1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
|
using System;
using System.Collections.Generic;
using Org.BouncyCastle.Asn1;
using Org.BouncyCastle.Asn1.EdEC;
using Org.BouncyCastle.Asn1.X9;
using Org.BouncyCastle.Crypto;
using Org.BouncyCastle.Crypto.Agreement;
using Org.BouncyCastle.Crypto.Agreement.Kdf;
using Org.BouncyCastle.Crypto.Digests;
using Org.BouncyCastle.Utilities.Collections;
namespace Org.BouncyCastle.Security
{
/// <remarks>
/// Utility class for creating IBasicAgreement objects from their names/Oids
/// </remarks>
public static class AgreementUtilities
{
private static readonly Dictionary<DerObjectIdentifier, string> AlgorithmOidMap =
new Dictionary<DerObjectIdentifier, string>();
static AgreementUtilities()
{
AlgorithmOidMap[X9ObjectIdentifiers.DHSinglePassCofactorDHSha1KdfScheme] = "ECCDHWITHSHA1KDF";
AlgorithmOidMap[X9ObjectIdentifiers.DHSinglePassStdDHSha1KdfScheme] = "ECDHWITHSHA1KDF";
AlgorithmOidMap[X9ObjectIdentifiers.MqvSinglePassSha1KdfScheme] = "ECMQVWITHSHA1KDF";
AlgorithmOidMap[EdECObjectIdentifiers.id_X25519] = "X25519";
AlgorithmOidMap[EdECObjectIdentifiers.id_X448] = "X448";
#if DEBUG
//foreach (var key in AlgorithmMap.Keys)
//{
// if (DerObjectIdentifier.TryFromID(key, out var ignore))
// throw new Exception("OID mapping belongs in AlgorithmOidMap: " + key);
//}
//var mechanisms = new HashSet<string>(AlgorithmMap.Values);
var mechanisms = new HashSet<string>();
mechanisms.UnionWith(AlgorithmOidMap.Values);
foreach (var mechanism in mechanisms)
{
//if (AlgorithmMap.TryGetValue(mechanism, out var check))
//{
// if (mechanism != check)
// throw new Exception("Mechanism mapping MUST be to self: " + mechanism);
//}
//else
{
if (!mechanism.Equals(mechanism.ToUpperInvariant()))
throw new Exception("Unmapped mechanism MUST be uppercase: " + mechanism);
}
}
#endif
}
public static string GetAlgorithmName(DerObjectIdentifier oid)
{
return CollectionUtilities.GetValueOrNull(AlgorithmOidMap, oid);
}
public static IBasicAgreement GetBasicAgreement(DerObjectIdentifier oid)
{
if (oid == null)
throw new ArgumentNullException(nameof(oid));
if (AlgorithmOidMap.TryGetValue(oid, out var mechanism))
{
var basicAgreement = GetBasicAgreementForMechanism(mechanism);
if (basicAgreement != null)
return basicAgreement;
}
throw new SecurityUtilityException("Basic Agreement OID not recognised.");
}
public static IBasicAgreement GetBasicAgreement(string algorithm)
{
if (algorithm == null)
throw new ArgumentNullException(nameof(algorithm));
string mechanism = GetMechanism(algorithm) ?? algorithm.ToUpperInvariant();
var basicAgreement = GetBasicAgreementForMechanism(mechanism);
if (basicAgreement != null)
return basicAgreement;
throw new SecurityUtilityException("Basic Agreement " + algorithm + " not recognised.");
}
private static IBasicAgreement GetBasicAgreementForMechanism(string mechanism)
{
if (mechanism == "DH" || mechanism == "DIFFIEHELLMAN")
return new DHBasicAgreement();
if (mechanism == "ECDH")
return new ECDHBasicAgreement();
if (mechanism == "ECDHC" || mechanism == "ECCDH")
return new ECDHCBasicAgreement();
if (mechanism == "ECMQV")
return new ECMqvBasicAgreement();
return null;
}
public static IBasicAgreement GetBasicAgreementWithKdf(DerObjectIdentifier agreeAlgOid,
