public void InitializesIv(EncryptionAlgorithm algorithm)
{
// Use a 256-bit key which will be truncated based on the selected algorithm.
byte[] k = new byte[] { 0xe2, 0x7e, 0xd0, 0xc8, 0x45, 0x12, 0xbb, 0xd5, 0x5b, 0x6a, 0xf4, 0x34, 0xd2, 0x37, 0xc1, 0x1f, 0xeb, 0xa3, 0x11, 0x87, 0x0f, 0x80, 0xf2, 0xc2, 0xe3, 0x36, 0x42, 0x60, 0xf3, 0x1c, 0x82, 0xc8 };
JsonWebKey key = new JsonWebKey(new[] { KeyOperation.Encrypt, KeyOperation.Decrypt })
{
K = k,
};
AesCryptographyProvider provider = new AesCryptographyProvider(key, null);
byte[] plaintext = Encoding.UTF8.GetBytes("plaintext");
EncryptOptions encryptOptions = new EncryptOptions(algorithm, plaintext, null, null);
EncryptResult encrypted = provider.Encrypt(encryptOptions, default);
Assert.IsNotNull(encryptOptions.Iv);
CollectionAssert.AreEqual(encryptOptions.Iv, encrypted.Iv);
DecryptOptions decryptOptions = new DecryptOptions(algorithm, encrypted.Ciphertext, encrypted.Iv);
DecryptResult decrypted = provider.Decrypt(decryptOptions, default);
Assert.IsNotNull(decrypted);
// AES-CBC will be zero-padded.
StringAssert.StartsWith("plaintext", Encoding.UTF8.GetString(decrypted.Plaintext));
}
/// <summary>
///
/// </summary>
/// <param name="opts"></param>
/// <returns></returns>
private static string Decrypt(DecryptOptions opts)
{
var decryptedString = StringCipher.Decrypt(opts.CipherString, opts.PassPhrase);
var result = $"Decrypted string [{decryptedString}] generated by decrypting cipher string [{opts.CipherString}] with pass phrase [{opts.PassPhrase}]";
DisplayOutput(result);
return(decryptedString);
}
public void Setup()
{
options = new DecryptOptions
{
IdentityPem = "IDENTITY KEY PEM DATA",
IdentityPoint = "AmUppru04ghsI/FvbvV59eoX3lCUWlMAZKu1pPdlvixch5avV+aFwQg=",
PseudoKeyPem = "PSEUDONYM KEY PEM DATA",
PseudoClosingKeyPem = "PSEUDONYM CLOSING KEY PEM DATA",
PseudonymPoint = "A9GtKDUn++nl2NWtN4F/2id1gmBhxn4I6Qr9BfeMN+fjNuXGvE79qHc="
};
}
public void DecryptOptionsOnlyRequired()
{
byte[] buffer = new byte[] { 0, 1, 2, 3 };
DecryptOptions options = CryptographyModelFactory.DecryptOptions(EncryptionAlgorithm.A128Cbc, buffer, null, null);
Assert.AreEqual(EncryptionAlgorithm.A128Cbc, options.Algorithm);
CollectionAssert.AreEqual(buffer, options.Ciphertext);
Assert.IsNull(options.Iv);
Assert.IsNull(options.AuthenticationTag);
Assert.IsNull(options.AdditionalAuthenticatedData);
}
public void RequiresCiphertext()
{
ArgumentNullException ex = Assert.Throws <ArgumentNullException>(() => DecryptOptions.Rsa15Options(null));
Assert.AreEqual("ciphertext", ex.ParamName);
ex = Assert.Throws <ArgumentNullException>(() => DecryptOptions.RsaOaepOptions(null));
Assert.AreEqual("ciphertext", ex.ParamName);
ex = Assert.Throws <ArgumentNullException>(() => DecryptOptions.RsaOaep256Options(null));
Assert.AreEqual("ciphertext", ex.ParamName);
}
private static void DecryptWallet(DecryptOptions options)
{
string path = options.WalletPath;
path = Path.IsPathRooted(path) || path.StartsWith("~/")
? path
: Path.Join(Path.GetDirectoryName(Path.GetFullPath(path)), path);
var encryptedContent = File.ReadAllBytes(path);
var key = Encoding.UTF8.GetBytes(options.WalletPassword).KeccakBytes();
var crypto = CryptoProvider.GetCrypto();
var decryptedContent =
Encoding.UTF8.GetString(crypto.AesGcmDecrypt(key, encryptedContent));
