Merge pull request #6 from filipw/bouncycastle-2.4.0

filipw · web-flow · commit f9de0a73196b · 2024-08-16T09:06:22.000+02:00
Upgraded to .NET 8.0 and BC 2.4.0
diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml
@@ -18,7 +18,7 @@ jobs:
     - name: Setup .NET
       uses: actions/setup-dotnet@v3
       with:
-        dotnet-version: 7.0.x
+        dotnet-version: 8.0.x
     - name: Restore dependencies
       run: dotnet restore
     - name: Build
@@ -35,7 +35,7 @@ jobs:
       - name: Setup .NET
         uses: actions/setup-dotnet@v3
         with:
-          dotnet-version: 7.0.x
+          dotnet-version: 8.0.x
       - name: Restore dependencies
         run: dotnet restore
       - name: Build & Pack
diff --git a/.gitignore b/.gitignore
@@ -396,3 +396,7 @@ FodyWeavers.xsd
 
 # JetBrains Rider
 *.sln.iml
+.idea/.idea.Strathweb.Dilithium/.idea
+.idea
+.DS_Store
+samples/IdentityServer/keys
diff --git a/Directory.Build.props b/Directory.Build.props
@@ -1,6 +1,6 @@
 <Project>
     <PropertyGroup>
-        <Version>0.1.0</Version>
+        <Version>0.2.0</Version>
         <Deterministic>true</Deterministic>
         <RepositoryUrl>https://github.com/filipw/Strathweb.Dilithium.git</RepositoryUrl>
         <PackageTags>asp.net;security;post-quantum;dilithium;quantum;cryptography</PackageTags>
diff --git a/samples/ConsoleClient/ConsoleClient.csproj b/samples/ConsoleClient/ConsoleClient.csproj
@@ -2,14 +2,14 @@
 
     <PropertyGroup>
         <OutputType>Exe</OutputType>
-        <TargetFramework>net7.0</TargetFramework>
+        <TargetFramework>net8.0</TargetFramework>
         <ImplicitUsings>enable</ImplicitUsings>
         <Nullable>enable</Nullable>
         <IsPackable>false</IsPackable>
     </PropertyGroup>
 
     <ItemGroup>
-      <PackageReference Include="identitymodel" Version="6.1.0" />
+      <PackageReference Include="identitymodel" Version="7.0.0" />
     </ItemGroup>
 
 </Project>
diff --git a/samples/IdentityServer/IdentityServer.csproj b/samples/IdentityServer/IdentityServer.csproj
@@ -1,12 +1,12 @@
 ﻿<Project Sdk="Microsoft.NET.Sdk.Web">
 
   <PropertyGroup>
-    <TargetFramework>net7.0</TargetFramework>
+    <TargetFramework>net8.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
   </PropertyGroup>
   
   <ItemGroup>
-    <PackageReference Include="Duende.IdentityServer" Version="6.2.0" />
+    <PackageReference Include="Duende.IdentityServer" Version="7.0.6" />
   </ItemGroup>
   
   <ItemGroup>
diff --git a/samples/SampleApi/SampleApi.csproj b/samples/SampleApi/SampleApi.csproj
@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk.Web">
 
     <PropertyGroup>
-        <TargetFramework>net7.0</TargetFramework>
+        <TargetFramework>net8.0</TargetFramework>
         <Nullable>enable</Nullable>
         <ImplicitUsings>enable</ImplicitUsings>
     </PropertyGroup>
diff --git a/src/Strathweb.Dilithium.AspNetCore.Tests/Strathweb.Dilithium.AspNetCore.Tests.csproj b/src/Strathweb.Dilithium.AspNetCore.Tests/Strathweb.Dilithium.AspNetCore.Tests.csproj
@@ -1,16 +1,16 @@
 <Project Sdk="Microsoft.NET.Sdk.Web">
 
     <PropertyGroup>
-        <TargetFramework>net7.0</TargetFramework>
+        <TargetFramework>net8.0</TargetFramework>
         <ImplicitUsings>enable</ImplicitUsings>
         <Nullable>enable</Nullable>
         <IsTestProject>true</IsTestProject>
     </PropertyGroup>
 
