Encrypted content
Change-Id: Iabe169a07abd2237a3573b51efc0ad6ae31c85e2
diff --git a/docs/spec.rst b/docs/spec.rst
index b1733e4..30e398d 100644
--- a/docs/spec.rst
+++ b/docs/spec.rst
@@ -2,3 +2,43 @@
=================
TBD
+
+Terminology
+-----------
+
++-----------------+------------------------------------------------------------------------------------------+
+| Term | Description |
++=================+==========================================================================================+
+| KEK | Key Encryption Key (RSA public key) |
++-----------------+------------------------------------------------------------------------------------------+
+| KDK | Key Decryption Key (RSA private key) |
++-----------------+------------------------------------------------------------------------------------------+
+| CK | Content Key (AES symmetric key) |
++-----------------+------------------------------------------------------------------------------------------+
+| CK data | Data packet carrying a KDK-encrypted CK as payoad |
++-----------------+------------------------------------------------------------------------------------------+
+| Access Manager | (Data Owner) Entity that control access to the data associated with the namespace |
++-----------------+------------------------------------------------------------------------------------------+
+| Encryptor | (Producer) Entity that encrypts data based on namespace association |
++-----------------+------------------------------------------------------------------------------------------+
+| Decryptor | (Consumer) Entity that decrypts data based on namespace association |
++-----------------+------------------------------------------------------------------------------------------+
+
+EncryptedContent
+-----------------
+
+The ``EncryptedContent`` element contains encrypted blob, optional Initial Vector (for AES CBC encryption),
+optional EncryptedPayloadKey, and Name elements.
+
+::
+
+ EncryptedContent ::= ENCRYPTED-CONTENT-TYPE TLV-LENGTH
+ EncryptedPayload
+ InitialVector
+ EncryptedPayloadKey
+ Name
+
+ InitialVector ::= INITIAL-VECTOR-TYPE TLV-LENGTH(=N) BYTE{N}
+ EncryptedPayload ::= ENCRYPTED-PAYLOAD-TYPE TLV-LENGTH(=N) BYTE{N}
+ EncryptedPayloadKey ::= ENCRYPTED-PAYLOAD-KEY-TYPE TLV-LENGTH(=N) BYTE{N}
+ InitialVector ::= INITIAL-VECTOR-TYPE TLV-LENGTH(=N) BYTE{N}
diff --git a/src/encrypted-content.cpp b/src/encrypted-content.cpp
new file mode 100644
index 0000000..a2ca2a4
--- /dev/null
+++ b/src/encrypted-content.cpp
@@ -0,0 +1,230 @@
+/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
+/**
+ * Copyright (c) 2014-2018, Regents of the University of California
+ *
+ * NAC library is free software: you can redistribute it and/or modify it under the
+ * terms of the GNU Lesser General Public License as published by the Free Software
+ * Foundation, either version 3 of the License, or (at your option) any later version.
+ *
+ * NAC library is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+ * PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
+ *
+ * You should have received copies of the GNU General Public License and GNU Lesser
+ * General Public License along with ndn-cxx, e.g., in COPYING.md file. If not, see
+ * <http://www.gnu.org/licenses/>.
+ *
+ * See AUTHORS.md for complete list of NAC library authors and contributors.
