Skip to content

Commit 203eca5

Browse files
brentschmaltzbrentschmaltz
committed
Issue: #1236
Make sure our defined asymmetric SecurityAlgorithms have entries for checking key sizes
1 parent e4928af commit 203eca5

File tree

4 files changed

+176
-75
lines changed

4 files changed

+176
-75
lines changed

‎src/Microsoft.IdentityModel.Tokens/AsymmetricSignatureProvider.cs‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,9 @@ public class AsymmetricSignatureProvider : SignatureProvider
5151
{ SecurityAlgorithms.EcdsaSha256, 256 },
5252
{ SecurityAlgorithms.EcdsaSha384, 256 },
5353
{ SecurityAlgorithms.EcdsaSha512, 256 },
54+
{ SecurityAlgorithms.EcdsaSha256Signature, 256 },
55+
{ SecurityAlgorithms.EcdsaSha384Signature, 256 },
56+
{ SecurityAlgorithms.EcdsaSha512Signature, 256 },
5457
{ SecurityAlgorithms.RsaSha256, 2048 },
5558
{ SecurityAlgorithms.RsaSha384, 2048 },
5659
{ SecurityAlgorithms.RsaSha512, 2048 },
@@ -73,6 +76,9 @@ public class AsymmetricSignatureProvider : SignatureProvider
7376
{ SecurityAlgorithms.EcdsaSha256, 256 },
7477
{ SecurityAlgorithms.EcdsaSha384, 256 },
7578
{ SecurityAlgorithms.EcdsaSha512, 256 },
79+
{ SecurityAlgorithms.EcdsaSha256Signature, 256 },
80+
{ SecurityAlgorithms.EcdsaSha384Signature, 256 },
81+
{ SecurityAlgorithms.EcdsaSha512Signature, 256 },
7682
{ SecurityAlgorithms.RsaSha256, 1024 },
7783
{ SecurityAlgorithms.RsaSha384, 1024 },
7884
{ SecurityAlgorithms.RsaSha512, 1024 },

‎src/Microsoft.IdentityModel.Tokens/Encryption/RsaKeyWrapProvider.cs‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -108,15 +108,6 @@ protected override void Dispose(bool disposing)
108108
/// <returns>true if the algorithm is supported; otherwise, false.</returns>
109109
protected virtual bool IsSupportedAlgorithm(SecurityKey key, string algorithm)
110110
{
111-
if (key == null)
112-
return false;
113-
114-
if (string.IsNullOrEmpty(algorithm))
115-
return false;
116-
117-
if (key.KeySize < 2048)
118-
return false;
119-
120111
return SupportedAlgorithms.IsSupportedKeyWrapAlgorithm(algorithm, key);
121112
}
122113

‎src/Microsoft.IdentityModel.Tokens/SupportedAlgorithms.cs‎

Lines changed: 85 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -25,9 +25,11 @@
2525
//
2626
//------------------------------------------------------------------------------
2727

28-
using Microsoft.IdentityModel.Logging;
2928
using System;
29+
using System.Collections.Generic;
30+
using System.Collections.ObjectModel;
3031
using System.Security.Cryptography;
32+
using Microsoft.IdentityModel.Logging;
3133

