CryptoImpl.h

Go to the documentation of this file.

 
#pragma once
 
#include <aws/core/Core_EXPORTS.h>
#include <aws/core/utils/crypto/Hash.h>
#include <aws/core/utils/crypto/HMAC.h>
#include <aws/core/utils/crypto/Cipher.h>
#include <aws/core/utils/crypto/SecureRandom.h>
#include <aws/core/utils/logging/LogMacros.h>
#include <mutex>
 
#if (defined(WIN32) || defined(_WIN32) || defined(__WIN32__))
 
#define WIN32_NO_STATUS
#include <windows.h>
#include <bcrypt.h>
#include <winternl.h>
#include <winerror.h>
#undef WIN32_NO_STATUS
#endif // AWS_SDK_PLATFORM_WINDOWS
 
namespace Aws
{
    namespace Utils
    {
        namespace Crypto
        {
            static const char* SecureRandom_BCrypt_Tag = "SecureRandom_BCrypt";
 
            class SecureRandomBytes_BCrypt : public SecureRandomBytes
            {
            public:
                SecureRandomBytes_BCrypt();
                ~SecureRandomBytes_BCrypt();
                void GetBytes(unsigned char* buffer, size_t bufferSize) override;
            private:
                BCRYPT_ALG_HANDLE m_algHandle;
            };
 
            class BCryptHashContext;
 
            class BCryptHashImpl
            {
            public:
                BCryptHashImpl(LPCWSTR algorithmName, bool isHMAC);
                ~BCryptHashImpl();
 
                HashResult Calculate(const Aws::String& str);
                HashResult Calculate(const ByteBuffer& toHash, const ByteBuffer& secret);
                HashResult Calculate(Aws::IStream& stream);
 
                void Update(unsigned char* buffer, size_t bufferSize);
 
                HashResult GetHash();
 
            private:
 
                bool IsValid() const;
 
                HashResult HashData(const BCryptHashContext& context, PBYTE data, ULONG dataLength);
                bool HashStream(Aws::IStream& stream);
 
                void* m_algorithmHandle;
                void* m_hashHandle;
 
                DWORD m_hashBufferLength;
                PBYTE m_hashBuffer;
 
                DWORD m_hashObjectLength;
                PBYTE m_hashObject;
 
                //I'm 99% sure the algorithm handle for windows is not thread safe, but I can't
                //prove or disprove that theory. Therefore, we have to lock to be safe.
                std::mutex m_algorithmMutex;
            };
 
            class MD5BcryptImpl : public Hash
            {
            public:
                MD5BcryptImpl();
                virtual ~MD5BcryptImpl() {}
 
                virtual HashResult Calculate(const Aws::String& str) override;
                virtual HashResult Calculate(Aws::IStream& stream) override;
 
                virtual void Update(unsigned char* buffer, size_t bufferSize) override;
 
                virtual HashResult GetHash() override;
 
            private:
                BCryptHashImpl m_impl;
            };
 
            class Sha1BcryptImpl : public Hash
            {
            public:
 
                Sha1BcryptImpl();
                virtual ~Sha1BcryptImpl() {}
 
                virtual HashResult Calculate(const Aws::String& str) override;
 
                virtual HashResult Calculate(Aws::IStream& stream) override;
 
                virtual void Update(unsigned char* buffer, size_t bufferSize) override;
 
                virtual HashResult GetHash() override;
 
            private:
                BCryptHashImpl m_impl;
            };
 
            class Sha256BcryptImpl : public Hash
            {
            public:
                Sha256BcryptImpl();
                virtual ~Sha256BcryptImpl() {}
 
                virtual HashResult Calculate(const Aws::String& str) override;
                virtual HashResult Calculate(Aws::IStream& stream) override;
 
                virtual void Update(unsigned char* buffer, size_t bufferSize) override;
 
                virtual HashResult GetHash() override;
 
            private:
                BCryptHashImpl m_impl;
            };
 
            class Sha256HMACBcryptImpl : public HMAC
            {
            public:
 
                Sha256HMACBcryptImpl();
                virtual ~Sha256HMACBcryptImpl() {}
 
                virtual HashResult Calculate(const ByteBuffer& toSign, const ByteBuffer& secret) override;
 
            private:
                BCryptHashImpl m_impl;
            };
 
            class BCryptSymmetricCipher : public SymmetricCipher
            {
            public:
                BCryptSymmetricCipher(const CryptoBuffer& key, size_t ivSize, bool ctrMode = false);
 
