Skip to content

Commit 8f05895

Browse files
MrMatthewLaytonMrMatthewLayton
authored
update/crypto (#41)
Updated cryptography components to separate out public/private key requirements, especially those relating to PKCS8 format keys.
1 parent 41b3bde commit 8f05895

13 files changed

+133
-127
lines changed

‎.run/Build.run.xml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
<component name="ProjectRunConfigurationManager">
2+
<configuration default="false" name="Build" type="ShConfigurationType">
3+
<option name="SCRIPT_TEXT" value="dotnet build" />
4+
<option name="INDEPENDENT_SCRIPT_PATH" value="true" />
5+
<option name="SCRIPT_PATH" value="" />
6+
<option name="SCRIPT_OPTIONS" value="" />
7+
<option name="INDEPENDENT_SCRIPT_WORKING_DIRECTORY" value="true" />
8+
<option name="SCRIPT_WORKING_DIRECTORY" value="$PROJECT_DIR$" />
9+
<option name="INDEPENDENT_INTERPRETER_PATH" value="true" />
10+
<option name="INTERPRETER_PATH" value="/bin/zsh" />
11+
<option name="INTERPRETER_OPTIONS" value="" />
12+
<option name="EXECUTE_IN_TERMINAL" value="true" />
13+
<option name="EXECUTE_SCRIPT_FILE" value="false" />
14+
<envs />
15+
<method v="2" />
16+
</configuration>
17+
</component>

‎OnixLabs.Security.Cryptography.UnitTests.Data/TestPrivateKey.cs

+1-8
Original file line numberDiff line numberDiff line change
@@ -12,13 +12,6 @@
1212
// See the License for the specific language governing permissions and
1313
// limitations under the License.
1414

15-
using System.Security.Cryptography;
16-
1715
namespace OnixLabs.Security.Cryptography.UnitTests.Data;
1816

19-
public sealed class TestPrivateKey(ReadOnlySpan<byte> value) : PrivateKey(value)
20-
{
21-
public override PublicKey GetPublicKey() => new TestPublicKey([]);
22-
public override byte[] ExportPkcs8PrivateKey() => [];
23-
public override byte[] ExportPkcs8PrivateKey(ReadOnlySpan<char> password, PbeParameters parameters) => [];
24-
}
17+
public sealed class TestPrivateKey(ReadOnlySpan<byte> value) : PrivateKey(value);

‎OnixLabs.Security.Cryptography.UnitTests/EcdsaKeyTests.cs

+19-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ public void EcdsaSignAndVerifyWithTwoIdenticalKeysShouldSucceed()
2424
{
2525
// Given
2626
byte[] data = Salt.CreateNonZero(2048).ToByteArray();
27-
HashAlgorithm algorithm = SHA256.Create();
27+
using HashAlgorithm algorithm = SHA256.Create();
2828
IEcdsaPrivateKey privateKey1 = EcdsaPrivateKey.Create();
2929
IEcdsaPrivateKey privateKey2 = new EcdsaPrivateKey(privateKey1.ToByteArray());
3030
IEcdsaPublicKey publicKey1 = privateKey1.GetPublicKey();
@@ -40,4 +40,22 @@ public void EcdsaSignAndVerifyWithTwoIdenticalKeysShouldSucceed()
4040
Assert.True(publicKey2.IsDataValid(signature1, data, algorithm));
4141
Assert.True(publicKey2.IsDataValid(signature2, data, algorithm));
4242
}
43+
44+
[Fact(DisplayName = "ECDSA PKCS #8 round-trip sign and verify should succeed")]
45+
public void EcdsaPkcs8RoundTripSignAndVerifyShouldSucceed()
46+
{
47+
// Given
48+
byte[] data = Salt.CreateNonZero(2048).ToByteArray();
49+
using HashAlgorithm algorithm = SHA256.Create();
50+
PbeParameters parameters = new(PbeEncryptionAlgorithm.Aes256Cbc, HashAlgorithmName.SHA256, 10);
51+
byte[] exportedPrivateKey = EcdsaPrivateKey.Create().ExportPkcs8PrivateKey("Password", parameters);
52+
IEcdsaPrivateKey privateKey = EcdsaPrivateKey.ImportPkcs8PrivateKey(exportedPrivateKey, "Password");
53+
IEcdsaPublicKey publicKey = privateKey.GetPublicKey();
54+
55+
// When
56+
DigitalSignature signature = new(privateKey.SignData(data, algorithm));
57+
58+
// Then
59+
Assert.True(publicKey.IsDataValid(signature, data, algorithm));
60+
}
4361
}

