Skip to content

Client Encryption: Adds api FetchDataEncryptionKeyWithoutRawKeyAsync and FetchDataEncryptionKeyAsync to get DEK without and with raw key respectively. #3809

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
14 commits merged into from
May 3, 2023
Merged

Client Encryption: Adds api FetchDataEncryptionKeyWithoutRawKeyAsync and FetchDataEncryptionKeyAsync to get DEK without and with raw key respectively. #3809

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
5051044
added raw key to MdeEncryption
vipulvishal-ms Apr 10, 2023
cf0aed0
adding ray key to Mde Algo
vipulvishal-ms Apr 17, 2023
f93878e
test case changes
vipulvishal-ms Apr 17, 2023
dd9ee73
resolving code review comments
vipulvishal-ms Apr 18, 2023
062ecf1
code optimization to reduce keyvault calls
vipulvishal-ms Apr 20, 2023
069317b
Merge branch 'master' of https://github.com/Azure/azure-cosmos-dotnet…
vipulvishal-ms Apr 20, 2023
c06d251
removed Microsoft.Data.Encryption.Cryptography nuget package
vipulvishal-ms Apr 23, 2023
01272d3
added api for dek with raw key
vipulvishal-ms Apr 24, 2023
a30e44d
resolved code review comments
vipulvishal-ms Apr 25, 2023
554d6fd
adding change log
vipulvishal-ms Apr 27, 2023
28bf052
Merge branch 'master' of https://github.com/Azure/azure-cosmos-dotnet…
vipulvishal-ms Apr 27, 2023
8dd900f
code review changes
vipulvishal-ms Apr 27, 2023
b09644b
Merge branch 'master' into users/vipulvishal/MdeRawKey
vipulvishal-ms May 2, 2023
c051004
Merge branch 'master' into users/vipulvishal/MdeRawKey
vipulvishal-ms May 3, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 27 additions & 2 deletions Microsoft.Azure.Cosmos.Encryption.Custom/src/DataEncryptionKeyContainerCore.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -335,6 +335,7 @@ internal async Task<DataEncryptionKey> FetchUnWrappedMdeSupportedLegacyDekAsync(
unwrapResult.DataEncryptionKey);

return new MdeEncryptionAlgorithm(
unwrapResult.DataEncryptionKey,
plaintextDataEncryptionKey,
Data.Encryption.Cryptography.EncryptionType.Randomized);
}
Expand Down Expand Up @@ -384,7 +385,30 @@ internal async Task<InMemoryRawDek> FetchUnwrappedAsync(
{
if (string.Equals(dekProperties.EncryptionAlgorithm, CosmosEncryptionAlgorithm.MdeAeadAes256CbcHmac256Randomized))
{
DataEncryptionKey dek = this.InitMdeEncryptionAlgorithm(dekProperties);

if (this.DekProvider.MdeKeyWrapProvider == null)
{
throw new InvalidOperationException($"For use of '{CosmosEncryptionAlgorithm.MdeAeadAes256CbcHmac256Randomized}' algorithm based DEK, " +
"Encryptor or CosmosDataMdeKeyWrapProvider needs to be initialized with MdeKeyWrapProvider.");
}

EncryptionKeyUnwrapResult unwrapResult;
try
{
// unwrap with original wrap provider
unwrapResult = await this.DekProvider.MdeKeyWrapProvider.UnwrapKeyAsync(
dekProperties.WrappedDataEncryptionKey,
dekProperties.EncryptionKeyWrapMetadata,
cancellationToken);
}
catch (Exception exception)
{
throw EncryptionExceptionFactory.EncryptionKeyNotFoundException(
$"Failed to unwrap Data Encryption Key with id: '{dekProperties.Id}'.",
exception);
}

DataEncryptionKey dek = this.InitMdeEncryptionAlgorithm(unwrapResult.DataEncryptionKey, dekProperties);

// TTL is not used since DEK is not cached.
return new InMemoryRawDek(dek, TimeSpan.FromMilliseconds(0));
Expand Down Expand Up @@ -564,7 +588,7 @@ private async Task<EncryptionKeyUnwrapResult> UnWrapDekMdeEncAlgoAsync(
return unwrapResult;
}

internal DataEncryptionKey InitMdeEncryptionAlgorithm(DataEncryptionKeyProperties dekProperties)
internal DataEncryptionKey InitMdeEncryptionAlgorithm(byte[] unwrapKey, DataEncryptionKeyProperties dekProperties)
{
if (this.DekProvider.MdeKeyWrapProvider == null)
{
Expand All @@ -573,6 +597,7 @@ internal DataEncryptionKey InitMdeEncryptionAlgorithm(DataEncryptionKeyPropertie
}

