|
1
|
1 /**
|
|
|
2 * Cloud storage plugins for Orthanc
|
|
|
3 * Copyright (C) 2017-2020 Osimis S.A., Belgium
|
|
|
4 *
|
|
|
5 * This program is free software: you can redistribute it and/or
|
|
|
6 * modify it under the terms of the GNU Affero General Public License
|
|
|
7 * as published by the Free Software Foundation, either version 3 of
|
|
|
8 * the License, or (at your option) any later version.
|
|
|
9 *
|
|
|
10 * This program is distributed in the hope that it will be useful, but
|
|
|
11 * WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
|
13 * Affero General Public License for more details.
|
|
|
14 *
|
|
|
15 * You should have received a copy of the GNU Affero General Public License
|
|
|
16 * along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
17 **/
|
|
|
18 #pragma once
|
|
|
19
|
|
|
20 #include <memory.h>
|
|
|
21 #include <cryptopp/secblock.h>
|
|
|
22 #include "cryptopp/osrng.h"
|
|
|
23 #include <boost/thread/mutex.hpp>
|
|
|
24 #include "Core/MultiThreading/Semaphore.h"
|
|
|
25
|
|
|
26 class EncryptionException : public std::runtime_error
|
|
|
27 {
|
|
|
28 public:
|
|
|
29 EncryptionException(const std::string& what)
|
|
|
30 : std::runtime_error(what)
|
|
|
31 {
|
|
|
32 }
|
|
|
33 };
|
|
|
34
|
|
|
35 class EncryptionHelpers
|
|
|
36 {
|
|
|
37 public:
|
|
|
38 static const size_t HEADER_VERSION_SIZE = 2;
|
|
|
39 static const size_t MASTER_KEY_ID_SIZE = 4;
|
|
|
40 static const size_t AES_KEY_SIZE = 32; // length of AES keys (in bytes)
|
|
|
41 static const size_t IV_SIZE = 32; // length of IVs (in bytes)
|
|
|
42 static const size_t INTEGRITY_CHECK_TAG_SIZE = 16; // length of the TAG that is used to check the integrity of data (in bytes)
|
|
|
43
|
|
|
44 static const size_t OVERHEAD_SIZE = HEADER_VERSION_SIZE + MASTER_KEY_ID_SIZE + AES_KEY_SIZE + IV_SIZE + INTEGRITY_CHECK_TAG_SIZE;
|
|
|
45
|
|
|
46
|
|
|
47 static const std::string HEADER_VERSION;
|
|
|
48
|
|
|
49 private:
|
|
|
50 Orthanc::Semaphore concurrentInputSizeSemaphore_;
|
|
|
51 size_t maxConcurrentInputSize_;
|
|
|
52
|
|
|
53 CryptoPP::AutoSeededRandomPool randomGenerator_;
|
|
|
54
|
|
|
55 CryptoPP::SecByteBlock encryptionMasterKey_; // at a given time, there's only one master key that is used for encryption
|
|
|
56 std::string encryptionMasterKeyId_;
|
|
|
57
|
|
|
58 std::map<std::string, CryptoPP::SecByteBlock> previousMasterKeys_; // for decryption, we might use older master keys too
|
|
|
59
|
|
|
60 public:
|
|
|
61
|
|
|
62 // since the memory used during encryption/decryption can grow up to a bit more than 2 times the input,
|
|
|
63 // we want to limit the number of threads doing concurrent processing according to the available memory
|
|
|
64 // instead of the number of concurrent threads
|
|
|
65 EncryptionHelpers(size_t maxConcurrentInputSize = 1024*1024*1024);
|
|
|
66
|
|
|
67 void SetCurrentMasterKey(uint32_t id, const std::string& path);
|
|
|
68
|
|
|
69 void SetCurrentMasterKey(uint32_t id, const CryptoPP::SecByteBlock& key);
|
|
|
70
|
|
|
71 void AddPreviousMasterKey(uint32_t id, const std::string& path);
|
|
|
72
|
|
|
73 void AddPreviousMasterKey(uint32_t id, const CryptoPP::SecByteBlock& key);
|
|
|
74
|
|
|
75 // input: plain text data
|
|
|
76 // output: prefix/encrypted data/integrity check tag
|
|
|
77 void Encrypt(std::string& output, const std::string& input);
|
|
|
78 void Encrypt(std::string& output, const char* data, size_t size);
|
|
|
79
|
|
|
80 // input: prefix/encrypted data/integrity check tag
|
|
|
81 // output: plain text data
|
|
|
82 void Decrypt(std::string& output, const std::string& input);
|
|
|
83 void Decrypt(char* output, const char* data, size_t size);
|
|
|
84
|
|
|
85 static void GenerateKey(CryptoPP::SecByteBlock& key);
|
|
|
86
|
|
|
87 private:
|
|
|
88
|
|
|
89 void EncryptInternal(std::string& output, const char* data, size_t size, const CryptoPP::SecByteBlock& masterKey);
|
|
|
90
|
|
|
91 void DecryptInternal(char* output, const char* data, size_t size, const CryptoPP::SecByteBlock& masterKey);
|
|
|
92
|
|
|
93 void EncryptPrefixSecBlock(std::string& output, const CryptoPP::SecByteBlock& input, const CryptoPP::SecByteBlock& masterKey);
|
|
|
94
|
|
|
95 void DecryptPrefixSecBlock(CryptoPP::SecByteBlock& output, const std::string& input, const CryptoPP::SecByteBlock& masterKey);
|
|
|
96
|
|
|
97 std::string GetMasterKeyIdentifier(const CryptoPP::SecByteBlock& masterKey);
|
|
|
98
|
|
|
99 const CryptoPP::SecByteBlock& GetMasterKey(const std::string& keyId);
|
|
|
100
|
|
|
101 public:
|
|
|
102
|
|
|
103 static std::string ToHexString(const CryptoPP::byte* block, size_t size);
|
|
|
104 static std::string ToHexString(const std::string& block);
|
|
|
105 static std::string ToHexString(const CryptoPP::SecByteBlock& block);
|
|
|
106 static std::string ToString(const CryptoPP::SecByteBlock& block);
|
|
|
107 static std::string ToString(uint32_t value);
|
|
|
108
|
|
|
109 static void ReadKey(CryptoPP::SecByteBlock& key, const std::string& path);
|
|
|
110 //static void EncryptionHelpers::Encrypt(std::string& output, const std::string& input, const std::string& key, const std::string& iv);
|
|
|
111 };
|
|
|
112
|