‎OnixLabs.Security.Cryptography.UnitTests/RsaKeyTests.cs

+19
Original file line numberDiff line numberDiff line change
@@ -41,4 +41,23 @@ public void RsaSignAndVerifyWithTwoIdenticalKeysShouldSucceed()
4141
Assert.True(publicKey2.IsDataValid(signature1, data, algorithm, padding));
4242
Assert.True(publicKey2.IsDataValid(signature2, data, algorithm, padding));
4343
}
44+
45+
[Fact(DisplayName = "ECDSA PKCS #8 round-trip sign and verify should succeed")]
46+
public void EcdsaPkcs8RoundTripSignAndVerifyShouldSucceed()
47+
{
48+
// Given
49+
byte[] data = Salt.CreateNonZero(2048).ToByteArray();
50+
HashAlgorithmName algorithm = HashAlgorithmName.SHA256;
51+
RSASignaturePadding padding = RSASignaturePadding.Pkcs1;
52+
PbeParameters parameters = new(PbeEncryptionAlgorithm.Aes256Cbc, HashAlgorithmName.SHA256, 10);
53+
byte[] exportedPrivateKey = RsaPrivateKey.Create().ExportPkcs8PrivateKey("Password", parameters);
54+
IRsaPrivateKey privateKey = RsaPrivateKey.ImportPkcs8PrivateKey(exportedPrivateKey, "Password");
55+
IRsaPublicKey publicKey = privateKey.GetPublicKey();
56+
57+
// When
58+
DigitalSignature signature = new(privateKey.SignData(data, algorithm, padding));
59+
60+
// Then
61+
Assert.True(publicKey.IsDataValid(signature, data, algorithm, padding));
62+
}
4463
}

‎OnixLabs.Security.Cryptography/EcdsaPrivateKey.Export.cs

+2-2
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ public sealed partial class EcdsaPrivateKey
2323
/// Exports the ECDSA cryptographic private key data in PKCS #8 format.
2424
/// </summary>
2525
/// <returns>Returns a new <see cref="T:Byte[]"/> instance containing the ECDSA cryptographic private key data in PKCS #8 format.</returns>
26-
public override byte[] ExportPkcs8PrivateKey()
26+
public byte[] ExportPkcs8PrivateKey()
2727
{
2828
using ECDsa key = ImportKeyData();
2929
return key.ExportPkcs8PrivateKey();
@@ -35,7 +35,7 @@ public override byte[] ExportPkcs8PrivateKey()
3535
/// <param name="password">The password to use for encryption.</param>
3636
/// <param name="parameters">The parameters required for password based encryption.</param>
3737
/// <returns>Returns a new <see cref="T:Byte[]"/> instance containing the ECDSA cryptographic private key data in PKCS #8 format.</returns>
38-
public override byte[] ExportPkcs8PrivateKey(ReadOnlySpan<char> password, PbeParameters parameters)
38+
public byte[] ExportPkcs8PrivateKey(ReadOnlySpan<char> password, PbeParameters parameters)
3939
{
4040
using ECDsa key = ImportKeyData();
4141
return key.ExportEncryptedPkcs8PrivateKey(password, parameters);