System.Console.WriteLine(decryptedContent);
}
public static int RunDecrypt(DecryptOptions opts)
{
try
{
var collection = new X509Certificate2Collection();
collection.Import(opts.CertificatePath, opts.Password, X509KeyStorageFlags.PersistKeySet);
var cert = collection[0];
var encryptedTotal = File.ReadAllBytes(opts.FilePath);
var simmKeyIVEncrypted = encryptedTotal.Skip(Math.Max(0, encryptedTotal.Count() - 512)).ToArray();
var simmKeyEncrypted = simmKeyIVEncrypted.Take(256).ToArray();
var simmIVEncrypted = simmKeyIVEncrypted.Skip(256).ToArray();
using (var rsa = cert.GetRSAPrivateKey())
{
var decryptedKey = rsa.Decrypt(simmKeyEncrypted, RSAEncryptionPadding.OaepSHA1);
var decryptedIV = rsa.Decrypt(simmIVEncrypted, RSAEncryptionPadding.OaepSHA1);
var tdes = new TripleDESCryptoServiceProvider
{
Key = decryptedKey,
IV = decryptedIV
};
var decryptor = tdes.CreateDecryptor();
var payload = encryptedTotal.Take(encryptedTotal.Count() - 512).ToArray();
using (var msDecrypt = new MemoryStream(payload))
{
using (var csDecrypt = new CryptoStream(msDecrypt, decryptor, CryptoStreamMode.Read))
{
using (var srDecrypt = new StreamReader(csDecrypt))
{
var res = srDecrypt.ReadToEnd();
File.WriteAllText(opts.Output, res);
}
}
}
}
}
catch (Exception e)
{
return(-1);
}
return(0);
}
public void RequiresCiphertextIv()
{
ArgumentNullException ex = Assert.Throws <ArgumentNullException>(() => DecryptOptions.A128CbcOptions(null, null));
Assert.AreEqual("ciphertext", ex.ParamName);
ex = Assert.Throws <ArgumentNullException>(() => DecryptOptions.A128CbcOptions(Array.Empty <byte>(), null));
Assert.AreEqual("iv", ex.ParamName);
ex = Assert.Throws <ArgumentNullException>(() => DecryptOptions.A192CbcOptions(null, null));
Assert.AreEqual("ciphertext", ex.ParamName);
ex = Assert.Throws <ArgumentNullException>(() => DecryptOptions.A192CbcOptions(Array.Empty <byte>(), null));
Assert.AreEqual("iv", ex.ParamName);
ex = Assert.Throws <ArgumentNullException>(() => DecryptOptions.A256CbcOptions(null, null));
Assert.AreEqual("ciphertext", ex.ParamName);
ex = Assert.Throws <ArgumentNullException>(() => DecryptOptions.A256CbcOptions(Array.Empty <byte>(), null));
Assert.AreEqual("iv", ex.ParamName);
ex = Assert.Throws <ArgumentNullException>(() => DecryptOptions.A128CbcPadOptions(null, null));
Assert.AreEqual("ciphertext", ex.ParamName);
ex = Assert.Throws <ArgumentNullException>(() => DecryptOptions.A128CbcPadOptions(Array.Empty <byte>(), null));
Assert.AreEqual("iv", ex.ParamName);
ex = Assert.Throws <ArgumentNullException>(() => DecryptOptions.A192CbcPadOptions(null, null));
Assert.AreEqual("ciphertext", ex.ParamName);
ex = Assert.Throws <ArgumentNullException>(() => DecryptOptions.A192CbcPadOptions(Array.Empty <byte>(), null));
Assert.AreEqual("iv", ex.ParamName);
ex = Assert.Throws <ArgumentNullException>(() => DecryptOptions.A256CbcPadOptions(null, null));
Assert.AreEqual("ciphertext", ex.ParamName);
ex = Assert.Throws <ArgumentNullException>(() => DecryptOptions.A256CbcPadOptions(Array.Empty <byte>(), null));
Assert.AreEqual("iv", ex.ParamName);
}
public void RequiresOnlyCiphertextIvAuthenticationTag()
{
ArgumentNullException ex = Assert.Throws <ArgumentNullException>(() => DecryptOptions.A128GcmOptions(null, null, null, null));
