History

GSF.Core: Added configuration option to allow manual enabling or disabling use of FIPS cryptographic modules. Defaults to `Auto` which reads FIPS setting from registry.

J. Ritchie Carroll committed 8 years ago

Commit 6db87f91 parent 9d5e4354 files · +58 −7Browse files

Unified · Split

4 files
  1. Source/Libraries/GSF.Core.Shared/EnabledState.cs +44 −0
  2. Source/Libraries/GSF.Core.Shared/GSF.Core.Shared.projitems +1 −0
  3. Source/Libraries/GSF.Core.Shared/Security/Cryptography/Cipher.cs +1 −1
  4. Source/Libraries/GSF.Core/Security/Cryptography/Cipher.cs +12 −6
Source/Libraries/GSF.Core.Shared/EnabledState.cs+44−0
@@ -0,0 +1,44 @@
1//******************************************************************************************************
2// EnabledState.cs - Gbtc
3//
4// Copyright © 2018, Grid Protection Alliance. All Rights Reserved.
5//
6// Licensed to the Grid Protection Alliance (GPA) under one or more contributor license agreements. See
7// the NOTICE file distributed with this work for additional information regarding copyright ownership.
8// The GPA licenses this file to you under the MIT License (MIT), the "License"; you may not use this
9// file except in compliance with the License. You may obtain a copy of the License at:
10//
11// http://opensource.org/licenses/MIT
12//
13// Unless agreed to in writing, the subject software distributed under the License is distributed on an
14// "AS-IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. Refer to the
15// License for the specific language governing permissions and limitations.
16//
17// Code Modification History:
18// ----------------------------------------------------------------------------------------------------
19// 08/29/2018 - J. Ritchie Carroll
20// Generated original version of source code.
21//
22//******************************************************************************************************
23
24namespace GSF
25{
26 /// <summary>
27 /// Enumeration that represents a state of either "automatic", "on" or "off".
28 /// </summary>
29 public enum EnabledState
30 {
31 /// <summary>
32 /// Represents the automatic, i.e., default, state.
33 /// </summary>
34 Auto = -1,
35 /// <summary>
36 /// Represents the on, i.e., enabled, state.
37 /// </summary>
38 On = 1,
39 /// <summary>
40 /// Represents the off, i.e., disabled, state.
41 /// </summary>
42 Off = 0
43 }
44}
Source/Libraries/GSF.Core.Shared/GSF.Core.Shared.projitems+1−0
@@ -10,6 +10,7 @@ · 9 unmodified lines
10 </PropertyGroup>10 </PropertyGroup>
11 <ItemGroup>11 <ItemGroup>
12 <Compile Include="$(MSBuildThisFileDirectory)ArrayExtensions.cs" />12 <Compile Include="$(MSBuildThisFileDirectory)ArrayExtensions.cs" />
13 <Compile Include="$(MSBuildThisFileDirectory)EnabledState.cs" />
13 <Compile Include="$(MSBuildThisFileDirectory)RadixCodec.cs" />14 <Compile Include="$(MSBuildThisFileDirectory)RadixCodec.cs" />
14 <Compile Include="$(MSBuildThisFileDirectory)BigEndian.cs" />15 <Compile Include="$(MSBuildThisFileDirectory)BigEndian.cs" />
15 <Compile Include="$(MSBuildThisFileDirectory)BitMath.cs" />16 <Compile Include="$(MSBuildThisFileDirectory)BitMath.cs" />
Source/Libraries/GSF.Core.Shared/Security/Cryptography/Cipher.cs+1−1
@@ -35,7 +35,7 @@ namespace GSF.Security.Cryptography · 34 unmodified lines
35 public static partial class Cipher35 public static partial class Cipher
36 {36 {
37 // Switch to turn off managed encryption and use wrappers over FIPS-compliant algorithms.37 // Switch to turn off managed encryption and use wrappers over FIPS-compliant algorithms.
38 private static readonly bool s_managedEncryption;38 private static bool s_managedEncryption;
39 39
40 /// <summary>40 /// <summary>
41 /// Gets a flag that determines if system will allow use of managed, i.e., non-FIPS compliant, security algorithms.41 /// Gets a flag that determines if system will allow use of managed, i.e., non-FIPS compliant, security algorithms.
Source/Libraries/GSF.Core/Security/Cryptography/Cipher.cs+12−6
@@ -438,6 +438,7 @@ namespace GSF.Security.Cryptography · 437 unmodified lines
438 s_textEncoding = Encoding.Unicode;438 s_textEncoding = Encoding.Unicode;
439#endif439#endif
440 KeyIVCache localKeyIVCache;440 KeyIVCache localKeyIVCache;
441 EnabledState useFIPSModules = EnabledState.Auto;
