewGuid()}"; var rsaKey = new CreateRsaKeyOptions(rsaKeyName, hardwareProtected: false) { KeySize = 2048, ExpiresOn = DateTimeOffset.Now.AddYears(1) }; KeyVaultKey storedKey = await client.CreateRsaKeyAsync(rsaKey); // Backups are good to have if in case keys get accidentally deleted by you. // For long term storage, it is ideal to write the backup to a file, disk, database, etc. // For the purposes of this sample, we are storing the bakup in a temporary memory area. byte[] byteKey = await client.BackupKeyAsync(rsaKeyName); using (var memoryStream = new MemoryStream()) { memoryStream.Write(byteKey, 0, byteKey.Length); // The storage account key is no longer in use, so you delete it. await client.DeleteKeyAsync(rsaKeyName); // To ensure the key is deleted on server side. Assert.IsTrue(await WaitForDeletedKeyAsync(client, rsaKeyName)); // If the keyvault is soft-delete enabled, then for permanent deletion, deleted key needs to be purged. await client.PurgeDeletedKeyAsync(rsaKeyName); // After sometime, the key is required again. We can use the backup value to restore it in the Key Vault. KeyVaultKey restoredKey = await client.RestoreKeyBackupAsync(memoryStream.ToArray()); AssertKeysEqual(storedKey.Properties, restoredKey.Properties); } }
public async Task GetKeysAsync() { // Environment variable with the Key Vault endpoint. string keyVaultUrl = Environment.GetEnvironmentVariable("AZURE_KEYVAULT_URL"); // Instantiate a key client that will be used to call the service. Notice that the client is using default Azure // credentials. To make default credentials work, ensure that environment variables 'AZURE_CLIENT_ID', // 'AZURE_CLIENT_KEY' and 'AZURE_TENANT_ID' are set with the service principal credentials. var client = new KeyClient(new Uri(keyVaultUrl), new DefaultAzureCredential()); // Let's create EC and RSA keys valid for 1 year. If the key // already exists in the Key Vault, then a new version of the key is created. string rsaKeyName = $"CloudRsaKey-{Guid.NewGuid()}"; var rsaKey = new RsaKeyCreateOptions(rsaKeyName, hsm: false, keySize: 2048) { Expires = DateTimeOffset.Now.AddYears(1) }; await client.CreateRsaKeyAsync(rsaKey); string ecKeyName = $"CloudECKey-{Guid.NewGuid()}"; var ecKey = new EcKeyCreateOptions(ecKeyName, hsm: false) { Expires = DateTimeOffset.Now.AddYears(1) }; await client.CreateEcKeyAsync(ecKey); // You need to check the type of keys that already exist in your Key Vault. // Let's list the keys and print their types. // List operations don't return the keys with key material information. // So, for each returned key we call GetKey to get the key with its key material information. await foreach (KeyBase key in client.GetKeysAsync()) { Key keyWithType = await client.GetKeyAsync(key.Name); Debug.WriteLine($"Key is returned with name {keyWithType.Name} and type {keyWithType.KeyMaterial.KeyType}"); } // We need the Cloud RSA key with bigger key size, so you want to update the key in Key Vault to ensure // it has the required size. // Calling CreateRsaKey on an existing key creates a new version of the key in the Key Vault // with the new specified size. var newRsaKey = new RsaKeyCreateOptions(rsaKeyName, hsm: false, keySize: 4096) { Expires = DateTimeOffset.Now.AddYears(1) }; await client.CreateRsaKeyAsync(newRsaKey); // You need to check all the different versions Cloud RSA key had previously. // Lets print all the versions of this key. await foreach (KeyBase key in client.GetKeyVersionsAsync(rsaKeyName)) { Debug.WriteLine($"Key's version {key.Version} with name {key.Name}"); } // The Cloud RSA Key and the Cloud EC Key are no longer needed. // You need to delete them from the Key Vault. await client.DeleteKeyAsync(rsaKeyName); await client.DeleteKeyAsync(ecKeyName); // To ensure secrets are deleted on server side. Assert.IsTrue(await WaitForDeletedKeyAsync(client, rsaKeyName)); Assert.IsTrue(await WaitForDeletedKeyAsync(client, ecKeyName)); // You can list all the deleted and non-purged keys, assuming Key Vault is soft-delete enabled. await foreach (DeletedKey key in client.GetDeletedKeysAsync()) { Debug.WriteLine($"Deleted key's recovery Id {key.RecoveryId}"); } // If the keyvault is soft-delete enabled, then for permanent deletion, deleted keys needs to be purged. await client.PurgeDeletedKeyAsync(rsaKeyName); await client.PurgeDeletedKeyAsync(ecKeyName); }
public async Task SignVerifyAsync() { // Environment variable with the Key Vault endpoint. string keyVaultUrl = Environment.GetEnvironmentVariable("AZURE_KEYVAULT_URL"); // Instantiate a key client that will be used to create a key. Notice that the client is using default Azure // credentials. To make default credentials work, ensure that environment variables 'AZURE_CLIENT_ID', // 'AZURE_CLIENT_KEY' and 'AZURE_TENANT_ID' are set with the service principal credentials. var keyClient = new KeyClient(new Uri(keyVaultUrl), new DefaultAzureCredential()); // First we'll create both a RSA key and an EC which will be used to sign and verify string rsaKeyName = $"CloudRsaKey-{Guid.NewGuid()}"; var rsaKey = new RsaKeyCreateOptions(rsaKeyName, hsm: false, keySize: 2048); string ecKeyName = $"CloudEcKey-{Guid.NewGuid()}"; var