Skip to content

Commit 2721519

Browse files
alan-nullalan-null
committed
Added cmdlets: Protect-Data, Unprotect-Data
1 parent 79f0462 commit 2721519

File tree

3 files changed

+189
-0
lines changed

3 files changed

+189
-0
lines changed

‎Crypto.AES/Public/Protect-Data.ps1‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
function Protect-Data {
2+
[CmdletBinding()]
3+
param (
4+
[Parameter(Mandatory = $true, Position = 0, ParameterSetName = "Key" )]
5+
[byte[]]$Key,
6+
[Parameter(Mandatory = $true, Position = 0, ParameterSetName = "GCM" )]
7+
[System.Security.Cryptography.AesGcm]$GCM,
8+
[Parameter(Mandatory = $true, Position = 1 )]
9+
[byte[]]$Data,
10+
[Parameter(Mandatory = $false, Position = 2 )]
11+
[byte[]]$Nonce,
12+
[Parameter(Mandatory = $false, Position = 3 )]
13+
[Switch]$Combined
14+
)
15+
16+
begin {
17+
Write-Verbose "Cmdlet Protect-Data - Begin"
18+
}
19+
20+
process {
21+
Write-Verbose "Cmdlet Protect-Data - Process"
22+
if (!$Nonce) {
23+
$Nonce = [byte[]]::new(12)
24+
}
25+
$cipherOutput = [byte[]]::new($Data.Length)
26+
$tag = [byte[]]::new(16)
27+
28+
if ($PSCmdlet.ParameterSetName -eq 'Key') {
29+
$gcm = [System.Security.Cryptography.AesGcm]::new($Key)
30+
}
31+
32+
$gcm.Encrypt($Nonce, $Data, $cipherOutput, $tag)
33+
34+
if ($Combined) {
35+
return $tag + $cipherOutput + $Nonce
36+
}
37+
@{
38+
CipherText = $cipherOutput
39+
Nonce = $Nonce
40+
Tag = $tag
41+
}
42+
}
43+
44+
end {
45+
Write-Verbose "Cmdlet Protect-Data - End"
46+
}
47+
}

‎Crypto.AES/Public/Unprotect-Data.ps1‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
function Unprotect-Data {
2+
[CmdletBinding()]
3+
param (
4+
[Parameter(Mandatory = $true, Position = 0, ParameterSetName = "Key" )]
5+
[byte[]]$Key,
6+
[Parameter(Mandatory = $true, Position = 0, ParameterSetName = "GCM" )]
7+
[System.Security.Cryptography.AesGcm]$GCM,
8+
[Parameter(Mandatory = $true, Position = 1 )]
9+
[byte[]]$Data,
10+
[Parameter(Mandatory = $true, Position = 2 )]
11+
[byte[]]$Nonce,
12+
[Parameter(Mandatory = $true, Position = 3 )]
13+
[byte[]]$Tag
14+
)
15+
16+
begin {
17+
Write-Verbose "Cmdlet Unprotect-Data - Begin"
18+
}
19+
20+
process {
21+
Write-Verbose "Cmdlet Unprotect-Data - Process"
22+
$decrypted = [byte[]]::new($Data.Length)
23+
24+
if ($PSCmdlet.ParameterSetName -eq 'Key') {
25+
$gcm = [System.Security.Cryptography.AesGcm]::new($Key)
26+
}
27+
$gcm.Decrypt($nonce, $Data, $Tag, $decrypted)
28+
$decrypted
29+
}
30+
31+
end {
32+
Write-Verbose "Cmdlet Unprotect-Data - End"
33+
}
34+
}

