forked from Azure/azure-sdk-for-net
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Updating readme and samples for Azure.Security.KeyVault.Keys.Cryptog…
…raphy (Azure#7280) * Updating readme and samples for Azure.Security.KeyVault.Keys.Cryptography * fixing name copy paste error * updates addressing PR feedback * fix for sample issue
- Loading branch information
Showing
8 changed files
with
643 additions
and
2 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
83 changes: 83 additions & 0 deletions
83
sdk/keyvault/Azure.Security.KeyVault.Keys/samples/Sample4_EncryptDecrypt.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,83 @@ | ||
| using Azure.Identity; | ||
| using Azure.Security.KeyVault.Keys; | ||
| using Azure.Security.KeyVault.Keys.Cryptography; | ||
| using NUnit.Framework; | ||
| using System; | ||
| using System.Diagnostics; | ||
| using System.Text; | ||
| using System.Threading; | ||
|
|
||
| namespace Azure.Security.KeyVault.Keys.Samples | ||
| { | ||
|
|
||
| /// <summary> | ||
| /// Sample demonstrates how to encrypt and decrypt a single block of plain text with an RSA key using the synchronous methods of the CryptographyClient. | ||
| /// </summary> | ||
| [Category("Live")] | ||
| public partial class Sample4_EncryptDecypt | ||
| { | ||
| [Test] | ||
| public void EncryptDecryptSync() | ||
| { | ||
| // Environment variable with the Key Vault endpoint. | ||
| string keyVaultUrl = Environment.GetEnvironmentVariable("AZURE_KEYVAULT_URL"); | ||
|
|
||
| // Instantiate a key client that will be used to create a key. Notice that the client is using default Azure | ||
| // credentials. To make default credentials work, ensure that environment variables 'AZURE_CLIENT_ID', | ||
| // 'AZURE_CLIENT_KEY' and 'AZURE_TENANT_ID' are set with the service principal credentials. | ||
| var keyClient = new KeyClient(new Uri(keyVaultUrl), new DefaultAzureCredential()); | ||
|
|
||
| // Let's create a RSA key which will be used to encrypt and decrypt | ||
| string rsaKeyName = $"CloudRsaKey-{Guid.NewGuid()}"; | ||
| var rsaKey = new RsaKeyCreateOptions(rsaKeyName, hsm: false, keySize: 2048); | ||
|
|
||
| Key cloudRsaKey = keyClient.CreateRsaKey(rsaKey); | ||
| Debug.WriteLine($"Key is returned with name {cloudRsaKey.Name} and type {cloudRsaKey.KeyMaterial.KeyType}"); | ||
|
|
||
| // Let's create the CryptographyClient which can perform cryptographic operations with the key we just created. | ||
| // Again we are using the default Azure credential as above. | ||
| var cryptoClient = new CryptographyClient(cloudRsaKey.Id, new DefaultAzureCredential()); | ||
|
|
||
| // Next we'll encrypt some arbitrary plain text with the key using the CryptographyClient. Note that RSA encryption | ||
| // algorithms have no chaining so they can only encrypt a single block of plaintext securely. For RSAOAEP this can be | ||
| // calculated as (keysize / 8) - 42, or in our case (2048 / 8) - 42 = 214 bytes. | ||
| byte[] plaintext = Encoding.UTF8.GetBytes("A single block of plaintext"); | ||
|
|
||
| // First encrypt the data using RSAOAEP with the created key. | ||
| EncryptResult encryptResult = cryptoClient.Encrypt(EncryptionAlgorithm.RSAOAEP, plaintext); | ||
| Debug.WriteLine($"Encrypted data using the algorithm {encryptResult.Algorithm}, with key {encryptResult.KeyId}. The resulting encrypted data is {Convert.ToBase64String(encryptResult.Ciphertext)}"); | ||
|
|
||
| // Now decrypt the encrypted data. Note that the same algorithm must always be used for both encrypt and decrypt | ||
| DecryptResult decryptResult = cryptoClient.Decrypt(EncryptionAlgorithm.RSAOAEP, encryptResult.Ciphertext); | ||
| Debug.WriteLine($"Decrypted data using the algorithm {decryptResult.Algorithm}, with key {decryptResult.KeyId}. The resulting decrypted data is {Encoding.UTF8.GetString(decryptResult.Plaintext)}"); | ||
|
|
||
| // The Cloud RSA Key is no longer needed, need to delete it from the Key Vault. | ||
| keyClient.DeleteKey(rsaKeyName); | ||
|
|
||
| // To ensure key is deleted on server side. | ||
| Assert.IsTrue(WaitForDeletedKey(keyClient, rsaKeyName)); | ||
|
|
||
| // If the keyvault is soft-delete enabled, then for permanent deletion, deleted key needs to be purged. | ||
| keyClient.PurgeDeletedKey(rsaKeyName); | ||
|
|
||
| } | ||
|
|
||
| private bool WaitForDeletedKey(KeyClient client, string keyName) | ||
| { | ||
| int maxIterations = 20; | ||
| for (int i = 0; i < maxIterations; i++) | ||
| { | ||
| try | ||
| { | ||
