Skip to content

Commit 24f497c

Browse files
BethanyZhouBethanyZhou
authored
Supports Encrypt/Decrypt/Wrap/Unwrap using keys (#15816)
* add encrypt and decrypt by key * add test cases and examples * add change log * add online version * remove position number
1 parent 8b4f2c8 commit 24f497c

20 files changed

+1705
-892
lines changed

‎src/KeyVault/KeyVault.Test/PesterTests/Key.Tests.ps1

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,4 +53,18 @@ Describe "Import key" {
5353
Add-AzKeyVaultKey -VaultName veakkine-kv -Name PSECImportedKey -KeyFilePath E:\targetBlob.byok -CurveName P-256 -ErrorAction Stop
5454
} | Should -Throw "KeyType"
5555
}
56+
}
57+
58+
Describe "Invoke key operation" {
59+
It "Encrypt and Decrypt a sequence using key" {
60+
$encryptedResult = Invoke-AzKeyVaultKeyOperation -Operation Encrypt -Algorithm RSA1_5 -HsmName bez-hsm -Name bez-k -Value (ConvertTo-SecureString -String "test" -AsPlainText -Force)
61+
$decryptedResult = Invoke-AzKeyVaultKeyOperation -Operation Decrypt -Algorithm RSA1_5 -HsmName bez-hsm -Name bez-k -Value (ConvertTo-SecureString -String $$encryptedResult.result -AsPlainText -Force)
62+
$decryptedResult.result | Should -Be "test"
63+
}
64+
65+
It "Wrap and Unwrap a sequence using key" {
66+
$wrappedResult = Invoke-AzKeyVaultKeyOperation -Operation Wrap -Algorithm RSA1_5 -HsmName bez-hsm -Name bez-k -Value (ConvertTo-SecureString -String "test" -AsPlainText -Force)
67+
$unwrappedResult = Invoke-AzKeyVaultKeyOperation -Operation Unwrap -Algorithm RSA1_5 -HsmName bez-hsm -Name bez-k -Value (ConvertTo-SecureString -String $wrappedResult.result -AsPlainText -Force)
68+
$unwrappedResult.result | Should -Be "test"
69+
}
5670
}

‎src/KeyVault/KeyVault.Test/PesterTests/ManagedHsmDatePlaneTests.Tests.ps1 renamed to ‎src/KeyVault/KeyVault.Test/PesterTests/ManagedHsmDataPlaneTests.Tests.ps1

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ $here = Split-Path -Parent $MyInvocation.MyCommand.Path
22
$sut = (Split-Path -Leaf $MyInvocation.MyCommand.Path) -replace '\.Tests\.', '.'
33
. "$here\$sut"
44

5-
. $PSScriptRoot/ManagedHsmDatePlaneTests.ps1
5+
. $PSScriptRoot/ManagedHsmDataPlaneTests.ps1
66
# ImportModules
77
$hsmName = 'bezmhsm'
88
$signInName = '[email protected]'

‎src/KeyVault/KeyVault.Test/PesterTests/ManagedHsmDatePlaneTests.ps1 renamed to ‎src/KeyVault/KeyVault.Test/PesterTests/ManagedHsmDataPlaneTests.ps1

File renamed without changes.

‎src/KeyVault/KeyVault/Az.KeyVault.psd1

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,7 @@ CmdletsToExport = 'Add-AzKeyVaultCertificate', 'Update-AzKeyVaultCertificate',
104104
'Add-AzKeyVaultKey', 'Remove-AzKeyVaultKey', 'Update-AzKeyVault',
105105
'New-AzKeyVaultNetworkRuleSetObject', 'Remove-AzKeyVaultSecret',
106106
'Restore-AzKeyVaultKey', 'Update-AzKeyVaultKey',
107+
'Invoke-AzKeyVaultKeyOperation',
107108
'Set-AzKeyVaultSecret', 'Update-AzKeyVaultSecret',
108109
'Get-AzKeyVaultCertificatePolicy',
109110
'New-AzKeyVaultCertificateAdministratorDetail',

‎src/KeyVault/KeyVault/ChangeLog.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
- Additional information about change #1
1919
-->
2020
## Upcoming Release
21+
* Supports Encrypt/Decrypt/Wrap/Unwrap using keys [#15679]
2122
* Enabled managing resources in other subscriptions without switching the context by adding `-Subscription <String>`.
2223

2324
## Version 3.5.0

‎src/KeyVault/KeyVault/Commands/AddAzureKeyVaultKey.cs renamed to ‎src/KeyVault/KeyVault/Commands/Key/AddAzureKeyVaultKey.cs

File renamed without changes.

