/// <summary>
/// Add an entry to the list of ColumnEncryptionKeyValues.
/// </summary>
/// <param name="encryptedKey"></param>
/// <param name="databaseId"></param>
/// <param name="cekId"></param>
/// <param name="cekVersion"></param>
/// <param name="cekMdVersion"></param>
/// <param name="keyPath"></param>
/// <param name="keyStoreName"></param>
/// <param name="algorithmName"></param>
internal void Add(byte[] encryptedKey, int databaseId, int cekId, int cekVersion, byte[] cekMdVersion, string keyPath, string keyStoreName, string algorithmName)
{
Debug.Assert(_columnEncryptionKeyValues != null, "_columnEncryptionKeyValues should already be initialized.");
SqlEncryptionKeyInfo encryptionKey = new SqlEncryptionKeyInfo();
encryptionKey.encryptedKey = encryptedKey;
encryptionKey.databaseId = databaseId;
encryptionKey.cekId = cekId;
encryptionKey.cekVersion = cekVersion;
encryptionKey.cekMdVersion = cekMdVersion;
encryptionKey.keyPath = keyPath;
encryptionKey.keyStoreName = keyStoreName;
encryptionKey.algorithmName = algorithmName;
_columnEncryptionKeyValues.Add(encryptionKey);
if (0 == _databaseId)
{
_databaseId = databaseId;
_cekId = cekId;
_cekVersion = cekVersion;
_cekMdVersion = cekMdVersion;
}
else
{
Debug.Assert(_databaseId == databaseId);
Debug.Assert(_cekId == cekId);
Debug.Assert(_cekVersion == cekVersion);
Debug.Assert(_cekMdVersion != null && cekMdVersion != null && _cekMdVersion.Length == _cekMdVersion.Length);
}
}
/// <summary>
/// <para> Retrieves Symmetric Key (in plaintext) given the encryption material.</para>
/// </summary>
internal bool GetKey (SqlEncryptionKeyInfo keyInfo, string serverName, out SqlClientSymmetricKey encryptionKey) {
Debug.Assert(serverName != null, @"serverName should not be null.");
StringBuilder cacheLookupKeyBuilder = new StringBuilder(serverName, capacity: serverName.Length + SqlSecurityUtility.GetBase64LengthFromByteLength(keyInfo.encryptedKey.Length) + keyInfo.keyStoreName.Length + 2/*separators*/);
#if DEBUG
int capacity = cacheLookupKeyBuilder.Capacity;
#endif //DEBUG
cacheLookupKeyBuilder.Append(":");
cacheLookupKeyBuilder.Append(Convert.ToBase64String(keyInfo.encryptedKey));
cacheLookupKeyBuilder.Append(":");
cacheLookupKeyBuilder.Append(keyInfo.keyStoreName);
string cacheLookupKey = cacheLookupKeyBuilder.ToString();
#if DEBUG
Debug.Assert(cacheLookupKey.Length <= capacity, "We needed to allocate a larger array");
#endif //DEBUG
// Lookup the key in cache
encryptionKey = _cache.Get(cacheLookupKey) as SqlClientSymmetricKey;
if (encryptionKey == null) {
Debug.Assert(SqlConnection.ColumnEncryptionTrustedMasterKeyPaths != null, @"SqlConnection.ColumnEncryptionTrustedMasterKeyPaths should not be null");
// Check against the trusted key paths
//
// Get the List corresponding to the connected server
IList<string> trustedKeyPaths;
if (SqlConnection.ColumnEncryptionTrustedMasterKeyPaths.TryGetValue(serverName, out trustedKeyPaths)) {
// If the list is null or is empty or if the keyPath doesn't exist in the trusted key paths, then throw an exception.
