Reworked encryption to use less heap allocated buffers for secrets.

Also some work on plugin system.

IdentityShroud.Core.Tests/Security/Jwt/RsaJwtSignerTests.cs

@@ -0,0 +1,48 @@
+using System.Security.Cryptography;
+using IdentityShroud.Core.Contracts;
+using IdentityShroud.Core.Model;
+using IdentityShroud.Core.Security;
+using IdentityShroud.Core.Security.Keys;
+using IdentityShroud.Core.Services;
+
+namespace IdentityShroud.Core.Tests.Security.Jwt;
+
+public class RsaJwtSignerTests
+{
+    [Fact]
+    public void Test()
+    {
+        // ISecretProvider secretProvider = Substitute.For<ISecretProvider>();
+        // RealmSigningKey privateKey = new()
+        // {
+        //     Id = default,
+        //     KeyType = KeyType.RSA,
+        //     Key = new EncryptedDek(KekId.NewId(), [1]),
+        //     CreatedAt = default,
+        //     RevokedAt = null,
+        //     Priority = 0,
+        //     PublicKeyParameters = null
+        // };
+        DecryptedSigningKey key = new();
+        byte[] jwt = [];
+
+        RsaJwtSigner provider = new();
+        provider.CalculateSignature(JwtSigAlgName.RS256, key, jwt);
+        //
+        // new DekEncryptionService(secretProvider), privateKey,
+        //     JwtSigAlgName.RS256);
+    }
+
+    [Theory]
+    [InlineData(1024)]
+    [InlineData(2048)]
+    [InlineData(4096)]
+    public void EstimateKeySizeTests(int keySizeBits)
+    {
+        using var rsa = RSA.Create();
+        rsa.KeySize = keySizeBits;
+        byte[] b = rsa.ExportPkcs8PrivateKey();
+        int estimate = DecryptedSigningKey.EstimatePkcs8ExportSize(keySizeBits);
+        Assert.True(b.Length < estimate - 100);
+    }
+}

IdentityShroud.Core.Tests/Services/DekEncryptionServiceTests.cs

@@ -25,8 +25,13 @@ public class DekEncryptionServiceTests
         
         // act
         DekEncryptionService sut = new(secretProvider);
+        
         EncryptedDek cipher = sut.Encrypt(input.ToArray());
-        byte[] result = sut.Decrypt(cipher);
+        int decryptedSize = sut.GetDecryptedSize(cipher);
+        Assert.Equal(input.Length, decryptedSize);
+
+        var result = new byte[decryptedSize]; 
+        sut.Decrypt(cipher, result);
 
         // verify
         Assert.Equal(input, result);
@@ -56,8 +61,10 @@ public class DekEncryptionServiceTests
 
         // act
         DekEncryptionService sut = new(secretProvider);
+        int decryptedSize = sut.GetDecryptedSize(secret);
+        var result = new byte[decryptedSize]; 
         Assert.Throws<InvalidOperationException>(
-            () => sut.Decrypt(secret),
+            () => sut.Decrypt(secret, result),
             ex => ex.Message.Contains("Decryption failed") ? null : "Expected Decryption failed in message");
     }
 
@@ -89,7 +96,8 @@ public class DekEncryptionServiceTests
 
         // act
         DekEncryptionService sut = new(secretProvider);
-        byte[] result = sut.Decrypt(secret);
+        byte[] result = new byte[sut.GetDecryptedSize(secret)]; 
+        sut.Decrypt(secret, result);
 
         // verify
         Assert.Equal("Hello, World!"u8, result);

IdentityShroud.Core.Tests/Services/EncryptionTests.cs

@@ -19,7 +19,8 @@ public class EncryptionTests
         byte[] keyValue = Convert.FromBase64String("IGd9yUMusjNW0ezv8ink3QWlAHKFH45d21LyrbJTokw=");
         
         // act
-        byte[] result = Encryption.Decrypt(cipher, keyValue);
+        byte[] result = new byte[Encryption.GetDecryptedLength(cipher)];
+        Encryption.Decrypt(cipher, keyValue, result);
 
         // verify
         Assert.Equal("Hello, World!"u8, result);