‎src/KeyVault/KeyVault/Commands/BackupAzureKeyVaultKey.cs renamed to ‎src/KeyVault/KeyVault/Commands/Key/BackupAzureKeyVaultKey.cs

File renamed without changes.

‎src/KeyVault/KeyVault/Commands/GetAzureKeyVaultKey.cs renamed to ‎src/KeyVault/KeyVault/Commands/Key/GetAzureKeyVaultKey.cs

File renamed without changes.

‎src/KeyVault/KeyVault/Commands/Key/InvokeAzureKeyVaultOperation.cs

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
using Microsoft.Azure.Commands.KeyVault.Models;
2+
using Microsoft.Azure.Commands.ResourceManager.Common.ArgumentCompleters;
3+
4+
using System;
5+
using System.Management.Automation;
6+
using System.Security;
7+
using System.Text;
8+
9+
namespace Microsoft.Azure.Commands.KeyVault.Commands.Key
10+
{
11+
/// <summary>
12+
/// 1. Encrypts an arbitrary sequence of bytes using an encryption key that is stored in a key vault.
13+
/// 2. Decrypts a single block of encrypted data.
14+
/// 3. Wraps a symmetric key using a specified key.
15+
/// 4. Unwraps a symmetric key using the specified key that was initially used for wrapping that key.
16+
/// </summary>
17+
[Cmdlet(VerbsLifecycle.Invoke, ResourceManager.Common.AzureRMConstants.AzurePrefix + "KeyVaultKeyOperation", SupportsShouldProcess = true, DefaultParameterSetName = ByVaultNameParameterSet)]
18+
[OutputType(typeof(PSKeyOperationResult))]
19+
public class InvokeAzureKeyVaultKeyOperation : KeyVaultKeyCmdletBase
20+
{
21+
#region Supported Operation
22+
enum Operations
23+
{
24+
Unknown,
25+
Encrypt,
26+
Decrypt,
27+
Wrap,
28+
Unwrap
29+
}
30+
#endregion
31+
32+
#region Input Parameter Definitions
33+
34+
[Parameter(Mandatory = true,
35+
HelpMessage = "Algorithm identifier")]
36+
[ValidateNotNullOrEmpty]
37+
[PSArgumentCompleter("Encrypt", "Decrypt", "Wrap", "Unwrap")]
38+
public string Operation { get; set; }
39+
40+
[Parameter(Mandatory = true,
41+
HelpMessage = "Algorithm identifier")]
42+
[ValidateNotNullOrEmpty]
43+
[PSArgumentCompleter("RSA-OAEP", "RSA-OAEP-256", "RSA1_5")]
44+
[Alias("EncryptionAlgorithm", "WrapAlgorithm")]
45+
public string Algorithm { get; set; }
46+
47+
[Parameter(Mandatory = true,
48+
HelpMessage = "The value to be operated")]
49+
[ValidateNotNullOrEmpty]
50+
public SecureString Value { get; set; }
51+
#endregion Input Parameter Definitions
52+
53+
public override void ExecuteCmdlet()
54+
{
55+
NormalizeParameterSets();
56+
57+
Operations opt = Operations.Unknown;
58+
Enum.TryParse(Operation, out opt);
59+
60+
if (string.IsNullOrEmpty(HsmName))
61+
{
62+
switch (opt)
63+
{
64+
case Operations.Encrypt:
65+
this.WriteObject(
66+
this.Track2DataClient.Encrypt(VaultName, Name, Version,
67+
Encoding.ASCII.GetBytes(Value.ConvertToString()), Algorithm));
68+
break;
69+
case Operations.Decrypt:
70+
this.WriteObject(
71+
this.Track2DataClient.Decrypt(VaultName, Name, Version,
72+
Convert.FromBase64String(Value.ConvertToString()), Algorithm));
73+
break;
74+
case Operations.Wrap:
75+
this.WriteObject(
76+
this.Track2DataClient.WrapKey(VaultName, Name, Version,
77+
Encoding.ASCII.GetBytes(Value.ConvertToString()), Algorithm));
78+
break;
79+
case Operations.Unwrap:
80+
this.WriteObject(
81+
this.Track2DataClient.UnwrapKey(VaultName, Name, Version,
82+
Convert.FromBase64String(Value.ConvertToString()), Algorithm));
83+
break;
84+
case Operations.Unknown:
85+
throw new NotSupportedException("Not supported ${Operation} yet");
86+
}
87+
}
88+
else
89+
{
90+
switch (opt)
91+
{
92+
case Operations.Encrypt:
93+
this.WriteObject(
94+
this.Track2DataClient.ManagedHsmKeyEncrypt(HsmName, Name, Version,
95+
Encoding.ASCII.GetBytes(Value.ConvertToString()), Algorithm));
96+
break;
97+
case Operations.Decrypt:
98+
this.WriteObject(
99+
this.Track2DataClient.ManagedHsmKeyDecrypt(HsmName, Name, Version,
100+
Convert.FromBase64String(Value.ConvertToString()), Algorithm));
101+
break;
102+
case Operations.Wrap:
103+
this.WriteObject(
104+
this.Track2DataClient.ManagedHsmWrapKey(HsmName, Name, Version,
105+
Encoding.ASCII.GetBytes(Value.ConvertToString()), Algorithm));
106+
break;
107+
case Operations.Unwrap:
108+
this.WriteObject(
109+
this.Track2DataClient.ManagedHsmUnwrapKey(HsmName, Name, Version,
110+
Convert.FromBase64String(Value.ConvertToString()), Algorithm));
111+
break;
112+
case Operations.Unknown:
113+
throw new NotSupportedException("Not supported ${Operation} yet");
114+
}
115+
116+
}
117+
}
118+
}
119+
}