     <ItemGroup>
-      <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="7.0.10" />
-        <PackageReference Include="Duende.IdentityServer" Version="6.2.0" />
-        <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.5.0" />
+      <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="8.0.8" />
+        <PackageReference Include="Duende.IdentityServer" Version="7.0.6" />
+        <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.10.0" />
         <PackageReference Include="xunit" Version="2.4.2" />
         <PackageReference Include="xunit.runner.visualstudio" Version="2.4.5">
             <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
@@ -20,7 +20,7 @@
             <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
             <PrivateAssets>all</PrivateAssets>
         </PackageReference>
-        <PackageReference Include="identitymodel" Version="6.1.0" />
+        <PackageReference Include="identitymodel" Version="7.0.0" />
     </ItemGroup>
 
     <ItemGroup>
diff --git a/src/Strathweb.Dilithium.AspNetCore/DilithiumConfigurationExtensions.cs b/src/Strathweb.Dilithium.AspNetCore/DilithiumConfigurationExtensions.cs
@@ -1,6 +1,7 @@
 using System.IdentityModel.Tokens.Jwt;
 using Microsoft.AspNetCore.Authentication.JwtBearer;
 using Microsoft.Extensions.Caching.Memory;
+using Microsoft.IdentityModel.JsonWebTokens;
 using Microsoft.IdentityModel.Protocols;
 using Microsoft.IdentityModel.Protocols.OpenIdConnect;
 using Microsoft.IdentityModel.Tokens;
@@ -33,7 +34,7 @@ private static void ConfigureDilithiumTokenSupportInternal(JwtBearerOptions opti
         var lweCryptoProvideFactory = new DilithiumCryptoProviderFactory();
         options.TokenValidationParameters.IssuerSigningKeyResolver = (_, securityToken, kid, tokenValidationParameters) =>
         {
-            if (securityToken is not JwtSecurityToken _)
+            if (securityToken is not JwtSecurityToken && securityToken is not JsonWebToken)
             {
                 return Enumerable.Empty<SecurityKey>();
             }
@@ -50,7 +51,7 @@ private static void ConfigureDilithiumTokenSupportInternal(JwtBearerOptions opti
             }
 
             var serverUrl = tokenValidationParameters.ValidIssuer ??
-                            tokenValidationParameters.ValidIssuers.FirstOrDefault() ?? options.Authority;
+                            tokenValidationParameters.ValidIssuers?.FirstOrDefault() ?? options.Authority;
 
             if (serverUrl == null)
                 throw new Exception(
diff --git a/src/Strathweb.Dilithium.AspNetCore/Strathweb.Dilithium.AspNetCore.csproj b/src/Strathweb.Dilithium.AspNetCore/Strathweb.Dilithium.AspNetCore.csproj
@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
     <PropertyGroup>
-        <TargetFramework>net7.0</TargetFramework>
+        <TargetFramework>net8.0</TargetFramework>
         <ImplicitUsings>enable</ImplicitUsings>
         <Nullable>enable</Nullable>
     </PropertyGroup>
@@ -11,11 +11,7 @@
     </ItemGroup>
     
     <ItemGroup>
-        <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="7.0.9" />
-        
-        <!-- this reference below is not needed, but added to work around this lovely bug 
-        https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/1792 -->
-        <PackageReference Include="System.IdentityModel.Tokens.Jwt " Version="6.32.1" />
+        <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="8.0.8" />
     </ItemGroup>
 
 </Project>
diff --git a/src/Strathweb.Dilithium.DuendeIdentityServer/Strathweb.Dilithium.DuendeIdentityServer.csproj b/src/Strathweb.Dilithium.DuendeIdentityServer/Strathweb.Dilithium.DuendeIdentityServer.csproj
@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
     <PropertyGroup>
-        <TargetFramework>net7.0</TargetFramework>
+        <TargetFramework>net8.0</TargetFramework>
         <ImplicitUsings>enable</ImplicitUsings>
         <Nullable>enable</Nullable>
     </PropertyGroup>
@@ -11,7 +11,7 @@
     </ItemGroup>
     