3234
namespace Microsoft.IdentityModel.Tokens
3335
{
@@ -36,6 +38,76 @@ namespace Microsoft.IdentityModel.Tokens
3638
/// </summary>
3739
internal static class SupportedAlgorithms
3840
{
41+
internal static readonly ICollection<string> EcdsaSigningAlgorithms = new Collection<string>
42+
{
43+
SecurityAlgorithms.EcdsaSha256,
44+
SecurityAlgorithms.EcdsaSha256Signature,
45+
SecurityAlgorithms.EcdsaSha384,
46+
SecurityAlgorithms.EcdsaSha384Signature,
47+
SecurityAlgorithms.EcdsaSha512,
48+
SecurityAlgorithms.EcdsaSha512Signature
49+
};
50+
51+
internal static readonly ICollection<string> HashAlgorithms = new Collection<string>
52+
{
53+
SecurityAlgorithms.Sha256,
54+
SecurityAlgorithms.Sha256Digest,
55+
SecurityAlgorithms.Sha384,
56+
SecurityAlgorithms.Sha384Digest,
57+
SecurityAlgorithms.Sha512,
58+
SecurityAlgorithms.Sha512Digest
59+
};
60+
61+
internal static readonly ICollection<string> RsaEncryptionAlgorithms = new Collection<string>
62+
{
63+
SecurityAlgorithms.RsaOAEP,
64+
SecurityAlgorithms.RsaPKCS1,
65+
SecurityAlgorithms.RsaOaepKeyWrap
66+
};
67+
68+
internal static readonly ICollection<string> RsaSigningAlgorithms = new Collection<string>
69+
{
70+
SecurityAlgorithms.RsaSha256,
71+
SecurityAlgorithms.RsaSha384,
72+
SecurityAlgorithms.RsaSha512,
73+
SecurityAlgorithms.RsaSha256Signature,
74+
SecurityAlgorithms.RsaSha384Signature,
75+
SecurityAlgorithms.RsaSha512Signature
76+
};
77+
78+
internal static readonly ICollection<string> RsaPssSigningAlgorithms = new Collection<string>
79+
{
80+
SecurityAlgorithms.RsaSsaPssSha256,
81+
SecurityAlgorithms.RsaSsaPssSha384,
82+
SecurityAlgorithms.RsaSsaPssSha512,
83+
SecurityAlgorithms.RsaSsaPssSha256Signature,
84+
SecurityAlgorithms.RsaSsaPssSha384Signature,
85+
SecurityAlgorithms.RsaSsaPssSha512Signature
86+
};
87+
88+
internal static readonly ICollection<string> SymmetricEncryptionAlgorithms = new Collection<string>
89+
{
90+
SecurityAlgorithms.Aes128CbcHmacSha256,
91+
SecurityAlgorithms.Aes192CbcHmacSha384,
92+
SecurityAlgorithms.Aes256CbcHmacSha512
93+
};
94+
95+
internal static readonly ICollection<string> SymmetricKeyWrapAlgorithms = new Collection<string>
96+
{
97+
SecurityAlgorithms.Aes128KW,
98+
SecurityAlgorithms.Aes256KW
99+
};
100+
101+
internal static readonly ICollection<string> SymmetricSigningAlgorithms = new Collection<string>
102+
{
103+
SecurityAlgorithms.HmacSha256Signature,
104+
SecurityAlgorithms.HmacSha384Signature,
105+
SecurityAlgorithms.HmacSha512Signature,
106+
SecurityAlgorithms.HmacSha256,
107+
SecurityAlgorithms.HmacSha384,
108+
SecurityAlgorithms.HmacSha512
109+
};
110+
39111
/// <summary>
40112
/// Checks if an 'algorithm, key' pair is supported.
41113
/// </summary>
@@ -101,35 +173,12 @@ internal static bool IsSupportedAuthenticatedEncryptionAlgorithm(string algorith
101173

102174
private static bool IsSupportedEcdsaAlgorithm(string algorithm)
103175
{
104-
switch (algorithm)
105-
{
106-
case SecurityAlgorithms.EcdsaSha256:
107-
case SecurityAlgorithms.EcdsaSha256Signature:
108-
case SecurityAlgorithms.EcdsaSha384:
109-
case SecurityAlgorithms.EcdsaSha384Signature:
110-
case SecurityAlgorithms.EcdsaSha512:
111-
case SecurityAlgorithms.EcdsaSha512Signature:
112-
return true;
113-
}
114-
115-
return false;
176+
return EcdsaSigningAlgorithms.Contains(algorithm);
116177
}
117178

118179
internal static bool IsSupportedHashAlgorithm(string algorithm)
119180
{
120-
switch (algorithm)
121-
{
122-
case SecurityAlgorithms.Sha256:
123-
case SecurityAlgorithms.Sha256Digest:
124-
case SecurityAlgorithms.Sha384:
125-
case SecurityAlgorithms.Sha384Digest:
126-
case SecurityAlgorithms.Sha512:
127-
case SecurityAlgorithms.Sha512Digest:
128-
return true;
129-
130-
default:
131-
return false;
132-
}
181+
return HashAlgorithms.Contains(algorithm);
133182
}
134183

135184
internal static bool IsSupportedKeyWrapAlgorithm(string algorithm, SecurityKey key)
@@ -140,7 +189,10 @@ internal static bool IsSupportedKeyWrapAlgorithm(string algorithm, SecurityKey k
140189
if (string.IsNullOrEmpty(algorithm))
141190
return false;
142191

143-
if (algorithm.Equals(SecurityAlgorithms.RsaPKCS1, StringComparison.Ordinal)
192+
if (key.KeySize < 2048)
193+
return false;
194+
195+
if ( algorithm.Equals(SecurityAlgorithms.RsaPKCS1, StringComparison.Ordinal)
144196
|| algorithm.Equals(SecurityAlgorithms.RsaOAEP, StringComparison.Ordinal)
145197
|| algorithm.Equals(SecurityAlgorithms.RsaOaepKeyWrap, StringComparison.Ordinal))
146198
{
@@ -159,28 +211,9 @@ internal static bool IsSupportedKeyWrapAlgorithm(string algorithm, SecurityKey k
159211

