GSF.Core: Added configuration option to allow manual enabling or disabling use of FIPS cryptographic modules. Defaults to `Auto` which reads FIPS setting from registry.

J. Ritchie Carroll committed 8 years ago

Commit 6db87f91 parent 9d5e4354 files · +58 −7Browse files

Unified · Split

4 files

Source/Libraries/GSF.Core.Shared/EnabledState.cs +44 −0
Source/Libraries/GSF.Core.Shared/GSF.Core.Shared.projitems +1 −0
Source/Libraries/GSF.Core.Shared/Security/Cryptography/Cipher.cs +1 −1
Source/Libraries/GSF.Core/Security/Cryptography/Cipher.cs +12 −6

Source/Libraries/GSF.Core.Shared/EnabledState.cs+44−0

@@ -0,0 +1,44 @@
	1	+//******************************************************************************************************
	2	+// EnabledState.cs - Gbtc
	3	+//
	4	+// Copyright © 2018, Grid Protection Alliance. All Rights Reserved.
	5	+//
	6	+// Licensed to the Grid Protection Alliance (GPA) under one or more contributor license agreements. See
	7	+// the NOTICE file distributed with this work for additional information regarding copyright ownership.
	8	+// The GPA licenses this file to you under the MIT License (MIT), the "License"; you may not use this
	9	+// file except in compliance with the License. You may obtain a copy of the License at:
	10	+//
	11	+// http://opensource.org/licenses/MIT
	12	+//
	13	+// Unless agreed to in writing, the subject software distributed under the License is distributed on an
	14	+// "AS-IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. Refer to the
	15	+// License for the specific language governing permissions and limitations.
	16	+//
	17	+// Code Modification History:
	18	+// ----------------------------------------------------------------------------------------------------
	19	+// 08/29/2018 - J. Ritchie Carroll
	20	+// Generated original version of source code.
	21	+//
	22	+//******************************************************************************************************
	23	+
	24	+namespace GSF
	25	+{
	26	+ /// <summary>
	27	+ /// Enumeration that represents a state of either "automatic", "on" or "off".
	28	+ /// </summary>
	29	+ public enum EnabledState
	30	+ {
	31	+ /// <summary>
	32	+ /// Represents the automatic, i.e., default, state.
	33	+ /// </summary>
	34	+ Auto = -1,
	35	+ /// <summary>
	36	+ /// Represents the on, i.e., enabled, state.
	37	+ /// </summary>
	38	+ On = 1,
	39	+ /// <summary>
	40	+ /// Represents the off, i.e., disabled, state.
	41	+ /// </summary>
	42	+ Off = 0
	43	+ }
	44	+}

Source/Libraries/GSF.Core.Shared/GSF.Core.Shared.projitems+1−0

@@ -10,6 +10,7 @@ · 9 unmodified lines
10	10	</PropertyGroup>
11	11	<ItemGroup>
12	12	<Compile Include="$(MSBuildThisFileDirectory)ArrayExtensions.cs" />
	13	+ <Compile Include="$(MSBuildThisFileDirectory)EnabledState.cs" />
13	14	<Compile Include="$(MSBuildThisFileDirectory)RadixCodec.cs" />
14	15	<Compile Include="$(MSBuildThisFileDirectory)BigEndian.cs" />
15	16	<Compile Include="$(MSBuildThisFileDirectory)BitMath.cs" />

Source/Libraries/GSF.Core.Shared/Security/Cryptography/Cipher.cs+1−1

@@ -35,7 +35,7 @@ namespace GSF.Security.Cryptography · 34 unmodified lines
35	35	public static partial class Cipher
36	36	{
37	37	// Switch to turn off managed encryption and use wrappers over FIPS-compliant algorithms.
38		− private static readonly bool s_managedEncryption;
	38	+ private static bool s_managedEncryption;
39	39
40	40	/// <summary>
41	41	/// Gets a flag that determines if system will allow use of managed, i.e., non-FIPS compliant, security algorithms.