‎Tests/Crypto.AES.Tests.ps1‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,4 +27,112 @@ Describe 'Crypto.AES.Tests' {
2727
$v1 | Should -Not -Be $v2
2828
}
2929
}
30+
31+
Context "Protect-Data - Result" {
32+
$Key = [byte[]]::new(32)
33+
$nonce = [byte[]]::new(12)
34+
$data = $encoding.GetBytes("Test")
35+
36+
It "has correct size" {
37+
$r_key = Protect-Data -Key $Key -Data $data -Nonce $nonce
38+
39+
$r_key.CipherText.Length | Should -BeExactly $data.Length
40+
$r_key.Nonce.Length | Should -BeExactly $nonce.Length
41+
$r_key.Tag.Length | Should -BeExactly 16
42+
}
43+
44+
It "combined=false" {
45+
$r = Protect-Data -Key $Key -Data $data -Nonce $nonce
46+
47+
$r.CipherText | Should -Not -BeNullOrEmpty
48+
$r.Nonce | Should -Not -BeNullOrEmpty
49+
$r.Tag | Should -Not -BeNullOrEmpty
50+
$r | Should -BeOfType [hashtable]
51+
52+
}
53+
54+
It "combined=true" {
55+
$r = Protect-Data -Key $Key -Data $data -Nonce $nonce -Combined
56+
57+
$r.CipherText | Should -BeNullOrEmpty
58+
$r.Nonce | Should -BeNullOrEmpty
59+
$r.Tag | Should -BeNullOrEmpty
60+
$r -is [System.Object[]] | Should -BeTrue
61+
$r.Length | Should -BeExactly ($data.Length + $nonce.Length + 16)
62+
}
63+
}
64+
65+
Context "Protect-Data - signature" {
66+
$Key = [byte[]]::new(32)
67+
$nonce = [byte[]]::new(12)
68+
$data = $encoding.GetBytes("Test")
69+
70+
71+
It "optional nonce" {
72+
$r_explicit = Protect-Data -Key $Key -Data $data -Nonce $nonce
73+
$r_default = Protect-Data -Key $Key -Data $data -Nonce $null
74+
75+
$r_explicit.CipherText | Should -BeExactly $r_default.CipherText
76+
$r_explicit.Nonce | Should -BeExactly $r_default.Nonce
77+
$r_explicit.Tag | Should -BeExactly $r_default.Tag
78+
}
79+
80+
It "different parameter sets = same result" {
81+
$r_key = Protect-Data -Key $Key -Data $data -Nonce $nonce
82+
83+
$gcm = [System.Security.Cryptography.AesGcm]::new($Key)
84+
$r_gcm = Protect-Data $gcm -Data $data -Nonce $nonce
85+
86+
$r_key.CipherText | Should -BeExactly $r_gcm.CipherText
87+
$r_key.Nonce | Should -BeExactly $r_gcm.Nonce
88+
$r_key.Tag | Should -BeExactly $r_gcm.Tag
89+
}
90+
}
91+
92+
Context "Protect-Data - nonce" {
93+
$Key = [byte[]]::new(32)
94+
$nonce = [byte[]]::new(12)
95+
$data = $encoding.GetBytes("Test")
96+
97+
It "the same nonce" {
98+
$a = Protect-Data -Key $Key -Data $data -Nonce $nonce
99+
$b = Protect-Data -Key $Key -Data $data -Nonce $nonce
100+
101+
$a.CipherText | Should -BeExactly $b.CipherText
102+
$a.Tag | Should -BeExactly $b.Tag
103+
$a.Nonce | Should -BeExactly $b.Nonce
104+
}
105+
It "different nonce" {
106+
$a = Protect-Data -Key $Key -Data $data -Nonce $nonce
107+
$different = $nonce[0..11]
108+
$different[11]++
109+
110+
$b = Protect-Data -Key $Key -Data $data -Nonce $different
111+
112+
$a.CipherText | Should -not -BeExactly $b.CipherText
113+
$a.Tag | Should -not -BeExactly $b.Tag
114+
$a.Nonce | Should -not -BeExactly $b.Nonce
115+
}
116+
}
117+
118+
Context "Unprotect-Data" {
119+
$Key = [byte[]]::new(32)
120+
[byte[]]$nonce = @(228, 132, 78, 5, 31, 60, 78, 70, 192, 119, 50, 184)
121+
[byte[]]$tag = @(188, 136, 244, 158, 253, 2, 183, 117, 127, 2, 193, 66, 39, 37, 94, 188)
122+
$data = @(48, 22, 117, 218 )
123+
124+
It "has correct size" {
125+
$r_key = Unprotect-Data -Key $Key -Data $data -Nonce $nonce -Tag $tag
126+
$r_key.Length | Should -BeExactly $data.Length
127+
}
128+
129+
It "different parameter sets = same result" {
130+
$r_key = Unprotect-Data -Key $Key -Data $data -Nonce $nonce -Tag $tag
131+
132+
$gcm = [System.Security.Cryptography.AesGcm]::new($Key)
133+
$r_gcm = Unprotect-Data $gcm -Data $data -Nonce $nonce -Tag $tag
134+
135+
$r_key | Should -BeExactly $r_gcm
136+
}
137+
}
30138
}

0 commit comments

Comments
 (0)