return new MdeEncryptionAlgorithm(
unwrapKey,
dekProperties,
Data.Encryption.Cryptography.EncryptionType.Randomized,
this.DekProvider.MdeKeyWrapProvider.EncryptionKeyStoreProvider,
Expand Down
9 changes: 7 additions & 2 deletions Microsoft.Azure.Cosmos.Encryption.Custom/src/MdeServices/MdeEncryptionAlgorithm.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,10 @@ internal sealed class MdeEncryptionAlgorithm : DataEncryptionKey
{
private readonly AeadAes256CbcHmac256EncryptionAlgorithm mdeAeadAes256CbcHmac256EncryptionAlgorithm;

private readonly byte[] unwrapKey;

// unused for MDE Algorithm.
public override byte[] RawKey => null;
public override byte[] RawKey { get; }

public override string EncryptionAlgorithm => CosmosEncryptionAlgorithm.MdeAeadAes256CbcHmac256Randomized;

Expand All @@ -29,6 +31,7 @@ internal sealed class MdeEncryptionAlgorithm : DataEncryptionKey
/// <param name="encryptionType"> Encryption type </param>
/// <param name="encryptionKeyStoreProvider"> EncryptionKeyStoreProvider for wrapping and unwrapping </param>
public MdeEncryptionAlgorithm(
byte[] unwrapKey,
DataEncryptionKeyProperties dekProperties,
Data.Encryption.Cryptography.EncryptionType encryptionType,
EncryptionKeyStoreProvider encryptionKeyStoreProvider,
Expand Down Expand Up @@ -75,7 +78,7 @@ public MdeEncryptionAlgorithm(
keyEncryptionKey,
dekProperties.WrappedDataEncryptionKey);
}

this.RawKey = unwrapKey;
this.mdeAeadAes256CbcHmac256EncryptionAlgorithm = AeadAes256CbcHmac256EncryptionAlgorithm.GetOrCreate(
protectedDataEncryptionKey,
encryptionType);
Expand All @@ -90,9 +93,11 @@ public MdeEncryptionAlgorithm(
/// <param name="dataEncryptionKey"> Data Encryption Key </param>
/// <param name="encryptionType"> Encryption type </param>
public MdeEncryptionAlgorithm(
byte[] unwrapKey,
Data.Encryption.Cryptography.DataEncryptionKey dataEncryptionKey,
Data.Encryption.Cryptography.EncryptionType encryptionType)
{
this.RawKey = unwrapKey;
this.mdeAeadAes256CbcHmac256EncryptionAlgorithm = AeadAes256CbcHmac256EncryptionAlgorithm.GetOrCreate(
dataEncryptionKey,
encryptionType);
Expand Down
6 changes: 3 additions & 3 deletions Microsoft.Azure.Cosmos.Encryption.Custom/tests/EmulatorTests/MdeCustomEncryptionTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -315,7 +315,7 @@ public async Task ValidateCachingOfProtectedDataEncryptionKey()
await MdeCustomEncryptionTests.CreateItemAsync(encryptionContainer, dekId, TestDoc.PathsToEncrypt);

testEncryptionKeyStoreProvider.UnWrapKeyCallsCount.TryGetValue(masterKeyUri1.ToString(), out int unwrapcount);
Assert.AreEqual(1, unwrapcount);
Assert.AreEqual(33, unwrapcount);

testEncryptionKeyStoreProvider = new TestEncryptionKeyStoreProvider
{
Expand All @@ -332,7 +332,7 @@ public async Task ValidateCachingOfProtectedDataEncryptionKey()
await MdeCustomEncryptionTests.CreateItemAsync(encryptionContainer, dekId, TestDoc.PathsToEncrypt);

testEncryptionKeyStoreProvider.UnWrapKeyCallsCount.TryGetValue(masterKeyUri1.ToString(), out unwrapcount);
Assert.AreEqual(32, unwrapcount);
Assert.AreEqual(64, unwrapcount);

// 2 hours default
testEncryptionKeyStoreProvider = new TestEncryptionKeyStoreProvider();
Expand All @@ -346,7 +346,7 @@ public async Task ValidateCachingOfProtectedDataEncryptionKey()
await MdeCustomEncryptionTests.CreateItemAsync(encryptionContainer, dekId, TestDoc.PathsToEncrypt);

testEncryptionKeyStoreProvider.UnWrapKeyCallsCount.TryGetValue(masterKeyUri1.ToString(), out unwrapcount);
Assert.AreEqual(1, unwrapcount);
Assert.AreEqual(33, unwrapcount);
}

[TestMethod]
Expand Down