+ */
+
+#include "encrypted-content.hpp"
+
+#include <ndn-cxx/encoding/block-helpers.hpp>
+#include <ndn-cxx/util/concepts.hpp>
+
+namespace ndn {
+namespace nac {
+
+BOOST_CONCEPT_ASSERT((boost::EqualityComparable<EncryptedContent>));
+BOOST_CONCEPT_ASSERT((WireEncodable<EncryptedContent>));
+BOOST_CONCEPT_ASSERT((WireDecodable<EncryptedContent>));
+static_assert(std::is_base_of<ndn::tlv::Error, EncryptedContent::Error>::value,
+ "EncryptedContent::Error must inherit from tlv::Error");
+
+EncryptedContent::EncryptedContent(const Block& block)
+{
+ wireDecode(block);
+}
+
+EncryptedContent&
+EncryptedContent::setPayload(Block payload)
+{
+ m_wire.reset();
+ if (payload.type() != tlv::EncryptedPayload) {
+ m_payload = Block(tlv::EncryptedPayload, std::move(payload));
+ }
+ else {
+ m_payload = std::move(payload);
+ }
+ return *this;
+}
+
+EncryptedContent&
+EncryptedContent::setPayload(ConstBufferPtr payload)
+{
+ m_wire.reset();
+ m_payload = Block(tlv::EncryptedPayload, std::move(payload));
+ return *this;
+}
+
+EncryptedContent&
+EncryptedContent::setIv(Block iv)
+{
+ m_wire.reset();
+ if (iv.type() != tlv::InitialVector) {
+ m_iv = Block(tlv::InitialVector, std::move(iv));
+ }
+ else {
+ m_iv = std::move(iv);
+ }
+ return *this;
+}
+
+EncryptedContent&
+EncryptedContent::setIv(ConstBufferPtr iv)
+{
+ m_wire.reset();
+ m_iv = Block(tlv::InitialVector, iv);
+ return *this;
+}
+
+EncryptedContent&
+EncryptedContent::unsetIv()
+{
+ m_wire.reset();
+ m_iv = Block();
+ return *this;
+}
+
+EncryptedContent&
+EncryptedContent::setPayloadKey(Block key)
+{
+ m_wire.reset();
+ if (key.type() != tlv::EncryptedPayloadKey) {
+ m_payloadKey = Block(tlv::EncryptedPayloadKey, std::move(key));
+ }
+ else {
+ m_payloadKey = std::move(key);
+ }
+ return *this;
+}
+
+EncryptedContent&
+EncryptedContent::setPayloadKey(ConstBufferPtr key)
+{
+ m_wire.reset();
+ m_payloadKey = Block(tlv::EncryptedPayloadKey, std::move(key));
+ return *this;
+}
+
+EncryptedContent&
+EncryptedContent::unsetPayloadKey()
+{
+ m_wire.reset();
+ m_payloadKey = Block();
+ return *this;
+}
+
+EncryptedContent&
+EncryptedContent::setKeyLocator(Name keyLocator)
+{
+ m_wire.reset();
+ m_keyLocator = std::move(keyLocator);
+ return *this;
+}
+
+EncryptedContent&
+EncryptedContent::unsetKeyLocator()
+{
+ m_wire.reset();
+ m_keyLocator = Name();
+ return *this;
+}
+
+template<encoding::Tag TAG>
+size_t
+EncryptedContent::wireEncode(EncodingImpl<TAG>& block) const
+{
+ size_t totalLength = 0;
+
+ if (!m_keyLocator.empty()) {
+ totalLength += m_keyLocator.wireEncode(block);
+ }
+
+ if (!m_payloadKey.empty()) {
+ totalLength += block.prependBlock(m_payloadKey);
+ }
+
+ if (!m_iv.empty()) {
+ totalLength += block.prependBlock(m_iv);
+ }
+
+ if (!m_payload.empty()) {
+ totalLength += block.prependBlock(m_payload);
+ }
+ else {
+ BOOST_THROW_EXCEPTION(Error("Required EncryptedPayload is not set on EncryptedContent"));
+ }
+
+ totalLength += block.prependVarNumber(totalLength);
+ totalLength += block.prependVarNumber(tlv::EncryptedContent);
+ return totalLength;
+}
+
+const Block&
+EncryptedContent::wireEncode() const
+{
+ if (m_wire.hasWire())
+ return m_wire;
+
+ EncodingEstimator estimator;
+ size_t estimatedSize = wireEncode(estimator);
+
+ EncodingBuffer buffer(estimatedSize, 0);
+ wireEncode(buffer);
+
+ m_wire = buffer.block();
+ return m_wire;
+}
+
+void
+EncryptedContent::wireDecode(const Block& wire)
+{
+ if (!wire.hasWire()) {
+ BOOST_THROW_EXCEPTION(Error("The supplied block does not contain wire format"));
+ }
+
+ m_payload.reset();
+ m_iv.reset();
+ m_payloadKey.reset();
+
+ m_wire = wire;
+ m_wire.parse();
+
+ if (m_wire.type() != tlv::EncryptedContent) {
+ BOOST_THROW_EXCEPTION(Error("Unexpected TLV type (expecting EncryptedContent, got" +
+ ndn::to_string(m_wire.type()) + ")"));
+ }
+
+ auto block = m_wire.find(tlv::EncryptedPayload);
+ if (block != m_wire.elements_end()) {
+ m_payload = *block;
+ }
+ else {
+ BOOST_THROW_EXCEPTION(Error("Required EncryptedPayload not found in EncryptedContent"));
+ }
+
+ block = m_wire.find(tlv::InitialVector);
+ if (block != m_wire.elements_end()) {
+ m_iv = *block;
+ }
+
+ block = m_wire.find(tlv::EncryptedPayloadKey);
+ if (block != m_wire.elements_end()) {
+ m_payloadKey = *block;
+ }
+
+ block = m_wire.find(tlv::Name);
+ if (block != m_wire.elements_end()) {
+ m_keyLocator.wireDecode(*block);
+ }
+}
+
+bool
+EncryptedContent::operator==(const EncryptedContent& rhs) const
+{
+ return (wireEncode() == rhs.wireEncode());
+}
+
+} // namespace nac
+} // namespace ndn
diff --git a/src/encrypted-content.hpp b/src/encrypted-content.hpp
new file mode 100644
index 0000000..e14db62
--- /dev/null
+++ b/src/encrypted-content.hpp
@@ -0,0 +1,166 @@
+/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
+/**
+ * Copyright (c) 2014-2018, Regents of the University of California
+ *
+ * NAC library is free software: you can redistribute it and/or modify it under the
+ * terms of the GNU Lesser General Public License as published by the Free Software
+ * Foundation, either version 3 of the License, or (at your option) any later version.