160212
internal static bool IsSupportedRsaAlgorithm(string algorithm, SecurityKey key)
161213
{
162-
switch (algorithm)
163-
{
164-
case SecurityAlgorithms.RsaSha256:
165-
case SecurityAlgorithms.RsaSha384:
166-
case SecurityAlgorithms.RsaSha512:
167-
case SecurityAlgorithms.RsaSha256Signature:
168-
case SecurityAlgorithms.RsaSha384Signature:
169-
case SecurityAlgorithms.RsaSha512Signature:
170-
case SecurityAlgorithms.RsaOAEP:
171-
case SecurityAlgorithms.RsaPKCS1:
172-
case SecurityAlgorithms.RsaOaepKeyWrap:
173-
return true;
174-
case SecurityAlgorithms.RsaSsaPssSha256:
175-
case SecurityAlgorithms.RsaSsaPssSha384:
176-
case SecurityAlgorithms.RsaSsaPssSha512:
177-
case SecurityAlgorithms.RsaSsaPssSha256Signature:
178-
case SecurityAlgorithms.RsaSsaPssSha384Signature:
179-
case SecurityAlgorithms.RsaSsaPssSha512Signature:
180-
return IsSupportedRsaPss(key);
181-
}
182-
183-
return false;
214+
return RsaSigningAlgorithms.Contains(algorithm)
215+
|| RsaEncryptionAlgorithms.Contains(algorithm)
216+
|| (RsaPssSigningAlgorithms.Contains(algorithm) && IsSupportedRsaPss(key));
184217
}
185218

186219
private static bool IsSupportedRsaPss(SecurityKey key)
@@ -212,23 +245,9 @@ private static bool IsSupportedRsaPss(SecurityKey key)
212245

213246
internal static bool IsSupportedSymmetricAlgorithm(string algorithm)
214247
{
215-
switch (algorithm)
216-
{
217-
case SecurityAlgorithms.Aes128CbcHmacSha256:
218-
case SecurityAlgorithms.Aes192CbcHmacSha384:
219-
case SecurityAlgorithms.Aes256CbcHmacSha512:
220-
case SecurityAlgorithms.Aes128KW:
221-
case SecurityAlgorithms.Aes256KW:
222-
case SecurityAlgorithms.HmacSha256Signature:
223-
case SecurityAlgorithms.HmacSha384Signature:
224-
case SecurityAlgorithms.HmacSha512Signature:
225-
case SecurityAlgorithms.HmacSha256:
226-
case SecurityAlgorithms.HmacSha384:
227-
case SecurityAlgorithms.HmacSha512:
228-
return true;
229-
}
230-
231-
return false;
248+
return SymmetricEncryptionAlgorithms.Contains(algorithm)
249+
|| SymmetricKeyWrapAlgorithms.Contains(algorithm)
250+
|| SymmetricSigningAlgorithms.Contains(algorithm);
232251
}
233252
}
234253
}