Assert.AreEqual("ciphertext", ex.ParamName);
ex = Assert.Throws <ArgumentNullException>(() => DecryptOptions.A128GcmOptions(Array.Empty <byte>(), null, null, null));
Assert.AreEqual("iv", ex.ParamName);
ex = Assert.Throws <ArgumentNullException>(() => DecryptOptions.A128GcmOptions(Array.Empty <byte>(), Array.Empty <byte>(), null, null));
Assert.AreEqual("authenticationTag", ex.ParamName);
Assert.DoesNotThrow(() => DecryptOptions.A128GcmOptions(Array.Empty <byte>(), Array.Empty <byte>(), Array.Empty <byte>(), null));
ex = Assert.Throws <ArgumentNullException>(() => DecryptOptions.A192GcmOptions(null, null, null, null));
Assert.AreEqual("ciphertext", ex.ParamName);
ex = Assert.Throws <ArgumentNullException>(() => DecryptOptions.A192GcmOptions(Array.Empty <byte>(), null, null, null));
Assert.AreEqual("iv", ex.ParamName);
ex = Assert.Throws <ArgumentNullException>(() => DecryptOptions.A192GcmOptions(Array.Empty <byte>(), Array.Empty <byte>(), null, null));
Assert.AreEqual("authenticationTag", ex.ParamName);
Assert.DoesNotThrow(() => DecryptOptions.A192GcmOptions(Array.Empty <byte>(), Array.Empty <byte>(), Array.Empty <byte>(), null));
ex = Assert.Throws <ArgumentNullException>(() => DecryptOptions.A256GcmOptions(null, null, null, null));
Assert.AreEqual("ciphertext", ex.ParamName);
ex = Assert.Throws <ArgumentNullException>(() => DecryptOptions.A256GcmOptions(Array.Empty <byte>(), null, null, null));
Assert.AreEqual("iv", ex.ParamName);
ex = Assert.Throws <ArgumentNullException>(() => DecryptOptions.A256GcmOptions(Array.Empty <byte>(), Array.Empty <byte>(), null, null));
Assert.AreEqual("authenticationTag", ex.ParamName);
Assert.DoesNotThrow(() => DecryptOptions.A256GcmOptions(Array.Empty <byte>(), Array.Empty <byte>(), Array.Empty <byte>(), null));
}
public static IList <string> Validate(DecryptOptions options)
{
return(Validate(options as CommonOptions));
}
public void EncryptDecryptRoundtrips(EncryptionAlgorithm algorithm)
{
// Use a 256-bit key which will be truncated based on the selected algorithm.
byte[] k = new byte[] { 0xe2, 0x7e, 0xd0, 0xc8, 0x45, 0x12, 0xbb, 0xd5, 0x5b, 0x6a, 0xf4, 0x34, 0xd2, 0x37, 0xc1, 0x1f, 0xeb, 0xa3, 0x11, 0x87, 0x0f, 0x80, 0xf2, 0xc2, 0xe3, 0x36, 0x42, 0x60, 0xf3, 0x1c, 0x82, 0xc8 };
byte[] iv = new byte[] { 0x89, 0xb8, 0xad, 0xbf, 0xb0, 0x73, 0x45, 0xe3, 0x59, 0x89, 0x32, 0xa0, 0x9c, 0x51, 0x74, 0x41 };
byte[] aad = Encoding.UTF8.GetBytes("test");
JsonWebKey key = new JsonWebKey(new[] { KeyOperation.Encrypt, KeyOperation.Decrypt })
{
K = k,
};
AesCryptographyProvider provider = new AesCryptographyProvider(key, null);
byte[] plaintext = Encoding.UTF8.GetBytes("plaintext");
if (algorithm.IsAesGcm())
{
iv = iv.Take(AesGcmProxy.NonceByteSize);
}
EncryptOptions encryptOptions = new EncryptOptions(algorithm, plaintext, iv, aad);
EncryptResult encrypted = provider.Encrypt(encryptOptions, default);
#if !NETCOREAPP3_1
if (algorithm.IsAesGcm())
{
Assert.IsNull(encrypted);
Assert.Ignore($"AES-GCM is not supported on {RuntimeInformation.FrameworkDescription} on {RuntimeInformation.OSDescription}");
}
#endif
Assert.IsNotNull(encrypted);
switch (algorithm.ToString())
{
// TODO: Move to new test to make sure CryptoClient and LocalCryptoClient initialize a null ICM for AES-CBC(PAD).
