rektor(RSA): Umbenennung von dir in cryptographer und Verschiebung der zugehörigen Klassen

DigitalData.Core.Security/Cryptographer/RSACryptographer.cs

@@ -0,0 +1,20 @@
+using DigitalData.Core.Abstractions.Security;
+using System.Security.Cryptography;
+
+namespace DigitalData.Core.Security.Cryptographer
+{
+    public class RSACryptographer : IRSACryptographer
+    {
+        public required virtual string Pem { get; init; }
+
+        public RSAEncryptionPadding Padding { get; init; } = RSAEncryptionPadding.OaepSHA256;
+
+        protected virtual RSA RSA { get; } = RSA.Create();
+
+        public string? Issuer { get; init; }
+
+        public string? Audience { get; init; }
+
+        internal RSACryptographer() { }
+    }
+}

DigitalData.Core.Security/Cryptographer/RSADecryptor.cs

@@ -0,0 +1,58 @@
+using DigitalData.Core.Abstractions.Security;
+using DigitalData.Core.Security.Extensions;
+using System.Security.Cryptography;
+
+namespace DigitalData.Core.Security.Cryptographer
+{
+    public class RSADecryptor : RSACryptographer, IRSADecryptor, IRSACryptographer
+    {
+        public (string Value, Version Version)? VersionedPassword
+        {
+            init
+            {
+                _password = value?.Value;
+                PasswordVersion = value?.Version;
+            }
+        }
+
+        private string? _password;
+
+        public Version? PasswordVersion { get; private init; } = null;
+
+        public bool HasEncryptedPem => _password is not null;
+
+        public bool IsEncrypted => _password is not null;
+
+        private readonly Lazy<IRSAEncryptor> _lazyEncryptor;
+
+        public IRSAEncryptor Encryptor => _lazyEncryptor.Value;
+
+        private readonly Lazy<RSA> lazyRSA;
+
+        protected override RSA RSA => lazyRSA.Value;
+
+        public RSADecryptor()
+        {
+            _lazyEncryptor = new(() => new RSAEncryptor()
+            {
+                Pem = RSA.ExportRSAPublicKeyPem(),
+                Padding = Padding
+            });
+
+            lazyRSA = new(() =>
+            {
+                var rsa = RSA.Create();
+                if (_password is null)
+                    RSA.ImportFromPem(Pem);
+                else
+                    RSA.ImportFromEncryptedPem(Pem, _password.AsSpan());
+
+                return rsa;
+            });
+        }
+
+        public byte[] Decrypt(byte[] data) => RSA.Decrypt(data, Padding);
+
+        public string Decrypt(string data) => RSA.Decrypt(data.Base64ToByte(), Padding).BytesToString();
+    }
+}

DigitalData.Core.Security/Cryptographer/RSAEncryptor.cs

@@ -0,0 +1,24 @@
+using DigitalData.Core.Abstractions.Security;
+using DigitalData.Core.Security.Extensions;
+
+namespace DigitalData.Core.Security.Cryptographer
+{
+    public class RSAEncryptor : RSACryptographer, IRSAEncryptor, IRSACryptographer
+    {
+        public override required string Pem
+        {
+            get => base.Pem;
+            init
+            {
+                RSA.ImportFromPem(base.Pem);
+                base.Pem = value;
+            }
+        }
+
+        public byte[] Encrypt(byte[] data) => RSA.Encrypt(data, Padding);
+
+        public string Encrypt(string data) => RSA.Encrypt(data.Base64ToByte(), Padding).BytesToString();
+
+        public bool Verify(string data, string signature) => Encrypt(data) == signature;
+    }
+}

DigitalData.Core.Security/Cryptographer/RSAFactory.cs

@@ -0,0 +1,65 @@
+using DigitalData.Core.Abstractions.Security;
+using DigitalData.Core.Security.Config;
+using Microsoft.Extensions.Options;
+using System.Security.Cryptography;
+
+namespace DigitalData.Core.Security.Cryptographer
+{
+    public class RSAFactory<TRSAFactoryParams> : IRSAFactory<TRSAFactoryParams> where TRSAFactoryParams : RSAFactoryParams
+    {
+        private static readonly Lazy<RSAFactory<RSAFactoryParams>> LazyInstance = new(() => new(Options.Create<RSAFactoryParams>(new())));
+
+        public static RSAFactory<RSAFactoryParams> Static => LazyInstance.Value;
+
+        protected readonly TRSAFactoryParams _params;
+
+        public RSAFactory(IOptions<TRSAFactoryParams> options) => _params = options.Value;
+
+        public string CreateRSAPrivateKeyPem(int? keySizeInBits = null)
+            => RSA.Create(keySizeInBits ?? _params.KeySizeInBits).ExportRSAPrivateKeyPem();
+
+        public string CreateEncryptedPrivateKeyPem(
+            int? keySizeInBits = null,
+            string? password = null,
+            PbeEncryptionAlgorithm? pbeEncryptionAlgorithm = null,
+            HashAlgorithmName? hashAlgorithmName = null,
+            int? iterationCount = null)
+        {
+            password ??= _params.PbePassword;
+
+            var pbeParameters = pbeEncryptionAlgorithm is null && hashAlgorithmName is null && iterationCount is null
+                ? new PbeParameters(
+                    pbeEncryptionAlgorithm ?? _params.PbeEncryptionAlgorithm,
+                    hashAlgorithmName ?? _params.PbeHashAlgorithmName,
+                    iterationCount ?? _params.PbeIterationCount)
+                : _params.PbeParameters;
+
+            var encryptedPrivateKey = RSA.Create(keySizeInBits ?? _params.KeySizeInBits).ExportEncryptedPkcs8PrivateKey(password.AsSpan(), pbeParameters);
+
+            var pemChars = PemEncoding.Write(_params.EncryptedPrivateKeyPemLabel, encryptedPrivateKey);
+
+            return new string(pemChars);
+        }
+
+        public async Task<IRSADecryptor> ReadRSADecryptorAsync(string path, Version? version = null, CancellationToken cancellationToken = default)
+        {
+            var pem = await File.ReadAllTextAsync(path, cancellationToken);
+
+            (string Value, Version Version)? versionedPassword = null;
+
+            if (version is not null)
+            {
+                if (version != Secrets.Version)
+                    throw new InvalidOperationException($"The provided version {version} does not match the expected version {Secrets.Version}.");
+
+                versionedPassword = (Secrets.PBE_PASSWORD, Secrets.Version);
+            }
+
+            return new RSADecryptor()
+            {
+                Pem = pem,
+                VersionedPassword = versionedPassword
+            };
+        }
+    }
+}