tenduke::crypto::AbstractCiphers Class Reference

#include <AbstractCiphers.h>

Detailed Description

Base class for cipher implementations using AES-256-GCM with PBKDF2 key derivation.

Implements VERSION_1 blob encryption and decryption using injected random and key-generator services. Subclasses supply the concrete service implementations via the constructor.

Output format (VERSION_1): [magic (4 bytes)] [version (2 bytes)] [nonce/salt (12 bytes)] [ciphertext] [tag (16 bytes)]

Inheritance diagram for tenduke::crypto::AbstractCiphers:

Public Member Functions
	AbstractCiphers (const std::shared_ptr<::tenduke::utl::random::RandomBytes > &random, const std::shared_ptr<::tenduke::crypto::PBKDF2 > &keyGenerator)
std::unique_ptr<::tenduke::utl::BinaryData >	decrypt (const ::tenduke::utl::DataSpan &ciphertext, const ::tenduke::utl::DataSpan &encryptionKey) const override
	Decrypts given data using the system default cipher (AES256 GCM).
std::string	decryptString (const ::tenduke::utl::DataSpan &ciphertext, const ::tenduke::utl::DataSpan &encryptionKey) const override
	Decrypts given data using the system default cipher (AES256 GCM) to a string.
std::unique_ptr<::tenduke::utl::BinaryData >	encrypt (const ::tenduke::utl::DataSpan &plaintext, const ::tenduke::utl::DataSpan &encryptionKey) const override
	Encrypts given data using the system default cipher (AES256 GCM).
std::unique_ptr<::tenduke::utl::BinaryData >	encrypt (const std::string &plaintext, const ::tenduke::utl::DataSpan &encryptionKey) const override
	Encrypts given data using the system default cipher (AES256 GCM).
std::string	decryptString (const ::tenduke::crypto::Cipher &cipher, const ::tenduke::utl::DataSpan &ciphertext) const override
	Decrypts given data using the given cipher to a string.
void	encrypt (const ::tenduke::crypto::Cipher &cipher, const ::tenduke::utl::DataSpan &plaintext, ::tenduke::utl::DataSink &ciphertext) const override
	Encrypts data with the given cipher.

Protected Member Functions
virtual std::unique_ptr<::tenduke::utl::BinaryData >	encryptBytes (const unsigned char *plaintext, std::size_t plaintextLength, const unsigned char *encryptionKey, std::size_t encryptionKeyLength) const
virtual std::unique_ptr<::tenduke::utl::BinaryData >	decryptBytes (const unsigned char *ciphertext, std::size_t ciphertextLength, const unsigned char *encryptionKey, std::size_t encryptionKeyLength) const
virtual void	writeHeader (unsigned char *buffer, const std::uint16_t version) const
virtual void	writeHeader (::tenduke::utl::DataSink &output, const std::uint16_t version) const
virtual std::uint16_t	readAndValidateHeader (const unsigned char *buffer, std::size_t bufferLength) const
virtual std::uint16_t	readAndValidateHeader (const ::tenduke::utl::DataSpan &buffer) const

Static Protected Attributes
static constexpr std::uint32_t	BLOB_MAGIC = 0x44554B45
	Magic value for encrypted blob header.
static constexpr std::size_t	BLOB_HEADER_SIZE = 6
	Header size: magic (4 bytes) + version (2 bytes).
static constexpr std::uint16_t	VERSION_1 = 0x0001
static constexpr std::uint16_t	VERSION_2 = 0x0002
static constexpr int	PBKDF2_ITERATIONS = 100000
	Number of PBKDF2 iterations for VERSION_1 key derivation.

Member Function Documentation

decrypt()

std::unique_ptr<::tenduke::utl::BinaryData > tenduke::crypto::AbstractCiphers::decrypt ( const ::tenduke::utl::DataSpan & ciphertext, const ::tenduke::utl::DataSpan & encryptionKey ) const

inlineoverridevirtual

Decrypts given data using the system default cipher (AES256 GCM).

This method expects the input to consist of magic (4 bytes) + version (2 bytes) + IV (12 bytes) + ciphertext + tag (16 bytes), i.e., the output produced by calling ::encrypt(key, plaintext).