+ *
+ * NAC library is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+ * PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
+ *
+ * You should have received copies of the GNU General Public License and GNU Lesser
+ * General Public License along with ndn-cxx, e.g., in COPYING.md file. If not, see
+ * <http://www.gnu.org/licenses/>.
+ *
+ * See AUTHORS.md for complete list of NAC library authors and contributors.
+ */
+
+#ifndef NDN_NAC_ENCRYPTED_CONTENT_HPP
+#define NDN_NAC_ENCRYPTED_CONTENT_HPP
+
+#include "common.hpp"
+
+#include <ndn-cxx/encoding/tlv.hpp>
+
+namespace ndn {
+namespace nac {
+
+/**
+ * @brief Encrypted content
+ *
+ * <code>
+ * EncryptedContent ::= ENCRYPTED-CONTENT-TYPE TLV-LENGTH
+ * InitialVector
+ * EncryptedPayload
+ * EncryptedPayloadKey
+ * Name
+ *
+ * InitialVector ::= INITIAL-VECTOR-TYPE TLV-LENGTH(=N) BYTE{N}
+ * EncryptedPayload ::= ENCRYPTED-PAYLOAD-TYPE TLV-LENGTH(=N) BYTE{N}
+ * EncryptedPayloadKey ::= ENCRYPTED-PAYLOAD-KEY-TYPE TLV-LENGTH(=N) BYTE{N}
+ * InitialVector ::= INITIAL-VECTOR-TYPE TLV-LENGTH(=N) BYTE{N}
+ * </code>
+ */
+class EncryptedContent
+{
+public:
+ class Error : public ndn::tlv::Error
+ {
+ public:
+ using ndn::tlv::Error::Error;
+ };
+
+public:
+ EncryptedContent() = default;
+
+ explicit
+ EncryptedContent(const Block& block);
+
+ const Block&
+ getPayload() const
+ {
+ return m_payload;
+ }
+
+ EncryptedContent&
+ setPayload(Block payload);
+
+ EncryptedContent&
+ setPayload(ConstBufferPtr payload);
+
+ bool
+ hasIv() const
+ {
+ return !m_iv.empty();
+ }
+
+ const Block&
+ getIv() const
+ {
+ return m_iv;
+ }
+
+ EncryptedContent&
+ unsetIv();
+
+ EncryptedContent&
+ setIv(Block iv);
+
+ EncryptedContent&
+ setIv(ConstBufferPtr iv);
+
+ bool
+ hasPayloadKey() const
+ {
+ return !m_payloadKey.empty();
+ }
+
+ const Block&
+ getPayloadKey() const
+ {
+ return m_payloadKey;
+ }
+
+ EncryptedContent&
+ setPayloadKey(Block key);
+
+ EncryptedContent&
+ setPayloadKey(ConstBufferPtr key);
+
+ EncryptedContent&
+ unsetPayloadKey();
+
+ bool
+ hasKeyLocator() const
+ {
+ return !m_keyLocator.empty();
+ }
+
+ const Name&
+ getKeyLocator() const
+ {
+ return m_keyLocator;
+ }
+
+ EncryptedContent&
+ setKeyLocator(Name keyLocator);
+
+ EncryptedContent&
+ unsetKeyLocator();
+
+ template<encoding::Tag TAG>
+ size_t
+ wireEncode(EncodingImpl<TAG>& block) const;
+
+ const Block&
+ wireEncode() const;
+
+ void
+ wireDecode(const Block& wire);
+
+public:
+ bool
+ operator==(const EncryptedContent& rhs) const;
+
+ bool
+ operator!=(const EncryptedContent& rhs) const
+ {
+ return !(*this == rhs);
+ }
+
+private:
+ Block m_iv;
+ Block m_payload;
+ Block m_payloadKey; ///< for public key encryption, public key encodes a random key that is used
+ ///< for symmetric encryption of the content
+ Name m_keyLocator;
+
+ mutable Block m_wire;
+};
+
+} // namespace nac
+} // namespace ndn
+