‎OnixLabs.Security.Cryptography/EcdsaPrivateKey.Get.cs

+1-1
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ public sealed partial class EcdsaPrivateKey
2222
/// Gets the ECDSA cryptographic public key component from the current ECDSA cryptographic private key.
2323
/// </summary>
2424
/// <returns>Returns a new <see cref="EcdsaPublicKey"/> instance containing the ECDSA cryptographic public key component from the current ECDSA cryptographic private key.</returns>
25-
public override EcdsaPublicKey GetPublicKey()
25+
public EcdsaPublicKey GetPublicKey()
2626
{
2727
using ECDsa key = ImportKeyData();
2828
byte[] keyData = key.ExportSubjectPublicKeyInfo();

‎OnixLabs.Security.Cryptography/IEcdsaPrivateKey.cs

+1-53
Original file line numberDiff line numberDiff line change
@@ -22,60 +22,8 @@ namespace OnixLabs.Security.Cryptography;
2222
/// <summary>
2323
/// Defines an ECDSA cryptographic private key.
2424
/// </summary>
25-
public interface IEcdsaPrivateKey : IBinaryConvertible
25+
public interface IEcdsaPrivateKey : IPublicKeyExportable<EcdsaPublicKey>, IPrivateKeyImportablePkcs8<EcdsaPrivateKey>, IPrivateKeyExportablePkcs8, IBinaryConvertible
2626
{
27-
/// <summary>
28-
/// Imports the ECDSA cryptographic private key data in PKCS #8 format.
29-
/// </summary>
30-
/// <param name="data">The cryptographic private key data to import.</param>
31-
/// <returns>Returns a new <see cref="EcdsaPrivateKey"/> instance from the imported cryptographic private key data.</returns>
32-
public static abstract EcdsaPrivateKey ImportPkcs8PrivateKey(ReadOnlySpan<byte> data);
33-
34-
/// <summary>
35-
/// Imports the ECDSA cryptographic private key data in PKCS #8 format.
36-
/// </summary>
37-
/// <param name="data">The cryptographic private key data to import.</param>
38-
/// <param name="bytesRead">The number of bytes read from the input data.</param>
39-
/// <returns>Returns a new <see cref="EcdsaPrivateKey"/> instance from the imported cryptographic private key data.</returns>
40-
public static abstract EcdsaPrivateKey ImportPkcs8PrivateKey(ReadOnlySpan<byte> data, out int bytesRead);
41-
42-
/// <summary>
43-
/// Imports the ECDSA cryptographic private key data in encrypted PKCS #8 format.
44-
/// </summary>
45-
/// <param name="data">The cryptographic private key data to import.</param>
46-
/// <param name="password">The password required for password based decryption.</param>
47-
/// <returns>Returns a new <see cref="EcdsaPrivateKey"/> instance from the imported cryptographic private key data.</returns>
48-
public static abstract EcdsaPrivateKey ImportPkcs8PrivateKey(ReadOnlySpan<byte> data, ReadOnlySpan<char> password);
49-
50-
/// <summary>
51-
/// Imports the ECDSA cryptographic private key data in encrypted PKCS #8 format.
52-
/// </summary>
53-
/// <param name="data">The cryptographic private key data to import.</param>
54-
/// <param name="password">The password required for password based decryption.</param>
55-
/// <param name="bytesRead">The number of bytes read from the input data.</param>
56-
/// <returns>Returns a new <see cref="EcdsaPrivateKey"/> instance from the imported cryptographic private key data.</returns>
57-
public static abstract EcdsaPrivateKey ImportPkcs8PrivateKey(ReadOnlySpan<byte> data, ReadOnlySpan<char> password, out int bytesRead);
58-
59-
/// <summary>
60-
/// Exports the ECDSA cryptographic private key data in PKCS #8 format.
61-
/// </summary>
62-
/// <returns>Returns a new <see cref="T:Byte[]"/> instance containing the ECDSA cryptographic private key data in PKCS #8 format.</returns>
63-
byte[] ExportPkcs8PrivateKey();
64-
65-
/// <summary>
66-
/// Exports the ECDSA cryptographic private key data in encrypted PKCS #8 format.
67-
/// </summary>
68-
/// <param name="password">The password to use for encryption.</param>
69-
/// <param name="parameters">The parameters required for password based encryption.</param>
70-
/// <returns>Returns a new <see cref="T:Byte[]"/> instance containing the ECDSA cryptographic private key data in PKCS #8 format.</returns>
71-
byte[] ExportPkcs8PrivateKey(ReadOnlySpan<char> password, PbeParameters parameters);
72-
73-
/// <summary>
74-
/// Gets the ECDSA cryptographic public key component from the current ECDSA cryptographic private key.
75-
/// </summary>
76-
/// <returns>Returns a new <see cref="EcdsaPublicKey"/> instance containing the ECDSA cryptographic public key component from the current ECDSA cryptographic private key.</returns>
77-
EcdsaPublicKey GetPublicKey();
78-
7927
/// <summary>
8028
/// Hashes the specified <see cref="ReadOnlySpan{T}"/> data and signs the resulting hash.
8129
/// </summary>