This is "syntactic sugar": The method also performs key-derivation for the provided key to simplify the use.

Parameters

ciphertext	the cipher text (the data to decrypt), the maximum supported length is INT_MAX.
encryptionKey	encryption key

Returns

plain text (decrypted data)

Implements tenduke::crypto::Ciphers.

decryptString() [1/2]

std::string tenduke::crypto::AbstractCiphers::decryptString ( const ::tenduke::crypto::Cipher & cipher, const ::tenduke::utl::DataSpan & ciphertext ) const

inlineoverridevirtual

Decrypts given data using the given cipher to a string.

This method expects the input to consist of magic (4 bytes) + version (2 bytes) + encrypted content (which is specific to the cipher), i.e., the output produced by calling ::encrypt(cipher, plaintext, ciphertext).

Parameters

cipher	The initialized cipher used to decrypt the data. Must match with the cipher used to encrypt
ciphertext	the cipher text (the data to decrypt), the maximum supported length is INT_MAX.

Returns

plain text (decrypted data) as std::string. Good for decrypting a string but also works for binary data

Implements tenduke::crypto::Ciphers.

decryptString() [2/2]

std::string tenduke::crypto::AbstractCiphers::decryptString ( const ::tenduke::utl::DataSpan & ciphertext, const ::tenduke::utl::DataSpan & encryptionKey ) const

inlineoverridevirtual

Decrypts given data using the system default cipher (AES256 GCM) to a string.

This method expects the input to consist of magic (4 bytes) + version (2 bytes) + IV (12 bytes) + ciphertext + tag (16 bytes), i.e., the output produced by calling ::encrypt(key, plaintext).

This is "syntactic sugar": The method also performs key-derivation for the provided key to simplify the use.

Parameters

ciphertext	the cipher text (the data to decrypt), the maximum supported length is INT_MAX.
encryptionKey	encryption key

Returns

plain text (decrypted data) as std::string. Good for decrypting a string but also works for binary data

Implements tenduke::crypto::Ciphers.

encrypt() [1/3]

void tenduke::crypto::AbstractCiphers::encrypt ( const ::tenduke::crypto::Cipher & cipher, const ::tenduke::utl::DataSpan & plaintext, ::tenduke::utl::DataSink & ciphertext ) const

inlineoverridevirtual

Encrypts data with the given cipher.

The output consists of:

• magic (4 bytes)
• version (2 bytes)
• then encrypted content, which depends on the cipher. Typically, it would be nonce (IV) + ciphertext + message authentication code (tag).

Implements tenduke::crypto::Ciphers.

encrypt() [2/3]

std::unique_ptr<::tenduke::utl::BinaryData > tenduke::crypto::AbstractCiphers::encrypt ( const ::tenduke::utl::DataSpan & plaintext, const ::tenduke::utl::DataSpan & encryptionKey ) const

inlineoverridevirtual

Encrypts given data using the system default cipher (AES256 GCM).

The output consists of magic (4 bytes) + version (2 bytes) + IV (12 bytes) + ciphertext + tag (16 bytes).

This is "syntactic sugar": The method also performs key-derivation for the provided key to simplify the use. The method also generates a random IV.

Parameters

plaintext	the plain text (the data to encrypt), the maximum supported length is INT_MAX.
encryptionKey	encryption key

Returns

cipher text (encrypted data)

Implements tenduke::crypto::Ciphers.

encrypt() [3/3]

std::unique_ptr<::tenduke::utl::BinaryData > tenduke::crypto::AbstractCiphers::encrypt ( const std::string & plaintext, const ::tenduke::utl::DataSpan & encryptionKey ) const

inlineoverridevirtual

Encrypts given data using the system default cipher (AES256 GCM).

The output consists of magic (4 bytes) + version (2 bytes) + IV (12 bytes) + ciphertext + tag (16 bytes).

This is "syntactic sugar": The method also performs key-derivation for the provided key to simplify the use. The method also generates a random IV.

Parameters

plaintext	the plain text, the maximum supported length is INT_MAX.
encryptionKey	encryption key

Returns

cipher text (encrypted data)

Implements tenduke::crypto::Ciphers.

---

The documentation for this class was generated from the following file:

• core/core/src/crypto/AbstractCiphers.h