     <ItemGroup>
-        <PackageReference Include="Duende.IdentityServer" Version="6.2.0" />
+        <PackageReference Include="Duende.IdentityServer" Version="7.0.6" />
     </ItemGroup>
 
 </Project>
diff --git a/src/Strathweb.Dilithium.IdentityModel/DilithiumSecurityKey.cs b/src/Strathweb.Dilithium.IdentityModel/DilithiumSecurityKey.cs
@@ -23,7 +23,7 @@ public DilithiumSecurityKey(string algorithm)
         }
 
         SupportedAlgorithm = algorithm;
-            
+
         var dilithiumParameters = GetDilithiumParameters(algorithm);
         var random = new SecureRandom();
         var keyGenParameters = new DilithiumKeyGenerationParameters(random, dilithiumParameters);
@@ -58,13 +58,14 @@ public DilithiumSecurityKey(JsonWebKey jsonWebKey)
         }
 
         SupportedAlgorithm = jsonWebKey.Alg;
-        
+
         var dilithiumParameters = GetDilithiumParameters(jsonWebKey.Alg);
         PublicKey = new DilithiumPublicKeyParameters(dilithiumParameters, Base64UrlEncoder.DecodeBytes(jsonWebKey.X));
 
         if (jsonWebKey.D != null)
         {
-            PrivateKey = GetPrivateKeyParametersFromEncodedKey(dilithiumParameters, Base64UrlEncoder.DecodeBytes(jsonWebKey.D));
+            PrivateKey =
+                GetPrivateKeyParametersFromEncodedKey(dilithiumParameters, Base64UrlEncoder.DecodeBytes(jsonWebKey.D));
         }
 
         _keyId = jsonWebKey.KeyId;
@@ -91,8 +92,9 @@ public DilithiumSecurityKey(string algorithm, string keyId, byte[] publicKey, by
             throw new NotSupportedException(
                 $"Algorithm {algorithm} is not supported. Supported algorithms: CRYDI2, CRYDI3 and CRYDI5.");
         }
+
         SupportedAlgorithm = algorithm;
-        
+
         var dilithiumParameters = GetDilithiumParameters(algorithm);
         PublicKey = new DilithiumPublicKeyParameters(dilithiumParameters, publicKey);
 
@@ -104,11 +106,11 @@ public DilithiumSecurityKey(string algorithm, string keyId, byte[] publicKey, by
         _keyId = keyId;
         CryptoProviderFactory = new DilithiumCryptoProviderFactory();
     }
-    
+
     public DilithiumPublicKeyParameters PublicKey { get; set; }
-    
+
     public DilithiumPrivateKeyParameters? PrivateKey { get; set; }
-    
+
     public override int KeySize { get; }
 
     public string SupportedAlgorithm { get; }
@@ -126,7 +128,7 @@ private DilithiumParameters GetDilithiumParameters(string algorithm)
         throw new NotSupportedException($"Unsupported algorithm type: '{algorithm}'");
     }
 
-    [Obsolete("HasPrivateKey method is deprecated, please use PrivateKeyStatus instead.")] 
+    [Obsolete("HasPrivateKey method is deprecated, please use PrivateKeyStatus instead.")]
     public override bool HasPrivateKey => PrivateKey != null;
 
     public override PrivateKeyStatus PrivateKeyStatus =>
@@ -151,58 +153,69 @@ public JsonWebKey ToJsonWebKey(bool includePrivateKey)
         return jsonWebKey;
     }
 
-    private DilithiumPrivateKeyParameters GetPrivateKeyParametersFromEncodedKey(DilithiumParameters dilithiumParameters, byte[] encodedPrivateKey)
+    // based on https://github.com/bcgit/bc-csharp/blob/release-2.4.0/crypto/src/pqc/crypto/crystals/dilithium/DilithiumPrivateKeyParameters.cs
+    private DilithiumPrivateKeyParameters GetPrivateKeyParametersFromEncodedKey(DilithiumParameters dilithiumParameters,
+        byte[] encodedPrivateKey)
     {
-        const int seedBytes = 32;
-        int s1Length;
-        int s2Length;
-        int t0Length;
+        const int SeedBytes = 32;
+        const int TrBytes = 64;
+        //const int PolyT1PackedBytes = 320; // not used here but listed for completeness
+        const int PolyT0PackedBytes = 416;
 