‎OnixLabs.Security.Cryptography/PrivateKey.Export.cs ‎OnixLabs.Security.Cryptography/IPrivateKeyExportablePkcs8.cs

+6-3
Original file line numberDiff line numberDiff line change
@@ -17,19 +17,22 @@
1717

1818
namespace OnixLabs.Security.Cryptography;
1919

20-
public abstract partial class PrivateKey
20+
/// <summary>
21+
/// Defines a cryptographic private key that can be exported in PKCS #8 format.
22+
/// </summary>
23+
public interface IPrivateKeyExportablePkcs8
2124
{
2225
/// <summary>
2326
/// Exports the cryptographic private key data in PKCS #8 format.
2427
/// </summary>
2528
/// <returns>Returns a new <see cref="T:Byte[]"/> instance containing the cryptographic private key data in PKCS #8 format.</returns>
26-
public abstract byte[] ExportPkcs8PrivateKey();
29+
byte[] ExportPkcs8PrivateKey();
2730

2831
/// <summary>
2932
/// Exports the cryptographic private key data in encrypted PKCS #8 format.
3033
/// </summary>
3134
/// <param name="password">The password to use for encryption.</param>
3235
/// <param name="parameters">The parameters required for password based encryption.</param>
3336
/// <returns>Returns a new <see cref="T:Byte[]"/> instance containing the cryptographic private key data in PKCS #8 format.</returns>
34-
public abstract byte[] ExportPkcs8PrivateKey(ReadOnlySpan<char> password, PbeParameters parameters);
37+
byte[] ExportPkcs8PrivateKey(ReadOnlySpan<char> password, PbeParameters parameters);
3538
}

‎OnixLabs.Security.Cryptography/IPrivateKeyImportablePkcs8.cs

+56
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
// Copyright 2020 ONIXLabs
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
using System;
16+
17+
namespace OnixLabs.Security.Cryptography;
18+
19+
/// <summary>
20+
/// Defines a cryptographic private key that can be imported in PKCS #8 format.
21+
/// </summary>
22+
/// <typeparam name="T">The underlying type of <see cref="PrivateKey"/> that the import functions will return.</typeparam>
23+
public interface IPrivateKeyImportablePkcs8<out T> where T : PrivateKey
24+
{
25+
/// <summary>
26+
/// Imports the cryptographic private key data in PKCS #8 format.
27+
/// </summary>
28+
/// <param name="data">The cryptographic private key data to import.</param>
29+
/// <returns>Returns a new cryptographic private key from the imported data.</returns>
30+
public static abstract T ImportPkcs8PrivateKey(ReadOnlySpan<byte> data);
31+
32+
/// <summary>
33+
/// Imports the cryptographic private key data in PKCS #8 format.
34+
/// </summary>
35+
/// <param name="data">The cryptographic private key data to import.</param>
36+
/// <param name="bytesRead">The number of bytes read from the input data.</param>
37+
/// <returns>Returns a new cryptographic private key from the imported data.</returns>
38+
public static abstract T ImportPkcs8PrivateKey(ReadOnlySpan<byte> data, out int bytesRead);
39+
40+
/// <summary>
41+
/// Imports the cryptographic private key data in encrypted PKCS #8 format.
42+
/// </summary>
43+
/// <param name="data">The cryptographic private key data to import.</param>
44+
/// <param name="password">The password required for password based decryption.</param>
45+
/// <returns>Returns a new cryptographic private key from the imported data.</returns>
46+
public static abstract T ImportPkcs8PrivateKey(ReadOnlySpan<byte> data, ReadOnlySpan<char> password);
47+
48+
/// <summary>
49+
/// Imports the cryptographic private key data in encrypted PKCS #8 format.
50+
/// </summary>
51+
/// <param name="data">The cryptographic private key data to import.</param>
52+
/// <param name="password">The password required for password based decryption.</param>
53+
/// <param name="bytesRead">The number of bytes read from the input data.</param>
54+
/// <returns>Returns a new cryptographic private key from the imported data.</returns>
55+
public static abstract T ImportPkcs8PrivateKey(ReadOnlySpan<byte> data, ReadOnlySpan<char> password, out int bytesRead);
56+
}