| client.GetDeletedKey(keyName); | ||
| return true; | ||
| } | ||
| catch | ||
| { | ||
| Thread.Sleep(5000); | ||
| } | ||
| } | ||
| return false; | ||
| } | ||
| } | ||
| } |
83 changes: 83 additions & 0 deletions
83
sdk/keyvault/Azure.Security.KeyVault.Keys/samples/Sample4_EncryptDecryptAsync.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,83 @@ | ||
| using Azure.Identity; | ||
| using Azure.Security.KeyVault.Keys.Cryptography; | ||
| using NUnit.Framework; | ||
| using System; | ||
| using System.Collections.Generic; | ||
| using System.Diagnostics; | ||
| using System.Text; | ||
| using System.Threading.Tasks; | ||
|
|
||
| namespace Azure.Security.KeyVault.Keys.Samples | ||
| { | ||
|
|
||
| /// <summary> | ||
| /// Sample demonstrates how to encrypt and decrypt a single block of plain text with an RSA key using the asynchronous methods of the CryptographyClient. | ||
| /// </summary> | ||
| [Category("Live")] | ||
| public partial class Sample4_EncryptDecypt | ||
| { | ||
| [Test] | ||
| public async Task EncryptDecryptAsync() | ||
| { | ||
| // Environment variable with the Key Vault endpoint. | ||
| string keyVaultUrl = Environment.GetEnvironmentVariable("AZURE_KEYVAULT_URL"); | ||
|
|
||
| // Instantiate a key client that will be used to create a key. Notice that the client is using default Azure | ||
| // credentials. To make default credentials work, ensure that environment variables 'AZURE_CLIENT_ID', | ||
| // 'AZURE_CLIENT_KEY' and 'AZURE_TENANT_ID' are set with the service principal credentials. | ||
| var keyClient = new KeyClient(new Uri(keyVaultUrl), new DefaultAzureCredential()); | ||
|
|
||
| // First we create a RSA key which will be used to encrypt and decrypt | ||
| string rsaKeyName = $"CloudRsaKey-{Guid.NewGuid()}"; | ||
| var rsaKey = new RsaKeyCreateOptions(rsaKeyName, hsm: false, keySize: 2048); | ||
|
|
||
| Key cloudRsaKey = await keyClient.CreateRsaKeyAsync(rsaKey); | ||
| Debug.WriteLine($"Key is returned with name {cloudRsaKey.Name} and type {cloudRsaKey.KeyMaterial.KeyType}"); | ||
|
|
||
| // Then we create the CryptographyClient which can perform cryptographic operations with the key we just created. | ||
| // Again we are using the default Azure credential as above. | ||
| var cryptoClient = new CryptographyClient(cloudRsaKey.Id, new DefaultAzureCredential()); | ||
|
|
||
| // Next we'll encrypt some arbitrary plain text with the key using the CryptographyClient. Note that RSA encryption | ||
| // algorithms have no chaining so they can only encrypt a single block of plaintext securely. For RSAOAEP this can be | ||
| // calculated as (keysize / 8) - 42, or in our case (2048 / 8) - 42 = 214 bytes. | ||
| byte[] plaintext = Encoding.UTF8.GetBytes("A single block of plaintext"); | ||
|
|
||
| // First encrypt the data using RSAOAEP with the created key. | ||
| EncryptResult encryptResult = await cryptoClient.EncryptAsync(EncryptionAlgorithm.RSAOAEP, plaintext); | ||
| Debug.WriteLine($"Encrypted data using the algorithm {encryptResult.Algorithm}, with key {encryptResult.KeyId}. The resulting encrypted data is {Convert.ToBase64String(encryptResult.Ciphertext)}"); | ||
|
|
||
| // Now decrypt the encrypted data. Note that the same algorithm must always be used for both encrypt and decrypt | ||
| DecryptResult decryptResult = await cryptoClient.DecryptAsync(EncryptionAlgorithm.RSAOAEP, encryptResult.Ciphertext); | ||
| Debug.WriteLine($"Decrypted data using the algorithm {decryptResult.Algorithm}, with key {decryptResult.KeyId}. The resulting decrypted data is {Encoding.UTF8.GetString(decryptResult.Plaintext)}"); | ||
|
|
||
| // The Cloud RSA Key is no longer needed, need to delete it from the Key Vault. | ||
| await keyClient.DeleteKeyAsync(rsaKeyName); | ||
|
|
||
| // To ensure key is deleted on server side. | ||
| Assert.IsTrue(await WaitForDeletedKeyAsync(keyClient, rsaKeyName)); | ||
|
|
||
| // If the keyvault is soft-delete enabled, then for permanent deletion, deleted key needs to be purged. | ||
| await keyClient.PurgeDeletedKeyAsync(rsaKeyName); | ||
|
|
||
| } | ||
|
|
||
| private async Task<bool> WaitForDeletedKeyAsync(KeyClient client, string keyName) | ||
| { | ||
| int maxIterations = 20; | ||
| for (int i = 0; i < maxIterations; i++) | ||
| { | ||
| try | ||
| { | ||
| await client.GetDeletedKeyAsync(keyName); | ||
| return true; | ||
| } | ||
| catch | ||
| { | ||
| await Task.Delay(5000); | ||
| } | ||
| } | ||
| return false; | ||
| } | ||
| } | ||
| } |
Oops, something went wrong.