+        int K, L, PolyEtaPackedBytes;
+
+        // Set parameters based on the Dilithium mode
         if (dilithiumParameters == DilithiumParameters.Dilithium2)
         {
-            s1Length = 4 * 96; 
-            s2Length = 4 * 96;
-            t0Length = 4 * 416;
-        } 
+            K = 4;
+            L = 4;
+            PolyEtaPackedBytes = 96;
+        }
         else if (dilithiumParameters == DilithiumParameters.Dilithium3)
         {
-            s1Length = 5 * 128;
-            s2Length = 6 * 128;
-            t0Length = 6 * 416;
-        } 
+            K = 6;
+            L = 5;
+            PolyEtaPackedBytes = 128;
+        }
         else if (dilithiumParameters == DilithiumParameters.Dilithium5)
         {
-            s1Length = 7 * 96;
-            s2Length = 8 * 96;
-            t0Length = 8 * 416;
+            K = 8;
+            L = 7;
+            PolyEtaPackedBytes = 96;
         }
         else
         {
             throw new NotSupportedException("Unsupported mode");
         }
-    
-        var rho = new byte[seedBytes]; // SeedBytes length
-        var k = new byte[seedBytes]; // SeedBytes length
-        var tr = new byte[seedBytes]; // SeedBytes length
-        var s1 = new byte[s1Length]; // L * PolyEtaPackedBytes
-        var s2 = new byte[s2Length]; // K * PolyEtaPackedBytes
-        var t0 = new byte[t0Length]; // K * PolyT0PackedBytes
 
+        // calculate the lengths based on the parameters
+        var s1Length = L * PolyEtaPackedBytes;
+        var s2Length = K * PolyEtaPackedBytes;
+        var t0Length = K * PolyT0PackedBytes;
+
+        var rho = new byte[SeedBytes];
+        var k = new byte[SeedBytes];
+        var tr = new byte[TrBytes];
+        var s1 = new byte[s1Length];
+        var s2 = new byte[s2Length];
+        var t0 = new byte[t0Length];
+
+        // copy the respective parts of the encoded private key
         var offset = 0;
-        Array.Copy(encodedPrivateKey, offset, rho, 0, seedBytes);
-        offset += seedBytes;
-        Array.Copy(encodedPrivateKey, offset, k, 0, seedBytes);
-        offset += seedBytes;
-        Array.Copy(encodedPrivateKey, offset, tr, 0, seedBytes);
-        offset += seedBytes;
+        Array.Copy(encodedPrivateKey, offset, rho, 0, SeedBytes);
+        offset += SeedBytes;
+        Array.Copy(encodedPrivateKey, offset, k, 0, SeedBytes);
+        offset += SeedBytes;
+        Array.Copy(encodedPrivateKey, offset, tr, 0, TrBytes);
+        offset += TrBytes;
         Array.Copy(encodedPrivateKey, offset, s1, 0, s1Length);
         offset += s1Length;
         Array.Copy(encodedPrivateKey, offset, s2, 0, s2Length);
         offset += s2Length;
         Array.Copy(encodedPrivateKey, offset, t0, 0, t0Length);
         offset += t0Length;
-    
-        // Take all remaining bytes as t1
+
+        // handle t1 with the remaining bytes
         var remainingLength = encodedPrivateKey.Length - offset;
         var t1 = new byte[remainingLength];
         Array.Copy(encodedPrivateKey, offset, t1, 0, remainingLength);
diff --git a/src/Strathweb.Dilithium.IdentityModel/DilithiumSignatureProvider.cs b/src/Strathweb.Dilithium.IdentityModel/DilithiumSignatureProvider.cs
@@ -29,6 +29,18 @@ public override byte[] Sign(byte[] input)
     public override bool Verify(byte[] input, byte[] signature) => 
         _signer.VerifySignature(input, signature);
 