‎OnixLabs.Security.Cryptography/PrivateKey.Get.cs ‎OnixLabs.Security.Cryptography/IPublicKeyExportable.cs

+7-3
Original file line numberDiff line numberDiff line change
@@ -14,11 +14,15 @@
1414

1515
namespace OnixLabs.Security.Cryptography;
1616

17-
public abstract partial class PrivateKey
17+
/// <summary>
18+
/// Defines a cryptographic private key that can export a cryptographic public key component.
19+
/// </summary>
20+
/// <typeparam name="T">The underlying type of <see cref="PublicKey"/> that the cryptographic private key exports.</typeparam>
21+
public interface IPublicKeyExportable<out T> where T : PublicKey
1822
{
1923
/// <summary>
2024
/// Gets the cryptographic public key component from the current cryptographic private key.
2125
/// </summary>
22-
/// <returns>Returns a new <see cref="PublicKey"/> instance containing the cryptographic public key component from the current cryptographic private key.</returns>
23-
public abstract PublicKey GetPublicKey();
26+
/// <returns>Returns the cryptographic public key component from the current cryptographic private key.</returns>
27+
T GetPublicKey();
2428
}

‎OnixLabs.Security.Cryptography/IRsaPrivateKey.cs

+1-53
Original file line numberDiff line numberDiff line change
@@ -22,60 +22,8 @@ namespace OnixLabs.Security.Cryptography;
2222
/// <summary>
2323
/// Defines an RSA cryptographic private key.
2424
/// </summary>
25-
public interface IRsaPrivateKey : IBinaryConvertible
25+
public interface IRsaPrivateKey : IPublicKeyExportable<RsaPublicKey>, IPrivateKeyImportablePkcs8<RsaPrivateKey>, IPrivateKeyExportablePkcs8, IBinaryConvertible
2626
{
27-
/// <summary>
28-
/// Imports the RSA cryptographic private key data in PKCS #8 format.
29-
/// </summary>
30-
/// <param name="data">The cryptographic private key data to import.</param>
31-
/// <returns>Returns a new <see cref="RsaPrivateKey"/> instance from the imported cryptographic private key data.</returns>
32-
public static abstract RsaPrivateKey ImportPkcs8PrivateKey(ReadOnlySpan<byte> data);
33-
34-
/// <summary>
35-
/// Imports the RSA cryptographic private key data in PKCS #8 format.
36-
/// </summary>
37-
/// <param name="data">The cryptographic private key data to import.</param>
38-
/// <param name="bytesRead">The number of bytes read from the input data.</param>
39-
/// <returns>Returns a new <see cref="RsaPrivateKey"/> instance from the imported cryptographic private key data.</returns>
40-
public static abstract RsaPrivateKey ImportPkcs8PrivateKey(ReadOnlySpan<byte> data, out int bytesRead);
41-
42-
/// <summary>
43-
/// Imports the RSA cryptographic private key data in encrypted PKCS #8 format.
44-
/// </summary>
45-
/// <param name="data">The cryptographic private key data to import.</param>
46-
/// <param name="password">The password required for password based decryption.</param>
47-
/// <returns>Returns a new <see cref="RsaPrivateKey"/> instance from the imported cryptographic private key data.</returns>
48-
public static abstract RsaPrivateKey ImportPkcs8PrivateKey(ReadOnlySpan<byte> data, ReadOnlySpan<char> password);
49-
50-
/// <summary>
51-
/// Imports the RSA cryptographic private key data in encrypted PKCS #8 format.