DerObjectIdentifier wrapAlgOid)
{
return GetBasicAgreementWithKdf(agreeAlgOid, wrapAlgOid?.Id);
}
// TODO[api] Change parameter name to 'agreeAlgOid'
public static IBasicAgreement GetBasicAgreementWithKdf(DerObjectIdentifier oid, string wrapAlgorithm)
{
if (oid == null)
throw new ArgumentNullException(nameof(oid));
if (wrapAlgorithm == null)
throw new ArgumentNullException(nameof(wrapAlgorithm));
if (AlgorithmOidMap.TryGetValue(oid, out var mechanism))
{
var basicAgreement = GetBasicAgreementWithKdfForMechanism(mechanism, wrapAlgorithm);
if (basicAgreement != null)
return basicAgreement;
}
throw new SecurityUtilityException("Basic Agreement (with KDF) OID not recognised.");
}
public static IBasicAgreement GetBasicAgreementWithKdf(string agreeAlgorithm, string wrapAlgorithm)
{
if (agreeAlgorithm == null)
throw new ArgumentNullException(nameof(agreeAlgorithm));
if (wrapAlgorithm == null)
throw new ArgumentNullException(nameof(wrapAlgorithm));
string mechanism = GetMechanism(agreeAlgorithm) ?? agreeAlgorithm.ToUpperInvariant();
var basicAgreement = GetBasicAgreementWithKdfForMechanism(mechanism, wrapAlgorithm);
if (basicAgreement != null)
return basicAgreement;
throw new SecurityUtilityException("Basic Agreement (with KDF) " + agreeAlgorithm + " not recognised.");
}
private static IBasicAgreement GetBasicAgreementWithKdfForMechanism(string mechanism, string wrapAlgorithm)
{
// 'DHWITHSHA1KDF' retained for backward compatibility
if (mechanism == "DHWITHSHA1KDF" || mechanism == "ECDHWITHSHA1KDF")
return new ECDHWithKdfBasicAgreement(wrapAlgorithm, new ECDHKekGenerator(new Sha1Digest()));
if (mechanism == "ECCDHWITHSHA1KDF")
return new ECDHCWithKdfBasicAgreement(wrapAlgorithm, new ECDHKekGenerator(new Sha1Digest()));
if (mechanism == "ECMQVWITHSHA1KDF")
return new ECMqvWithKdfBasicAgreement(wrapAlgorithm, new ECDHKekGenerator(new Sha1Digest()));
return null;
}
public static IRawAgreement GetRawAgreement(DerObjectIdentifier oid)
{
if (oid == null)
throw new ArgumentNullException(nameof(oid));
if (AlgorithmOidMap.TryGetValue(oid, out var mechanism))
{
var rawAgreement = GetRawAgreementForMechanism(mechanism);
if (rawAgreement != null)
return rawAgreement;
}
throw new SecurityUtilityException("Raw Agreement OID not recognised.");
}
public static IRawAgreement GetRawAgreement(string algorithm)
{
if (algorithm == null)
throw new ArgumentNullException(nameof(algorithm));
string mechanism = GetMechanism(algorithm) ?? algorithm.ToUpperInvariant();
var rawAgreement = GetRawAgreementForMechanism(mechanism);
if (rawAgreement != null)
return rawAgreement;
throw new SecurityUtilityException("Raw Agreement " + algorithm + " not recognised.");
}
private static IRawAgreement GetRawAgreementForMechanism(string mechanism)
{
if (mechanism == "X25519")
return new X25519Agreement();
if (mechanism == "X448")
return new X448Agreement();
return null;
}
private static string GetMechanism(string algorithm)
{
//if (AlgorithmMap.TryGetValue(algorithm, out var mechanism1))
// return mechanism1;
if (DerObjectIdentifier.TryFromID(algorithm, out var oid))
{
if (AlgorithmOidMap.TryGetValue(oid, out var mechanism2))
return mechanism2;
}
return null;
}
}
}
|