                BCryptSymmetricCipher(const CryptoBuffer& key, const CryptoBuffer& initializationVector, const CryptoBuffer& tag = CryptoBuffer(0));
 
                BCryptSymmetricCipher(CryptoBuffer&& key, CryptoBuffer&& initializationVector, CryptoBuffer&& tag = std::move(CryptoBuffer(0)));
 
                BCryptSymmetricCipher(const BCryptSymmetricCipher&) = delete;
                BCryptSymmetricCipher& operator=(const BCryptSymmetricCipher&) = delete;
 
                BCryptSymmetricCipher(BCryptSymmetricCipher&& toMove);
 
                BCryptSymmetricCipher& operator=(BCryptSymmetricCipher&& toMove);
 
                virtual ~BCryptSymmetricCipher();
 
                CryptoBuffer EncryptBuffer(const CryptoBuffer& unEncryptedData) override;
                CryptoBuffer FinalizeEncryption() override;
                CryptoBuffer DecryptBuffer(const CryptoBuffer& encryptedData) override;
                CryptoBuffer FinalizeDecryption() override;
 
                void Reset() override;
 
            protected:
                void InitKey();
                virtual size_t GetBlockSizeBytes() const = 0;
                virtual size_t GetKeyLengthBits() const = 0;
                bool CheckKeyAndIVLength(size_t expectedKeyLength, size_t expectedIVLength);
 
                BCRYPT_ALG_HANDLE m_algHandle;
                BCRYPT_KEY_HANDLE m_keyHandle;
                DWORD m_flags;
                CryptoBuffer m_workingIv;
                PBCRYPT_AUTHENTICATED_CIPHER_MODE_INFO m_authInfoPtr;
 
                static BCRYPT_KEY_HANDLE ImportKeyBlob(BCRYPT_ALG_HANDLE handle, CryptoBuffer& key);
                bool m_encryptDecryptCalled;
            private:
                void Init();
                void Cleanup();
            };
 
            class AES_CBC_Cipher_BCrypt : public BCryptSymmetricCipher
            {
            public:
                AES_CBC_Cipher_BCrypt(const CryptoBuffer& key);
 
                AES_CBC_Cipher_BCrypt(CryptoBuffer&& key, CryptoBuffer&& initializationVector);
 
                AES_CBC_Cipher_BCrypt(const CryptoBuffer& key, const CryptoBuffer& initializationVector);
 
                AES_CBC_Cipher_BCrypt(const AES_CBC_Cipher_BCrypt&) = delete;
 
                AES_CBC_Cipher_BCrypt& operator=(const AES_CBC_Cipher_BCrypt&) = delete;
 
                AES_CBC_Cipher_BCrypt(AES_CBC_Cipher_BCrypt&& toMove) : BCryptSymmetricCipher(std::move(toMove)), m_blockOverflow(std::move(toMove.m_blockOverflow)) {}
 
                CryptoBuffer EncryptBuffer(const CryptoBuffer& unEncryptedData) override;
                CryptoBuffer FinalizeEncryption() override;
                CryptoBuffer DecryptBuffer(const CryptoBuffer& encryptedData) override;
                CryptoBuffer FinalizeDecryption() override;
 
                void Reset() override;
 
            protected:
                size_t GetBlockSizeBytes() const override;
                size_t GetKeyLengthBits() const override;
 
            private:
                void InitCipher();
                CryptoBuffer FillInOverflow(const CryptoBuffer& buffer);
 
                CryptoBuffer m_blockOverflow;
 
                static size_t BlockSizeBytes;
                static size_t KeyLengthBits;
            };
 
            class AES_CTR_Cipher_BCrypt : public BCryptSymmetricCipher
            {
            public:
                AES_CTR_Cipher_BCrypt(const CryptoBuffer& key);
 
                AES_CTR_Cipher_BCrypt(CryptoBuffer&& key, CryptoBuffer&& initializationVector);
 
                AES_CTR_Cipher_BCrypt(const CryptoBuffer& key, const CryptoBuffer& initializationVector);
 
                AES_CTR_Cipher_BCrypt(const AES_CTR_Cipher_BCrypt&) = delete;
 
                AES_CTR_Cipher_BCrypt& operator=(const AES_CTR_Cipher_BCrypt&) = delete;
 
                AES_CTR_Cipher_BCrypt(AES_CTR_Cipher_BCrypt&& toMove) : BCryptSymmetricCipher(std::move(toMove)), m_blockOverflow(std::move(toMove.m_blockOverflow)) {}
 