Source/Libraries/GSF.Core/Security/Cryptography/Cipher.cs+12−6

@@ -438,6 +438,7 @@ namespace GSF.Security.Cryptography · 437 unmodified lines
438	438	s_textEncoding = Encoding.Unicode;
439	439	#endif
440	440	KeyIVCache localKeyIVCache;
	441	+ EnabledState useFIPSModules = EnabledState.Auto;
441	442	string localCacheFileName = DefaultCacheFileName;
442	443	double retryDelayInterval = DefaultRetryDelayInterval;
443	444	int maximumRetryAttempts = DefaultMaximumRetryAttempts;
@@ -446,14 +447,19 @@ namespace GSF.Security.Cryptography · 2 unmodified lines
446	447	ConfigurationFile config = ConfigurationFile.Current;
447	448	CategorizedSettingsElementCollection settings = config.Settings[CryptoServicesSettingsCategory];
448	449
	450	+ settings.Add("UseFIPSModules", useFIPSModules, "Determines if security functions should use FIPS cryptographic modules. Value is one of \"Auto\", \"On\" or \"Off\". Defaults to \"Auto\" which reads FIPS setting from registry.");
449	451	settings.Add("CryptoCache", localCacheFileName, "Path and file name of cryptographic key and initialization vector cache.");
450	452	settings.Add("CacheRetryDelayInterval", retryDelayInterval, "Wait interval, in milliseconds, before retrying load of cryptographic key and initialization vector cache.");
451	453	settings.Add("CacheMaximumRetryAttempts", maximumRetryAttempts, "Maximum retry attempts allowed for loading cryptographic key and initialization vector cache.");
452	454
	455	+ useFIPSModules = settings["UseFIPSModules"].ValueAs(useFIPSModules);
453	456	localCacheFileName = FilePath.GetAbsolutePath(settings["CryptoCache"].ValueAs(localCacheFileName));
454	457	retryDelayInterval = settings["CacheRetryDelayInterval"].ValueAs(retryDelayInterval);
455	458	maximumRetryAttempts = settings["CacheMaximumRetryAttempts"].ValueAs(maximumRetryAttempts);
456	459
	460	+ if (useFIPSModules != EnabledState.Auto)
	461	+ s_managedEncryption = useFIPSModules == EnabledState.Off; // FIPS Off means use managed encryption
	462	+
457	463	s_keyIVCache = new Lazy<KeyIVCache>(() =>
458	464	{
459	465	KeyIVCache globalKeyIVCache;
@@ -468,9 +474,9 @@ namespace GSF.Security.Cryptography · 8 unmodified lines
468	474	#if DNF45 && !MONO
469	475	ReloadOnChange = true,
470	476	#else
471		− // Reload on change is disabled to eliminate GC handle leaks on .NET 4.0, this prevents
472		− // automatic runtime reloading of key/iv data cached by another application.
473		− ReloadOnChange = false,
	477	+ // Reload on change is disabled to eliminate GC handle leaks on .NET 4.0, this prevents
	478	+ // automatic runtime reloading of key/iv data cached by another application.
	479	+ ReloadOnChange = false,
474	480	#endif
475	481	AutoSave = false
476	482	};
@@ -518,9 +524,9 @@ namespace GSF.Security.Cryptography · 41 unmodified lines
518	524	#if DNF45 && !MONO
519	525	ReloadOnChange = true,
520	526	#else
521		− // Reload on change is disabled to eliminate GC handle leaks on .NET 4.0, this prevents
522		− // automatic runtime reloading of key/iv data cached by another application.
523		− ReloadOnChange = false,
	527	+ // Reload on change is disabled to eliminate GC handle leaks on .NET 4.0, this prevents
	528	+ // automatic runtime reloading of key/iv data cached by another application.
	529	+ ReloadOnChange = false,
524	530	#endif
525	531	AutoSave = true
526	532	};

GSF.Core: Added configuration option to allow manual enabling or disabling use of FIPS cryptographic modules. Defaults to `Auto` which reads FIPS setting from registry.

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code