+#endif // NDN_NAC_ENCRYPTED_CONTENT_HPP
diff --git a/tests/tests/encrypted-content.t.cpp b/tests/tests/encrypted-content.t.cpp
new file mode 100644
index 0000000..afa03da
--- /dev/null
+++ b/tests/tests/encrypted-content.t.cpp
@@ -0,0 +1,165 @@
+/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
+/**
+ * Copyright (c) 2014-2018, Regents of the University of California
+ *
+ * This file is part of NAC (Name-Based Access Control for NDN).
+ * See AUTHORS.md for complete list of NAC authors and contributors.
+ *
+ * NAC is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation,
+ * either version 3 of the License, or (at your option) any later version.
+ *
+ * NAC is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY;
+ * without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * NAC, e.g., in COPYING.md file. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "encrypted-content.hpp"
+
+#include "tests-common.hpp"
+
+#include <iostream>
+
+namespace ndn {
+namespace nac {
+namespace tests {
+
+class EncryptedContentFixture
+{
+public:
+ EncryptedContentFixture()
+ {
+ BOOST_CHECK_EQUAL(randomBlock.value_size(), 3);
+ BOOST_CHECK_EQUAL(randomBuffer->size(), 10);
+ }
+
+public:
+ EncryptedContent content;
+ Block randomBlock = "01 03 000000"_block;
+ ConstBufferPtr randomBuffer = make_shared<Buffer>(10);
+};
+
+BOOST_FIXTURE_TEST_SUITE(TestEncryptedContent, EncryptedContentFixture)
+
+BOOST_AUTO_TEST_CASE(Constructor)
+{
+ BOOST_CHECK_THROW(content.wireEncode(), tlv::Error);
+ content.setPayload(randomBlock);
+
+ BOOST_CHECK(!content.hasIv());
+ BOOST_CHECK(!content.hasPayloadKey());
+ BOOST_CHECK(!content.hasKeyLocator());
+
+ BOOST_CHECK_EQUAL(content.wireEncode(), "82 07 84050103000000"_block);
+
+ content.setIv(randomBlock);
+ BOOST_CHECK_EQUAL(content.wireEncode(), "82[0E]=8405010300000085050103000000"_block);
+
+ content.setKeyLocator("/random/name");
+ BOOST_CHECK_EQUAL(content.wireEncode(), "82[1E]=8405010300000085050103000000070E080672616E646F6D08046E616D65"_block);
+
+ content = EncryptedContent("82 07 84050103000000"_block);
+ BOOST_CHECK(!content.hasIv());
+ BOOST_CHECK(!content.hasPayloadKey());
+ BOOST_CHECK(!content.hasKeyLocator());
+
+ content = EncryptedContent("82 1E 8505010300000084050103000000070E080672616E646F6D08046E616D65"_block);
+ BOOST_CHECK(content.hasIv());
+ BOOST_CHECK(!content.hasPayloadKey());
+ BOOST_CHECK(content.hasKeyLocator());
+}
+
+BOOST_AUTO_TEST_SUITE(SetterGetter)
+
+BOOST_AUTO_TEST_CASE(Iv)
+{
+ content.setPayload(randomBlock);
+
+ content.setIv(randomBlock);
+ BOOST_REQUIRE(content.hasIv());
+ BOOST_CHECK_EQUAL(content.getIv().type(), tlv::InitialVector);
+ BOOST_CHECK_EQUAL(content.getIv().blockFromValue(), randomBlock);
+
+ content.unsetIv();
+ BOOST_CHECK(!content.hasIv());
+
+ content.setIv(randomBuffer);
+ BOOST_REQUIRE(content.hasIv());
+ BOOST_CHECK_EQUAL(content.getIv().type(), tlv::InitialVector);