case EncryptionAlgorithm.A128CbcValue:
CollectionAssert.AreEqual(
new byte[] { 0x63, 0x23, 0x21, 0xaf, 0x94, 0xf9, 0xe1, 0x21, 0xc2, 0xbd, 0xb1, 0x1b, 0x04, 0x89, 0x8c, 0x3a },
encrypted.Ciphertext);
CollectionAssert.AreEqual(iv, encrypted.Iv);
Assert.IsNull(encrypted.AuthenticationTag);
Assert.IsNull(encrypted.AdditionalAuthenticatedData);
break;
case EncryptionAlgorithm.A192CbcValue:
CollectionAssert.AreEqual(
new byte[] { 0x95, 0x9d, 0x75, 0x91, 0x09, 0x8b, 0x70, 0x0b, 0x9c, 0xfe, 0xaf, 0xcd, 0x60, 0x1f, 0xaa, 0x79 },
encrypted.Ciphertext);
CollectionAssert.AreEqual(iv, encrypted.Iv);
Assert.IsNull(encrypted.AuthenticationTag);
Assert.IsNull(encrypted.AdditionalAuthenticatedData);
break;
case EncryptionAlgorithm.A256CbcValue:
CollectionAssert.AreEqual(
new byte[] { 0xf4, 0xe8, 0x5a, 0xa4, 0xa8, 0xb3, 0xff, 0xc3, 0x85, 0x89, 0x17, 0x9a, 0x70, 0x09, 0x96, 0x7f },
encrypted.Ciphertext);
CollectionAssert.AreEqual(iv, encrypted.Iv);
Assert.IsNull(encrypted.AuthenticationTag);
Assert.IsNull(encrypted.AdditionalAuthenticatedData);
break;
case EncryptionAlgorithm.A128CbcPadValue:
CollectionAssert.AreEqual(
new byte[] { 0xec, 0xb2, 0x63, 0x4c, 0xe0, 0x04, 0xe0, 0x31, 0x2d, 0x9a, 0x77, 0xb2, 0x11, 0xe5, 0x28, 0x7f },
encrypted.Ciphertext);
CollectionAssert.AreEqual(iv, encrypted.Iv);
Assert.IsNull(encrypted.AuthenticationTag);
Assert.IsNull(encrypted.AdditionalAuthenticatedData);
break;
case EncryptionAlgorithm.A192CbcPadValue:
CollectionAssert.AreEqual(
new byte[] { 0xc3, 0x4e, 0x1b, 0xe7, 0x6e, 0xa1, 0xf1, 0xc3, 0x24, 0xae, 0x05, 0x1b, 0x0e, 0x32, 0xac, 0xb4 },
encrypted.Ciphertext);
CollectionAssert.AreEqual(iv, encrypted.Iv);
Assert.IsNull(encrypted.AuthenticationTag);
Assert.IsNull(encrypted.AdditionalAuthenticatedData);
break;
case EncryptionAlgorithm.A256CbcPadValue:
CollectionAssert.AreEqual(
new byte[] { 0x4e, 0xbd, 0x78, 0xda, 0x90, 0x73, 0xc8, 0x97, 0x67, 0x2b, 0xa1, 0x0a, 0x41, 0x67, 0xf8, 0x99 },
encrypted.Ciphertext);
CollectionAssert.AreEqual(iv, encrypted.Iv);
Assert.IsNull(encrypted.AuthenticationTag);
Assert.IsNull(encrypted.AdditionalAuthenticatedData);
break;
case EncryptionAlgorithm.A128GcmValue:
case EncryptionAlgorithm.A192GcmValue:
case EncryptionAlgorithm.A256GcmValue:
Assert.IsNotNull(encrypted.Ciphertext);
Assert.IsNotNull(encrypted.Iv);
Assert.IsNotNull(encrypted.AuthenticationTag);
CollectionAssert.AreEqual(aad, encrypted.AdditionalAuthenticatedData);
break;
}
DecryptOptions decryptOptions = algorithm.IsAesGcm() ?
new DecryptOptions(algorithm, encrypted.Ciphertext, encrypted.Iv, encrypted.AuthenticationTag, encrypted.AdditionalAuthenticatedData) :
new DecryptOptions(algorithm, encrypted.Ciphertext, encrypted.Iv);
DecryptResult decrypted = provider.Decrypt(decryptOptions, default);
Assert.IsNotNull(decrypted);
// AES-CBC will be zero-padded.