‎test/Microsoft.IdentityModel.Tokens.Tests/AsymmetricSignatureTests.cs‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -410,6 +410,91 @@ public static TheoryData<AsymmetricSignatureProviderTheoryData> ValidateAsymmetr
410410
}
411411
};
412412
}
413+
414+
/// <summary>
415+
/// This test ensures that if every algorithm in SupportedAlgorithms has a value in our maps that validate key sizes
416+
/// </summary>
417+
/// <param name="theoryData"></param>
418+
[Theory, MemberData(nameof(VerifyAlgorithmsInDefaultMinimumAsymmetricKeySizeTests))]
419+
public void VerifyAlgorithmsInDefaultMinimumAsymmetricKeySize(AsymmetricSignatureProviderTheoryData theoryData)
420+
{
421+
var context = TestUtilities.WriteHeader($"{this}.VerifyAlgorithmsInDefaultMinimumAsymmetricKeySize", theoryData);
422+
if (!AsymmetricSignatureProvider.DefaultMinimumAsymmetricKeySizeInBitsForSigningMap.ContainsKey(theoryData.Algorithm))
423+
context.AddDiff($"!AsymmetricSignatureProvider.DefaultMinimumAsymmetricKeySizeInBitsForSigningMap.ContainsKey(theoryData.Algorithm)) algorithm: '{theoryData.Algorithm}'.");
424+
425+
if (!AsymmetricSignatureProvider.DefaultMinimumAsymmetricKeySizeInBitsForVerifyingMap.ContainsKey(theoryData.Algorithm))
426+
context.AddDiff($"!AsymmetricSignatureProvider.DefaultMinimumAsymmetricKeySizeInBitsForVerifyingMap.ContainsKey(theoryData.Algorithm)): algorithm: '{theoryData.Algorithm}'.");
427+
428+
TestUtilities.AssertFailIfErrors(context);
429+
}
430+
431+
public static TheoryData<AsymmetricSignatureProviderTheoryData> VerifyAlgorithmsInDefaultMinimumAsymmetricKeySizeTests
432+
{
433+
get
434+
{
435+
var theoryData = new TheoryData<AsymmetricSignatureProviderTheoryData>();
436+
437+
foreach (var algorithm in SupportedAlgorithms.EcdsaSigningAlgorithms)
438+
theoryData.Add(
439+
new AsymmetricSignatureProviderTheoryData
440+
{
441+
Algorithm = algorithm,
442+
SecurityKey = KeyingMaterial.RsaSecurityKey_4096,
443+
TestId = algorithm
444+
});
445+
446+
foreach (var algorithm in SupportedAlgorithms.RsaPssSigningAlgorithms)
447+
theoryData.Add(
448+
new AsymmetricSignatureProviderTheoryData
449+
{
450+
Algorithm = algorithm,
451+
SecurityKey = KeyingMaterial.RsaSecurityKey_4096,
452+
TestId = algorithm
453+
});
454+
455+
456+
foreach (var algorithm in SupportedAlgorithms.RsaSigningAlgorithms)
457+
theoryData.Add(
458+
new AsymmetricSignatureProviderTheoryData
459+
{
460+
Algorithm = algorithm,
461+
SecurityKey = KeyingMaterial.RsaSecurityKey_4096,
462+
TestId = algorithm
463+
});
464+
465+
return theoryData;
466+
}
467+
}
468+
469+
/// <summary>
470+
/// This test ensures that if new keys sizes are added to the dictionaries that check for default supported algorithms, we have those algorithms in SupportedAlgorithms
471+
/// </summary>
472+
[Fact]
473+
public void VerifyDefaultMinimumAsymmetricKeySizeAreSupported()
474+
{
475+
var theoryData = new TheoryDataBase
476+
{
477+
TestId = "VerifyDefaultMinimumAsymmetricKeySizeAreSupported"
478+
};
479+
480+
var context = TestUtilities.WriteHeader($"{this}.VerifyDefaultMinimumAsymmetricKeySizeAreSupported", theoryData);
481+
482+
foreach (var algorithm in AsymmetricSignatureProvider.DefaultMinimumAsymmetricKeySizeInBitsForSigningMap.Keys)
483+
if (!(SupportedAlgorithms.EcdsaSigningAlgorithms.Contains(algorithm) || SupportedAlgorithms.RsaPssSigningAlgorithms.Contains(algorithm) || SupportedAlgorithms.RsaSigningAlgorithms.Contains(algorithm)))
484+
{
485+
context.AddDiff($"DefaultMinimumAsymmetricKeySizeInBitsForSigningMap, algorithm: '{algorithm}' not found in (SupportedAlgorithms.EcdsaSigningAlgorithms || SupportedAlgorithms.RsaPssSigningAlgorithms || SupportedAlgorithms.RsaSigningAlgorithms.");
486+
context.AddDiff($"seems like algorithm was added somewhere: '{algorithm}'.");
487+
}
488+
489+
foreach (var algorithm in AsymmetricSignatureProvider.DefaultMinimumAsymmetricKeySizeInBitsForVerifyingMap.Keys)
490+
if (!(SupportedAlgorithms.EcdsaSigningAlgorithms.Contains(algorithm) || SupportedAlgorithms.RsaPssSigningAlgorithms.Contains(algorithm) || SupportedAlgorithms.RsaSigningAlgorithms.Contains(algorithm)))
491+
{
492+
context.AddDiff($"DefaultMinimumAsymmetricKeySizeInBitsForVerifyingMap, algorithm: '{algorithm}' not found in (SupportedAlgorithms.EcdsaSigningAlgorithms || SupportedAlgorithms.RsaPssSigningAlgorithms || SupportedAlgorithms.RsaSigningAlgorithms");
493+
context.AddDiff($"seems like algorithm was added somewhere: '{algorithm}'.");
494+
}
495+
496+
TestUtilities.AssertFailIfErrors(context);
497+
}
413498
}
414499

415500
public class AsymmetricSignatureProviderTheoryData : TheoryDataBase

0 commit comments

Comments
 (0)