| | | 1 | | // Licensed to the .NET Foundation under one or more agreements. |
| | | 2 | | // The .NET Foundation licenses this file to you under the MIT license. |
| | | 3 | | |
| | | 4 | | using System.Buffers; |
| | | 5 | | using System.Diagnostics; |
| | | 6 | | using System.Runtime.Versioning; |
| | | 7 | | using System.Security.Cryptography; |
| | | 8 | | using System.Text; |
| | | 9 | | |
| | | 10 | | namespace System.IO.Compression |
| | | 11 | | { |
| | | 12 | | /// <summary> |
| | | 13 | | /// Represents the parsed components of WinZip AES key material. |
| | | 14 | | /// The key material layout is: [salt][encryption key][HMAC key][password verifier (2 bytes)]. |
| | | 15 | | /// </summary> |
| | | 16 | | internal readonly struct WinZipAesKeyMaterial |
| | | 17 | | { |
| | 384 | 18 | | public byte[] Salt { get; } |
| | 192 | 19 | | public byte[] EncryptionKey { get; } |
| | 192 | 20 | | public byte[] HmacKey { get; } |
| | 384 | 21 | | public byte[] PasswordVerifier { get; } |
| | | 22 | | public int KeySizeBits { get; } |
| | 288 | 23 | | public int SaltSize { get; } |
| | | 24 | | |
| | | 25 | | private WinZipAesKeyMaterial(byte[] salt, byte[] encryptionKey, byte[] hmacKey, byte[] passwordVerifier, int key |
| | 288 | 26 | | { |
| | 288 | 27 | | if (OperatingSystem.IsBrowser()) |
| | 0 | 28 | | { |
| | 0 | 29 | | throw new PlatformNotSupportedException(SR.WinZipEncryptionNotSupportedOnPlatform); |
| | | 30 | | } |
| | 288 | 31 | | Salt = salt; |
| | 288 | 32 | | EncryptionKey = encryptionKey; |
| | 288 | 33 | | HmacKey = hmacKey; |
| | 288 | 34 | | PasswordVerifier = passwordVerifier; |
| | 288 | 35 | | KeySizeBits = keySizeBits; |
| | 288 | 36 | | SaltSize = GetSaltSize(keySizeBits); |
| | 288 | 37 | | } |
| | | 38 | | |
| | | 39 | | /// <summary> |
| | | 40 | | /// Derives key material from a password and optional salt using PBKDF2-SHA1. |
| | | 41 | | /// </summary> |
| | | 42 | | internal static unsafe WinZipAesKeyMaterial Create(ReadOnlySpan<char> password, byte[]? salt, int keySizeBits) |
| | 288 | 43 | | { |
| | 288 | 44 | | if (OperatingSystem.IsBrowser()) |
| | 0 | 45 | | { |
| | 0 | 46 | | throw new PlatformNotSupportedException(SR.WinZipEncryptionNotSupportedOnPlatform); |
| | | 47 | | } |
| | 288 | 48 | | int saltSize = GetSaltSize(keySizeBits); |
| | 288 | 49 | | int keySizeBytes = keySizeBits / 8; |
| | 288 | 50 | | int totalKeySize = checked(keySizeBytes + keySizeBytes + 2); |
| | | 51 | | |
| | | 52 | | byte[] saltBytes; |
| | 288 | 53 | | if (salt is null) |
| | 96 | 54 | | { |
| | 96 | 55 | | saltBytes = new byte[saltSize]; |
| | 96 | 56 | | RandomNumberGenerator.Fill(saltBytes); |
| | 96 | 57 | | } |
| | | 58 | | else |
| | 192 | 59 | | { |
| | 192 | 60 | | Debug.Assert(salt.Length == saltSize, $"Salt must be {saltSize} bytes for AES-{keySizeBits}."); |
| | 192 | 61 | | saltBytes = salt; |
| | 192 | 62 | | } |
| | | 63 | | |
| | 288 | 64 | | int maxPasswordByteCount = Encoding.UTF8.GetMaxByteCount(password.Length); |
| | 288 | 65 | | byte[] rentedPasswordBytes = ArrayPool<byte>.Shared.Rent(maxPasswordByteCount); |
| | 288 | 66 | | Debug.Assert(totalKeySize <= 66, "totalKeySize should be at most 66 bytes (AES-256: 32 + 32 + 2)"); |
| | 288 | 67 | | Span<byte> derivedKey = stackalloc byte[totalKeySize]; |
| | | 68 | | |
| | | 69 | | try |
| | 288 | 70 | | { |
| | 288 | 71 | | int actualByteCount = Encoding.UTF8.GetBytes(password, rentedPasswordBytes); |
| | 288 | 72 | | Span<byte> passwordSpan = rentedPasswordBytes.AsSpan(0, actualByteCount); |
| | | 73 | | |
| | 288 | 74 | | Rfc2898DeriveBytes.Pbkdf2( |
| | 288 | 75 | | passwordSpan, |
| | 288 | 76 | | saltBytes, |
| | 288 | 77 | | derivedKey, |
| | 288 | 78 | | 1000, // iteration count specified by the WinZip AE-1/AE-2 specification |
| | 288 | 79 | | HashAlgorithmName.SHA1); |
| | | 80 | | |
| | | 81 | | // Slice the derived key directly into its components instead of |
| | | 82 | | // round-tripping through a combined array and Parse. |
| | 288 | 83 | | byte[] encryptionKey = derivedKey.Slice(0, keySizeBytes).ToArray(); |
| | 288 | 84 | | byte[] hmacKey = derivedKey.Slice(keySizeBytes, keySizeBytes).ToArray(); |
| | 288 | 85 | | byte[] passwordVerifier = derivedKey.Slice(keySizeBytes + keySizeBytes, 2).ToArray(); |
| | | 86 | | |
| | 288 | 87 | | return new WinZipAesKeyMaterial(saltBytes, encryptionKey, hmacKey, passwordVerifier, keySizeBits); |
| | | 88 | | } |
| | | 89 | | finally |
| | 288 | 90 | | { |
| | 288 | 91 | | CryptographicOperations.ZeroMemory(rentedPasswordBytes); |
| | 288 | 92 | | CryptographicOperations.ZeroMemory(derivedKey); |
| | 288 | 93 | | ArrayPool<byte>.Shared.Return(rentedPasswordBytes); |
| | 288 | 94 | | } |
| | 288 | 95 | | } |
| | | 96 | | |
| | 672 | 97 | | internal static int GetSaltSize(int keySizeBits) => keySizeBits / 16; |
| | | 98 | | } |
| | | 99 | | } |