StringAssert.StartsWith("plaintext", Encoding.UTF8.GetString(decrypted.Plaintext));
}
private static ExitCode RunDecryptOptionsAndReturnExitCode(DecryptOptions decryptOptions)
{
AesDecryptionResult aesDecryptionResult = null;
switch (decryptOptions.InputType.ToLower())
{
case "string":
{
aesDecryptionResult = (decryptOptions.Algorithm.ToLower()) switch
{
"aes128cbc" => new AE_AES_128_CBC_HMAC_SHA_256().DecryptString(decryptOptions.InputToBeDecrypted, decryptOptions.Password),
"aes192cbc" => new AE_AES_192_CBC_HMAC_SHA_384().DecryptString(decryptOptions.InputToBeDecrypted, decryptOptions.Password),
"aes256cbc" => new AE_AES_256_CBC_HMAC_SHA_512().DecryptString(decryptOptions.InputToBeDecrypted, decryptOptions.Password),
"aes128gcm" => new AEAD_AES_128_GCM().DecryptString(decryptOptions.InputToBeDecrypted, decryptOptions.Password, decryptOptions.AssociatedData),
"aes192gcm" => new AEAD_AES_192_GCM().DecryptString(decryptOptions.InputToBeDecrypted, decryptOptions.Password, decryptOptions.AssociatedData),
"aes256gcm" => new AEAD_AES_256_GCM().DecryptString(decryptOptions.InputToBeDecrypted, decryptOptions.Password, decryptOptions.AssociatedData),
_ => new AesDecryptionResult()
{
Success = false, Message = $"Unknown algorithm \"{decryptOptions.Algorithm}\"."
},
};
}
break;
case "file":
{
switch (decryptOptions.Algorithm.ToLower())
{
case "aes128cbc":
{
using (var progressBar = new ProgressBar())
{
var aes128 = new AE_AES_128_CBC_HMAC_SHA_256();
aes128.OnDecryptionProgress += (percentageDone, message) => { progressBar.Report((double)percentageDone / 100); };
aes128.OnDecryptionMessage += (msg) => { progressBar.WriteLine(msg); };
aesDecryptionResult = aes128.DecryptFile(decryptOptions.InputToBeDecrypted, decryptOptions.OutputFilePath, decryptOptions.Password, decryptOptions.DeleteEncryptedFile);
}
}
break;
case "aes192cbc":
{
using (var progressBar = new ProgressBar())
{
var aes192 = new AE_AES_192_CBC_HMAC_SHA_384();
aes192.OnDecryptionProgress += (percentageDone, message) => { progressBar.Report((double)percentageDone / 100); };
aes192.OnDecryptionMessage += (msg) => { progressBar.WriteLine(msg); };
aesDecryptionResult = aes192.DecryptFile(decryptOptions.InputToBeDecrypted, decryptOptions.OutputFilePath, decryptOptions.Password, decryptOptions.DeleteEncryptedFile);
}
}
break;
case "aes256cbc":
{
using (var progressBar = new ProgressBar())
{
var aes256 = new AE_AES_256_CBC_HMAC_SHA_512();
aes256.OnDecryptionProgress += (percentageDone, message) => { progressBar.Report((double)percentageDone / 100); };
aes256.OnDecryptionMessage += (msg) => { progressBar.WriteLine(msg); };
aesDecryptionResult = aes256.DecryptFile(decryptOptions.InputToBeDecrypted, decryptOptions.OutputFilePath, decryptOptions.Password, decryptOptions.DeleteEncryptedFile);
}
}
break;
case "aes128gcm":
case "aes192gcm":
case "aes256gcm":
aesDecryptionResult = new AesDecryptionResult()
{
Success = false, Message = $"Algorithm \"{decryptOptions.Algorithm}\" currently not available for file decryption."
};
break;
default:
aesDecryptionResult = new AesDecryptionResult()
{
Success = false, Message = $"Unknown algorithm \"{decryptOptions.Algorithm}\"."
};
break;
}
}
break;
default:
aesDecryptionResult = new AesDecryptionResult()
{
Success = false, Message = $"Unknown input type \"{decryptOptions.InputType}\"."
};
break;
}
if (aesDecryptionResult.Success)
{
Console.WriteLine((decryptOptions.InputType.ToLower().Equals("string") ? aesDecryptionResult.DecryptedDataString : aesDecryptionResult.Message));
return(ExitCode.Sucess);
}
else
{
Console.WriteLine(aesDecryptionResult.Message);
return(ExitCode.Error);
}
}
public static void Decrypt(DecryptOptions options, IOutputHandler outputHandler)
{
PerformCommand(options, outputHandler, "Decryption", () => new FileSystemSource().GetFilesRecursive(options.SourceDir).ToList(), DecryptCommandHelper.PerformDecryption);
}
public Task <DecryptResult> DecryptAsync(DecryptOptions options, CancellationToken cancellationToken = default) => throw new CryptographicException(CRYPT_E_NO_PROVIDER);
public static int Decrypt(DecryptOptions cmdoptions)
{
return(0);
}
public static IList<string> Validate(DecryptOptions options)
{
return Validate(options as CommonOptions);
}