                CryptoBuffer EncryptBuffer(const CryptoBuffer& unEncryptedData) override;
                CryptoBuffer FinalizeEncryption() override;
                CryptoBuffer DecryptBuffer(const CryptoBuffer& encryptedData) override;
                CryptoBuffer FinalizeDecryption() override;
 
                void Reset() override;
 
            protected:
                size_t GetBlockSizeBytes() const override;
                size_t GetKeyLengthBits() const override;
 
            private:
                void InitCipher();
 
                static void InitBuffersToNull(Aws::Vector<ByteBuffer*>& initBuffers);
                static void CleanupBuffers(Aws::Vector<ByteBuffer*>& cleanupBuffers);
 
                CryptoBuffer EncryptWithCtr(const CryptoBuffer& buffer);
 
                static size_t BlockSizeBytes;
                static size_t KeyLengthBits;
 
                CryptoBuffer m_blockOverflow;
            };
 
            class AES_GCM_Cipher_BCrypt : public BCryptSymmetricCipher
            {
            public:
                AES_GCM_Cipher_BCrypt(const CryptoBuffer& key);
 
                AES_GCM_Cipher_BCrypt(const CryptoBuffer& key, const CryptoBuffer* aad);
 
                AES_GCM_Cipher_BCrypt(CryptoBuffer&& key, CryptoBuffer&& initializationVector,
                    CryptoBuffer&& tag = CryptoBuffer(0), CryptoBuffer&& aad = CryptoBuffer(0));
 
                AES_GCM_Cipher_BCrypt(const CryptoBuffer& key, const CryptoBuffer& initializationVector,
                    const CryptoBuffer& tag = CryptoBuffer(0), const CryptoBuffer& aad = CryptoBuffer(0));
 
                AES_GCM_Cipher_BCrypt(const AES_GCM_Cipher_BCrypt&) = delete;
 
                AES_GCM_Cipher_BCrypt& operator=(const AES_GCM_Cipher_BCrypt&) = delete;
 
                AES_GCM_Cipher_BCrypt(AES_GCM_Cipher_BCrypt&& toMove) :
                    BCryptSymmetricCipher(std::move(toMove)), m_macBuffer(std::move(toMove.m_macBuffer)), m_finalBuffer(std::move(toMove.m_finalBuffer)),
                    m_authInfo(std::move(toMove.m_authInfo)) {}
 
                CryptoBuffer EncryptBuffer(const CryptoBuffer&) override;
                CryptoBuffer FinalizeEncryption() override;
                CryptoBuffer DecryptBuffer(const CryptoBuffer&) override;
                CryptoBuffer FinalizeDecryption() override;
 
                void Reset() override;
 
            protected:
                size_t GetBlockSizeBytes() const override;
                size_t GetKeyLengthBits() const override;
                size_t GetTagLengthBytes() const;
 
            private:
                void InitCipher();
 
                static size_t BlockSizeBytes;
                static size_t IVLengthBytes;
                static size_t KeyLengthBits;
                static size_t TagLengthBytes;
 
                CryptoBuffer m_macBuffer;
                CryptoBuffer m_finalBuffer;
                CryptoBuffer m_aad;
                BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO m_authInfo;
            };
 
            class AES_KeyWrap_Cipher_BCrypt : public BCryptSymmetricCipher
            {
            public:
                AES_KeyWrap_Cipher_BCrypt(const CryptoBuffer& key);
 
                AES_KeyWrap_Cipher_BCrypt(const AES_KeyWrap_Cipher_BCrypt&) = delete;
 
                AES_KeyWrap_Cipher_BCrypt& operator=(const AES_KeyWrap_Cipher_BCrypt&) = delete;
 
                AES_KeyWrap_Cipher_BCrypt(AES_CTR_Cipher_BCrypt&& toMove) : BCryptSymmetricCipher(std::move(toMove)) {}
 
                CryptoBuffer EncryptBuffer(const CryptoBuffer& unEncryptedData) override;
                CryptoBuffer FinalizeEncryption() override;
                CryptoBuffer DecryptBuffer(const CryptoBuffer& encryptedData) override;
                CryptoBuffer FinalizeDecryption() override;
 
                void Reset() override;
 
            protected:
                size_t GetBlockSizeBytes() const override;
                size_t GetKeyLengthBits() const override;
 
            private:
                void InitCipher();
 
                static size_t BlockSizeBytes;
                static size_t KeyLengthBits;
 
                CryptoBuffer m_operatingKeyBuffer;
            };
        } // namespace Crypto
    } // namespace Utils
} // namespace Aws