52-
/// </summary>
53-
/// <param name="data">The cryptographic private key data to import.</param>
54-
/// <param name="password">The password required for password based decryption.</param>
55-
/// <param name="bytesRead">The number of bytes read from the input data.</param>
56-
/// <returns>Returns a new <see cref="RsaPrivateKey"/> instance from the imported cryptographic private key data.</returns>
57-
public static abstract RsaPrivateKey ImportPkcs8PrivateKey(ReadOnlySpan<byte> data, ReadOnlySpan<char> password, out int bytesRead);
58-
59-
/// <summary>
60-
/// Exports the RSA cryptographic private key data in PKCS #8 format.
61-
/// </summary>
62-
/// <returns>Returns a new <see cref="T:Byte[]"/> instance containing the RSA cryptographic private key data in PKCS #8 format.</returns>
63-
byte[] ExportPkcs8PrivateKey();
64-
65-
/// <summary>
66-
/// Exports the RSA cryptographic private key data in encrypted PKCS #8 format.
67-
/// </summary>
68-
/// <param name="password">The password to use for encryption.</param>
69-
/// <param name="parameters">The parameters required for password based encryption.</param>
70-
/// <returns>Returns a new <see cref="T:Byte[]"/> instance containing the RSA cryptographic private key data in PKCS #8 format.</returns>
71-
byte[] ExportPkcs8PrivateKey(ReadOnlySpan<char> password, PbeParameters parameters);
72-
73-
/// <summary>
74-
/// Gets the RSA cryptographic public key component from the current RSA cryptographic private key.
75-
/// </summary>
76-
/// <returns>Returns a new <see cref="RsaPublicKey"/> instance containing the RSA cryptographic public key component from the current RSA cryptographic private key.</returns>
77-
RsaPublicKey GetPublicKey();
78-
7927
/// <summary>
8028
/// Hashes the specified <see cref="ReadOnlySpan{T}"/> data and signs the resulting hash.
8129
/// </summary>

‎OnixLabs.Security.Cryptography/RsaPrivateKey.Export.cs

+2-2
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ public sealed partial class RsaPrivateKey
2323
/// Exports the RSA cryptographic private key data in PKCS #8 format.
2424
/// </summary>
2525
/// <returns>Returns a new <see cref="T:Byte[]"/> instance containing the RSA cryptographic private key data in PKCS #8 format.</returns>
26-
public override byte[] ExportPkcs8PrivateKey()
26+
public byte[] ExportPkcs8PrivateKey()
2727
{
2828
using RSA key = ImportKeyData();
2929
return key.ExportPkcs8PrivateKey();
@@ -35,7 +35,7 @@ public override byte[] ExportPkcs8PrivateKey()
3535
/// <param name="password">The password to use for encryption.</param>
3636
/// <param name="parameters">The parameters required for password based encryption.</param>
3737
/// <returns>Returns a new <see cref="T:Byte[]"/> instance containing the RSA cryptographic private key data in PKCS #8 format.</returns>
38-
public override byte[] ExportPkcs8PrivateKey(ReadOnlySpan<char> password, PbeParameters parameters)
38+
public byte[] ExportPkcs8PrivateKey(ReadOnlySpan<char> password, PbeParameters parameters)
3939
{
4040
using RSA key = ImportKeyData();
4141
return key.ExportEncryptedPkcs8PrivateKey(password, parameters);

0 commit comments

Comments
 (0)