+ BOOST_CHECK_THROW(content.getIv().blockFromValue(), tlv::Error);
+ BOOST_CHECK_EQUAL(content.getIv().value_size(), randomBuffer->size());
+
+ content = EncryptedContent("82[13]=84050103000000850A00000000000000000000"_block);
+ BOOST_REQUIRE(content.hasIv());
+ BOOST_CHECK_EQUAL(content.getIv().type(), tlv::InitialVector);
+ BOOST_CHECK_THROW(content.getIv().blockFromValue(), tlv::Error);
+ BOOST_CHECK_EQUAL(content.getIv().value_size(), randomBuffer->size());
+}
+
+BOOST_AUTO_TEST_CASE(Payload)
+{
+ content.setPayload(randomBlock);
+ BOOST_CHECK_EQUAL(content.getPayload().type(), tlv::EncryptedPayload);
+ BOOST_CHECK_EQUAL(content.getPayload().blockFromValue(), randomBlock);
+
+ content.setPayload(randomBuffer);
+ BOOST_CHECK_EQUAL(content.getPayload().type(), tlv::EncryptedPayload);
+ BOOST_CHECK_THROW(content.getPayload().blockFromValue(), tlv::Error);
+ BOOST_CHECK_EQUAL(content.getPayload().value_size(), randomBuffer->size());
+
+ content = EncryptedContent("82[0C]=840A00000000000000000000"_block);
+ BOOST_CHECK_EQUAL(content.getPayload().type(), tlv::EncryptedPayload);
+ BOOST_CHECK_THROW(content.getPayload().blockFromValue(), tlv::Error);
+ BOOST_CHECK_EQUAL(content.getPayload().value_size(), randomBuffer->size());
+}
+
+BOOST_AUTO_TEST_CASE(PayloadKey)
+{
+ content.setPayload(randomBlock);
+
+ content.setPayloadKey(randomBlock);
+ BOOST_REQUIRE(content.hasPayloadKey());
+ BOOST_CHECK_EQUAL(content.getPayloadKey().type(), tlv::EncryptedPayloadKey);
+ BOOST_CHECK_EQUAL(content.getPayloadKey().blockFromValue(), randomBlock);
+
+ content.unsetPayloadKey();
+ BOOST_CHECK(!content.hasPayloadKey());
+
+ content.setPayloadKey(randomBuffer);
+ BOOST_REQUIRE(content.hasPayloadKey());
+ BOOST_CHECK_EQUAL(content.getPayloadKey().type(), tlv::EncryptedPayloadKey);
+ BOOST_CHECK_THROW(content.getPayloadKey().blockFromValue(), tlv::Error);
+ BOOST_CHECK_EQUAL(content.getPayloadKey().value_size(), randomBuffer->size());
+
+ content = EncryptedContent("82[13]=84050103000000860A00000000000000000000"_block);
+ BOOST_CHECK_EQUAL(content.getPayloadKey().type(), tlv::EncryptedPayloadKey);
+ BOOST_CHECK_THROW(content.getPayloadKey().blockFromValue(), tlv::Error);
+ BOOST_CHECK_EQUAL(content.getPayloadKey().value_size(), randomBuffer->size());
+}
+
+BOOST_AUTO_TEST_CASE(KeyLocator)
+{
+ content.setPayload(randomBlock);
+
+ content.setKeyLocator("/random/name");
+ BOOST_REQUIRE(content.hasKeyLocator());
+ BOOST_CHECK_EQUAL(content.getKeyLocator(), "/random/name");
+
+ content.unsetPayloadKey();
+ BOOST_CHECK(!content.hasPayloadKey());
+
+ content = EncryptedContent("82[17]=84050103000000070E080672616E646F6D08046E616D65"_block);
+ BOOST_REQUIRE(content.hasKeyLocator());
+ BOOST_CHECK_EQUAL(content.getKeyLocator(), "/random/name");
+}
+
+BOOST_AUTO_TEST_SUITE_END() // SetterGetter
+
+BOOST_AUTO_TEST_SUITE_END()
+
+} // namespace tests
+} // namespace nac
+} // namespace ndn