if ((trustedKeyPaths == null) || (trustedKeyPaths.Count() == 0) ||
// (trustedKeyPaths.Where(s => s.Equals(keyInfo.keyPath, StringComparison.InvariantCultureIgnoreCase)).Count() == 0)) {
(trustedKeyPaths.Any(s => s.Equals(keyInfo.keyPath, StringComparison.InvariantCultureIgnoreCase)) == false)) {
// throw an exception since the key path is not in the trusted key paths list for this server
throw SQL.UntrustedKeyPath(keyInfo.keyPath, serverName);
}
}
// Key Not found, attempt to look up the provider and decrypt CEK
SqlColumnEncryptionKeyStoreProvider provider;
if (!SqlConnection.TryGetColumnEncryptionKeyStoreProvider(keyInfo.keyStoreName, out provider)) {
throw SQL.UnrecognizedKeyStoreProviderName(keyInfo.keyStoreName,
SqlConnection.GetColumnEncryptionSystemKeyStoreProviders(),
SqlConnection.GetColumnEncryptionCustomKeyStoreProviders());
}
// Decrypt the CEK
// We will simply bubble up the exception from the DecryptColumnEncryptionKey function.
byte[] plaintextKey;
try {
plaintextKey = provider.DecryptColumnEncryptionKey(keyInfo.keyPath, keyInfo.algorithmName, keyInfo.encryptedKey);
}
catch (Exception e) {
// Generate a new exception and throw.
string keyHex = SqlSecurityUtility.GetBytesAsString(keyInfo.encryptedKey, fLast:true, countOfBytes:10);
throw SQL.KeyDecryptionFailed (keyInfo.keyStoreName, keyHex, e);
}
encryptionKey = new SqlClientSymmetricKey (plaintextKey);
// If the cache TTL is zero, don't even bother inserting to the cache.
if (SqlConnection.ColumnEncryptionKeyCacheTtl != TimeSpan.Zero) {
// In case multiple threads reach here at the same time, the first one wins.
// The allocated memory will be reclaimed by Garbage Collector.
DateTimeOffset expirationTime = DateTimeOffset.UtcNow.Add(SqlConnection.ColumnEncryptionKeyCacheTtl);
_cache.Add(cacheLookupKey, encryptionKey, expirationTime);
}
}
return true;
}
/// <summary>
/// Add an entry to the list of ColumnEncryptionKeyValues.
/// </summary>
/// <param name="encryptedKey"></param>
/// <param name="databaseId"></param>
/// <param name="cekId"></param>
/// <param name="cekVersion"></param>
/// <param name="cekMdVersion"></param>
/// <param name="keyPath"></param>
/// <param name="keyStoreName"></param>
/// <param name="algorithmName"></param>
internal void Add(byte[] encryptedKey, int databaseId, int cekId, int cekVersion, byte[] cekMdVersion, string keyPath, string keyStoreName, string algorithmName) {
Debug.Assert(_columnEncryptionKeyValues != null, "_columnEncryptionKeyValues should already be initialized.");
SqlEncryptionKeyInfo encryptionKey = new SqlEncryptionKeyInfo();
encryptionKey.encryptedKey = encryptedKey;
encryptionKey.databaseId = databaseId;
encryptionKey.cekId = cekId;
encryptionKey.cekVersion = cekVersion;
encryptionKey.cekMdVersion = cekMdVersion;
encryptionKey.keyPath = keyPath;
encryptionKey.keyStoreName = keyStoreName;
encryptionKey.algorithmName = algorithmName;
_columnEncryptionKeyValues.Add(encryptionKey);
if (0 == _databaseId) {
_databaseId = databaseId;
_cekId = cekId;
_cekVersion = cekVersion;
_cekMdVersion = cekMdVersion;
}
else {
Debug.Assert(_databaseId == databaseId);
Debug.Assert(_cekId == cekId);
Debug.Assert(_cekVersion == cekVersion);
Debug.Assert (_cekMdVersion != null && cekMdVersion != null && _cekMdVersion.Length == _cekMdVersion.Length);
}
}
/// <summary>
/// <para> Retrieves Symmetric Key (in plaintext) given the encryption material.</para>