+    // todo: it would be good to avoid copying here
+    public override bool Verify(byte[] input, int inputOffset, int inputLength, byte[] signature, int signatureOffset, int signatureLength)
+    {
+        var actualInput = new byte[inputLength];
+        Array.Copy(input, inputOffset, actualInput, 0, inputLength);
+
+        var actualSignature = new byte[signatureLength];
+        Array.Copy(signature, signatureOffset, actualSignature, 0, signatureLength);
+
+        return _signer.VerifySignature(actualInput, actualSignature);
+    }
+
     protected override void Dispose(bool disposing)
     {
     }
diff --git a/src/Strathweb.Dilithium.IdentityModel/Strathweb.Dilithium.IdentityModel.csproj b/src/Strathweb.Dilithium.IdentityModel/Strathweb.Dilithium.IdentityModel.csproj
@@ -1,15 +1,15 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <TargetFramework>net7.0</TargetFramework>
+    <TargetFramework>net8.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
     <RootNamespace>Strathweb.Dilithium.IdentityModel</RootNamespace>
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="BouncyCastle.Cryptography" Version="2.2.1" />
-    <PackageReference Include="Microsoft.IdentityModel.Tokens" Version="6.32.1" />
+    <PackageReference Include="BouncyCastle.Cryptography" Version="2.4.0" />
+    <PackageReference Include="Microsoft.IdentityModel.Tokens" Version="7.0.0" />
   </ItemGroup>
 
 </Project>
diff --git a/src/Strathweb.Dilithium.Tests/Strathweb.Dilithium.Tests.csproj b/src/Strathweb.Dilithium.Tests/Strathweb.Dilithium.Tests.csproj
@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
     <PropertyGroup>
-        <TargetFramework>net7.0</TargetFramework>
+        <TargetFramework>net8.0</TargetFramework>
         <ImplicitUsings>enable</ImplicitUsings>
         <Nullable>enable</Nullable>
 
@@ -11,7 +11,7 @@
     </PropertyGroup>
 
     <ItemGroup>
-        <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.5.0" />
+        <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.10.0" />
         <PackageReference Include="xunit" Version="2.4.2" />
         <PackageReference Include="xunit.runner.visualstudio" Version="2.4.5">
             <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,7 @@`
`1`	`1`	`using System.IdentityModel.Tokens.Jwt;`
`2`	`2`	`using Microsoft.AspNetCore.Authentication.JwtBearer;`
`3`	`3`	`using Microsoft.Extensions.Caching.Memory;`
	`4`	`+using Microsoft.IdentityModel.JsonWebTokens;`
`4`	`5`	`using Microsoft.IdentityModel.Protocols;`
`5`	`6`	`using Microsoft.IdentityModel.Protocols.OpenIdConnect;`
`6`	`7`	`using Microsoft.IdentityModel.Tokens;`
`@@ -33,7 +34,7 @@ private static void ConfigureDilithiumTokenSupportInternal(JwtBearerOptions opti`
`33`	`34`	`var lweCryptoProvideFactory = new DilithiumCryptoProviderFactory();`
`34`	`35`	`options.TokenValidationParameters.IssuerSigningKeyResolver = (_, securityToken, kid, tokenValidationParameters) =>`
`35`	`36`	`{`
`36`		`- if (securityToken is not JwtSecurityToken _)`
	`37`	`+ if (securityToken is not JwtSecurityToken && securityToken is not JsonWebToken)`
`37`	`38`	`{`
`38`	`39`	`return Enumerable.Empty<SecurityKey>();`
`39`	`40`	`}`
`@@ -50,7 +51,7 @@ private static void ConfigureDilithiumTokenSupportInternal(JwtBearerOptions opti`
`50`	`51`	`}`
`51`	`52`
`52`	`53`	`var serverUrl = tokenValidationParameters.ValidIssuer ??`
`53`		`- tokenValidationParameters.ValidIssuers.FirstOrDefault() ?? options.Authority;`
	`54`	`+ tokenValidationParameters.ValidIssuers?.FirstOrDefault() ?? options.Authority;`
`54`	`55`
`55`	`56`	`if (serverUrl == null)`
`56`	`57`	`throw new Exception(`