441 string localCacheFileName = DefaultCacheFileName;442 string localCacheFileName = DefaultCacheFileName;
442 double retryDelayInterval = DefaultRetryDelayInterval;443 double retryDelayInterval = DefaultRetryDelayInterval;
443 int maximumRetryAttempts = DefaultMaximumRetryAttempts;444 int maximumRetryAttempts = DefaultMaximumRetryAttempts;
@@ -446,14 +447,19 @@ namespace GSF.Security.Cryptography · 2 unmodified lines
446 ConfigurationFile config = ConfigurationFile.Current;447 ConfigurationFile config = ConfigurationFile.Current;
447 CategorizedSettingsElementCollection settings = config.Settings[CryptoServicesSettingsCategory];448 CategorizedSettingsElementCollection settings = config.Settings[CryptoServicesSettingsCategory];
448 449
450 settings.Add("UseFIPSModules", useFIPSModules, "Determines if security functions should use FIPS cryptographic modules. Value is one of \"Auto\", \"On\" or \"Off\". Defaults to \"Auto\" which reads FIPS setting from registry.");
449 settings.Add("CryptoCache", localCacheFileName, "Path and file name of cryptographic key and initialization vector cache.");451 settings.Add("CryptoCache", localCacheFileName, "Path and file name of cryptographic key and initialization vector cache.");
450 settings.Add("CacheRetryDelayInterval", retryDelayInterval, "Wait interval, in milliseconds, before retrying load of cryptographic key and initialization vector cache.");452 settings.Add("CacheRetryDelayInterval", retryDelayInterval, "Wait interval, in milliseconds, before retrying load of cryptographic key and initialization vector cache.");
451 settings.Add("CacheMaximumRetryAttempts", maximumRetryAttempts, "Maximum retry attempts allowed for loading cryptographic key and initialization vector cache.");453 settings.Add("CacheMaximumRetryAttempts", maximumRetryAttempts, "Maximum retry attempts allowed for loading cryptographic key and initialization vector cache.");
452 454
455 useFIPSModules = settings["UseFIPSModules"].ValueAs(useFIPSModules);
453 localCacheFileName = FilePath.GetAbsolutePath(settings["CryptoCache"].ValueAs(localCacheFileName));456 localCacheFileName = FilePath.GetAbsolutePath(settings["CryptoCache"].ValueAs(localCacheFileName));
454 retryDelayInterval = settings["CacheRetryDelayInterval"].ValueAs(retryDelayInterval);457 retryDelayInterval = settings["CacheRetryDelayInterval"].ValueAs(retryDelayInterval);
455 maximumRetryAttempts = settings["CacheMaximumRetryAttempts"].ValueAs(maximumRetryAttempts);458 maximumRetryAttempts = settings["CacheMaximumRetryAttempts"].ValueAs(maximumRetryAttempts);
456 459
460 if (useFIPSModules != EnabledState.Auto)
461 s_managedEncryption = useFIPSModules == EnabledState.Off; // FIPS Off means use managed encryption
462
457 s_keyIVCache = new Lazy<KeyIVCache>(() =>463 s_keyIVCache = new Lazy<KeyIVCache>(() =>
458 {464 {
459 KeyIVCache globalKeyIVCache;465 KeyIVCache globalKeyIVCache;
@@ -468,9 +474,9 @@ namespace GSF.Security.Cryptography · 8 unmodified lines
468#if DNF45 && !MONO474#if DNF45 && !MONO
469 ReloadOnChange = true,475 ReloadOnChange = true,
470#else476#else
471 // Reload on change is disabled to eliminate GC handle leaks on .NET 4.0, this prevents477 // Reload on change is disabled to eliminate GC handle leaks on .NET 4.0, this prevents
472 // automatic runtime reloading of key/iv data cached by another application.478 // automatic runtime reloading of key/iv data cached by another application.
473 ReloadOnChange = false,479 ReloadOnChange = false,
474#endif480#endif
475 AutoSave = false481 AutoSave = false
476 };482 };
@@ -518,9 +524,9 @@ namespace GSF.Security.Cryptography · 41 unmodified lines
518#if DNF45 && !MONO524#if DNF45 && !MONO
519 ReloadOnChange = true,525 ReloadOnChange = true,
520#else526#else
521 // Reload on change is disabled to eliminate GC handle leaks on .NET 4.0, this prevents527 // Reload on change is disabled to eliminate GC handle leaks on .NET 4.0, this prevents
522 // automatic runtime reloading of key/iv data cached by another application.528 // automatic runtime reloading of key/iv data cached by another application.
523 ReloadOnChange = false,529 ReloadOnChange = false,
524#endif530#endif
525 AutoSave = true531 AutoSave = true
526 };532 };

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t