/// </summary>
internal bool GetKey(SqlEncryptionKeyInfo keyInfo, string serverName, out SqlClientSymmetricKey encryptionKey)
{
Debug.Assert(serverName != null, @"serverName should not be null.");
StringBuilder cacheLookupKeyBuilder = new StringBuilder(serverName, capacity: serverName.Length + SqlSecurityUtility.GetBase64LengthFromByteLength(keyInfo.encryptedKey.Length) + keyInfo.keyStoreName.Length + 2 /*separators*/);
#if DEBUG
int capacity = cacheLookupKeyBuilder.Capacity;
#endif //DEBUG
cacheLookupKeyBuilder.Append(":");
cacheLookupKeyBuilder.Append(Convert.ToBase64String(keyInfo.encryptedKey));
cacheLookupKeyBuilder.Append(":");
cacheLookupKeyBuilder.Append(keyInfo.keyStoreName);
string cacheLookupKey = cacheLookupKeyBuilder.ToString();
#if DEBUG
Debug.Assert(cacheLookupKey.Length <= capacity, "We needed to allocate a larger array");
#endif //DEBUG
// Lookup the key in cache
encryptionKey = _cache.Get(cacheLookupKey) as SqlClientSymmetricKey;
if (encryptionKey == null)
{
Debug.Assert(SqlConnection.ColumnEncryptionTrustedMasterKeyPaths != null, @"SqlConnection.ColumnEncryptionTrustedMasterKeyPaths should not be null");
// Check against the trusted key paths
//
// Get the List corresponding to the connected server
IList <string> trustedKeyPaths;
if (SqlConnection.ColumnEncryptionTrustedMasterKeyPaths.TryGetValue(serverName, out trustedKeyPaths))
{
// If the list is null or is empty or if the keyPath doesn't exist in the trusted key paths, then throw an exception.
if ((trustedKeyPaths == null) || (trustedKeyPaths.Count() == 0) ||
// (trustedKeyPaths.Where(s => s.Equals(keyInfo.keyPath, StringComparison.InvariantCultureIgnoreCase)).Count() == 0)) {
(trustedKeyPaths.Any(s => s.Equals(keyInfo.keyPath, StringComparison.InvariantCultureIgnoreCase)) == false))
{
// throw an exception since the key path is not in the trusted key paths list for this server
throw SQL.UntrustedKeyPath(keyInfo.keyPath, serverName);
}
}
// Key Not found, attempt to look up the provider and decrypt CEK
SqlColumnEncryptionKeyStoreProvider provider;
if (!SqlConnection.TryGetColumnEncryptionKeyStoreProvider(keyInfo.keyStoreName, out provider))
{
throw SQL.UnrecognizedKeyStoreProviderName(keyInfo.keyStoreName,
SqlConnection.GetColumnEncryptionSystemKeyStoreProviders(),
SqlConnection.GetColumnEncryptionCustomKeyStoreProviders());
}
// Decrypt the CEK
// We will simply bubble up the exception from the DecryptColumnEncryptionKey function.
byte[] plaintextKey;
try {
plaintextKey = provider.DecryptColumnEncryptionKey(keyInfo.keyPath, keyInfo.algorithmName, keyInfo.encryptedKey);
}
catch (Exception e) {
// Generate a new exception and throw.
string keyHex = SqlSecurityUtility.GetBytesAsString(keyInfo.encryptedKey, fLast: true, countOfBytes: 10);
throw SQL.KeyDecryptionFailed(keyInfo.keyStoreName, keyHex, e);
}
encryptionKey = new SqlClientSymmetricKey(plaintextKey);
// If the cache TTL is zero, don't even bother inserting to the cache.
if (SqlConnection.ColumnEncryptionKeyCacheTtl != TimeSpan.Zero)
{
// In case multiple threads reach here at the same time, the first one wins.
// The allocated memory will be reclaimed by Garbage Collector.
DateTimeOffset expirationTime = DateTimeOffset.UtcNow.Add(SqlConnection.ColumnEncryptionKeyCacheTtl);
_cache.Add(cacheLookupKey, encryptionKey, expirationTime);
}
}
return(true);
}