ecKey = new EcKeyCreateOptions(ecKeyName, hsm: false, curveName: KeyCurveName.P256K); Key cloudRsaKey = await keyClient.CreateRsaKeyAsync(rsaKey); Debug.WriteLine($"Key is returned with name {cloudRsaKey.Name} and type {cloudRsaKey.KeyMaterial.KeyType}"); Key cloudEcKey = await keyClient.CreateEcKeyAsync(ecKey); Debug.WriteLine($"Key is returned with name {cloudEcKey.Name} and type {cloudEcKey.KeyMaterial.KeyType}"); // Let's create the CryptographyClient which can perform cryptographic operations with the keys we just created. // Again we are using the default Azure credential as above. var rsaCryptoClient = new CryptographyClient(cloudRsaKey.Id, new DefaultAzureCredential()); var ecCryptoClient = new CryptographyClient(cloudEcKey.Id, new DefaultAzureCredential()); // Next we'll sign some arbitrary data and verify the signatures using the CryptographyClient with both the EC and RSA keys we created. byte[] data = Encoding.UTF8.GetBytes("This is some sample data which we will use to demonstrate sign and verify"); byte[] digest = null; // // Signing with the SignAsync and VerifyAsync methods // // The SignAsync and VerifyAsync methods expect a precalculated digest, and the digest needs to be calculated using the hash algorithm which matches the // singature algorithm being used. SHA256 is the hash algorithm used for both RS256 and ES256K which are the algorithms we'll be using in this sample using (HashAlgorithm hashAlgo = SHA256.Create()) { digest = hashAlgo.ComputeHash(data); } // Get the signature for the computed digest with both keys. Note that the signature algorithm specified must be a valid algorithm for the key type, // and for EC keys the algorithm must also match the curve of the key SignResult rsaSignResult = await rsaCryptoClient.SignAsync(SignatureAlgorithm.RS256, digest); Debug.WriteLine($"Signed digest using the algorithm {rsaSignResult.Algorithm}, with key {rsaSignResult.KeyId}. The resulting signature is {Convert.ToBase64String(rsaSignResult.Signature)}"); SignResult ecSignResult = await ecCryptoClient.SignAsync(SignatureAlgorithm.ES256K, digest); Debug.WriteLine($"Signed digest using the algorithm {ecSignResult.Algorithm}, with key {ecSignResult.KeyId}. The resulting signature is {Convert.ToBase64String(ecSignResult.Signature)}"); // Verify the signatures VerifyResult rsaVerifyResult = await rsaCryptoClient.VerifyAsync(SignatureAlgorithm.RS256, digest, rsaSignResult.Signature); Debug.WriteLine($"Verified the signature using the algorithm {rsaVerifyResult.Algorithm}, with key {rsaVerifyResult.KeyId}. Signature is valid: {rsaVerifyResult.IsValid}"); VerifyResult ecVerifyResult = await ecCryptoClient.VerifyAsync(SignatureAlgorithm.ES256K, digest, ecSignResult.Signature); Debug.WriteLine($"Verified the signature using the algorithm {ecVerifyResult.Algorithm}, with key {ecVerifyResult.KeyId}. Signature is valid: {ecVerifyResult.IsValid}"); // // Signing with the SignDataAsync and VerifyDataAsync methods // // The SignDataAsync and VerifyDataAsync methods take the raw data which is to be signed. The calculate the digest for the user so there is no need to compute the digest // Get the signature for the data with both keys. Note that the signature algorithm specified must be a valid algorithm for the key type, // and for EC keys the algorithm must also match the curve of the key SignResult rsaSignDataResult = await rsaCryptoClient.SignDataAsync(SignatureAlgorithm.RS256, data); Debug.WriteLine($"Signed data using the algorithm {rsaSignDataResult.Algorithm}, with key {rsaSignDataResult.KeyId}. The resulting signature is {Convert.ToBase64String(rsaSignDataResult.Signature)}"); SignResult ecSignDataResult = await ecCryptoClient.SignDataAsync(SignatureAlgorithm.ES256K, data); Debug.WriteLine($"Signed data using the algorithm {ecSignDataResult.Algorithm}, with key {ecSignDataResult.KeyId}. The resulting signature is {Convert.ToBase64String(ecSignDataResult.Signature)}"); // Verify the signatures VerifyResult rsaVerifyDataResult = await rsaCryptoClient.VerifyDataAsync(SignatureAlgorithm.RS256, data, rsaSignDataResult.Signature); Debug.WriteLine($"Verified the signature using the algorithm {rsaVerifyDataResult.Algorithm}, with key {rsaVerifyDataResult.KeyId}. Signature is valid: {rsaVerifyDataResult.IsValid}"); VerifyResult ecVerifyDataResult = await ecCryptoClient.VerifyDataAsync(SignatureAlgorithm.ES256K, data, ecSignDataResult.Signature); Debug.WriteLine($"Verified the signature using the algorithm {ecVerifyDataResult.Algorithm}, with key {ecVerifyDataResult.KeyId}. Signature is valid: {ecVerifyDataResult.IsValid}"); // The Cloud Keys are no longer needed, need to delete them from the Key Vault. await keyClient.DeleteKeyAsync(rsaKeyName); await keyClient.DeleteKeyAsync(ecKeyName); // To ensure the keys are deleted on server side. Assert.IsTrue(await WaitForDeletedKeyAsync(keyClient, rsaKeyName)); Assert.IsTrue(await WaitForDeletedKeyAsync(keyClient, ecKeyName)); // If the keyvault is soft-delete enabled, then for permanent deletion, deleted keys needs to be purged. await keyClient.PurgeDeletedKeyAsync(rsaKeyName); await keyClient.PurgeDeletedKeyAsync(ecKeyName); }