123 lines
No EOL
4.3 KiB
C#
123 lines
No EOL
4.3 KiB
C#
using IdentityShroud.Core.Contracts;
|
|
using IdentityShroud.Core.Security;
|
|
using IdentityShroud.Core.Services;
|
|
|
|
namespace IdentityShroud.Core.Tests.Services;
|
|
|
|
public class DekEncryptionServiceTests
|
|
{
|
|
[Fact]
|
|
public void RoundtripWorks()
|
|
{
|
|
// Note this code will tend to only test the latest verion.
|
|
|
|
// setup
|
|
byte[] keyValue = Convert.FromBase64String("IGd9yUMusjNW0ezv8ink3QWlAHKFH45d21LyrbJTokw=");
|
|
var secretProvider = Substitute.For<ISecretProvider>();
|
|
KeyEncryptionKey[] keys =
|
|
[
|
|
new KeyEncryptionKey(KekId.NewId(), true, "AES", keyValue)
|
|
];
|
|
secretProvider.GetKeys("master").Returns(keys);
|
|
|
|
|
|
ReadOnlySpan<byte> input = "Hello, World!"u8;
|
|
|
|
// act
|
|
DekEncryptionService sut = new(secretProvider);
|
|
EncryptedDek cipher = sut.Encrypt(input.ToArray());
|
|
byte[] result = sut.Decrypt(cipher);
|
|
|
|
// verify
|
|
Assert.Equal(input, result);
|
|
}
|
|
|
|
[Fact]
|
|
public void DetectsCorruptInput()
|
|
{
|
|
// When introducing a new version we need version specific tests to
|
|
// make sure decoding of legacy data still works.
|
|
KekId kid = KekId.NewId();
|
|
// setup
|
|
byte[] cipher = // NOTE INCORRECT CIPHER DO NOT USE IN OTHER TESTS
|
|
[
|
|
1, 198, 55, 58, 56, 110, 238, 59, 158, 214, 85, 241, 26, 44, 140, 229, 128, 111, 167, 154, 160, 177, 152,
|
|
193, 75, 4, 235, 82, 207, 87, 32, 10, 239, 4, 246, 25, 21, 249, 25, 59, 160, 101
|
|
];
|
|
EncryptedDek secret = new(kid, cipher);
|
|
|
|
byte[] keyValue = Convert.FromBase64String("IGd9yUMusjNW0ezv8ink3QWlAHKFH45d21LyrbJTokw=");
|
|
var secretProvider = Substitute.For<ISecretProvider>();
|
|
KeyEncryptionKey[] keys =
|
|
[
|
|
new KeyEncryptionKey(kid, true, "AES", keyValue)
|
|
];
|
|
secretProvider.GetKeys("master").Returns(keys);
|
|
|
|
// act
|
|
DekEncryptionService sut = new(secretProvider);
|
|
Assert.Throws<InvalidOperationException>(
|
|
() => sut.Decrypt(secret),
|
|
ex => ex.Message.Contains("Decryption failed") ? null : "Expected Decryption failed in message");
|
|
}
|
|
|
|
[Fact]
|
|
public void DecodeSelectsRightKey()
|
|
{
|
|
// The key is marked inactive also it is the second key
|
|
|
|
// setup
|
|
KekId kid1 = KekId.NewId();
|
|
KekId kid2 = KekId.NewId();
|
|
|
|
byte[] cipher =
|
|
[
|
|
1, 198, 55, 58, 56, 110, 238, 59, 158, 214, 85, 241, 26, 44, 140, 229, 128, 111, 167, 154, 160, 177, 152,
|
|
193, 74, 4, 235, 82, 207, 87, 32, 10, 239, 4, 246, 25, 21, 249, 25, 59, 160, 101
|
|
];
|
|
EncryptedDek secret = new(kid1, cipher);
|
|
|
|
byte[] keyValue1 = Convert.FromBase64String("IGd9yUMusjNW0ezv8ink3QWlAHKFH45d21LyrbJTokw=");
|
|
byte[] keyValue2 = Convert.FromBase64String("Dat1RwRvuLX3wdKMMP4NwHdBl8tJJsKfp01qikyo8aw=");
|
|
var secretProvider = Substitute.For<ISecretProvider>();
|
|
KeyEncryptionKey[] keys =
|
|
[
|
|
new KeyEncryptionKey(kid2, true, "AES", keyValue2),
|
|
new KeyEncryptionKey(kid1, false, "AES", keyValue1),
|
|
];
|
|
secretProvider.GetKeys("master").Returns(keys);
|
|
|
|
// act
|
|
DekEncryptionService sut = new(secretProvider);
|
|
byte[] result = sut.Decrypt(secret);
|
|
|
|
// verify
|
|
Assert.Equal("Hello, World!"u8, result);
|
|
}
|
|
|
|
[Fact]
|
|
public void EncryptionUsesActiveKey()
|
|
{
|
|
// setup
|
|
KekId kid1 = KekId.NewId();
|
|
KekId kid2 = KekId.NewId();
|
|
|
|
byte[] keyValue1 = Convert.FromBase64String("IGd9yUMusjNW0ezv8ink3QWlAHKFH45d21LyrbJTokw=");
|
|
byte[] keyValue2 = Convert.FromBase64String("Dat1RwRvuLX3wdKMMP4NwHdBl8tJJsKfp01qikyo8aw=");
|
|
var secretProvider = Substitute.For<ISecretProvider>();
|
|
KeyEncryptionKey[] keys =
|
|
[
|
|
new KeyEncryptionKey(kid1, false, "AES", keyValue1),
|
|
new KeyEncryptionKey(kid2, true, "AES", keyValue2),
|
|
];
|
|
secretProvider.GetKeys("master").Returns(keys);
|
|
|
|
ReadOnlySpan<byte> input = "Hello, World!"u8;
|
|
// act
|
|
DekEncryptionService sut = new(secretProvider);
|
|
EncryptedDek cipher = sut.Encrypt(input.ToArray());
|
|
|
|
// Verify
|
|
Assert.Equal(kid2, cipher.KekId);
|
|
}
|
|
} |