‎src/KeyVault/KeyVault/Commands/Key/KeyVaultKeyCmdletBase.cs

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
using Microsoft.Azure.Commands.KeyVault.Models;
2+
using Microsoft.Azure.Commands.ResourceManager.Common.ArgumentCompleters;
3+
using Microsoft.Azure.Management.Internal.Resources.Utilities.Models;
4+
5+
using System.Management.Automation;
6+
7+
namespace Microsoft.Azure.Commands.KeyVault.Commands.Key
8+
{
9+
public class KeyVaultKeyCmdletBase : KeyVaultCmdletBase
10+
{
11+
#region Parameter Set Names
12+
13+
internal const string ByVaultNameParameterSet = "ByVaultName";
14+
internal const string ByHsmNameParameterSet = "ByHsmName";
15+
internal const string ByKeyInputObjectParameterSet = "ByKeyInputObject";
16+
17+
#endregion
18+
19+
#region Input Parameter Definitions
20+
21+
/// <summary>
22+
/// Vault name
23+
/// </summary>
24+
[Parameter(Mandatory = true,
25+
Position = 0,
26+
ParameterSetName = ByVaultNameParameterSet,
27+
HelpMessage = "Vault name.")]
28+
[ResourceNameCompleter("Microsoft.KeyVault/vaults", "FakeResourceGroupName")]
29+
[ValidateNotNullOrEmpty]
30+
public string VaultName { get; set; }
31+
32+
[Parameter(Mandatory = true,
33+
Position = 0,
34+
ParameterSetName = ByHsmNameParameterSet,
35+
HelpMessage = "HSM name.")]
36+
[ResourceNameCompleter("Microsoft.KeyVault/managedHSMs", "FakeResourceGroupName")]
37+
[ValidateNotNullOrEmpty]
38+
public string HsmName { get; set; }
39+
40+
/// <summary>
41+
/// Key name.
42+
/// </summary>
43+
[Parameter(Mandatory = true,
44+
Position = 1,
45+
ParameterSetName = ByVaultNameParameterSet,
46+
HelpMessage = "Key name.")]
47+
[Parameter(Mandatory = true,
48+
Position = 1,
49+
ParameterSetName = ByHsmNameParameterSet,
50+
HelpMessage = "Key name.")]
51+
[ValidateNotNullOrEmpty]
52+
[Alias(Constants.KeyName)]
53+
public string Name { get; set; }
54+
55+
/// <summary>
56+
/// Key object
57+
/// </summary>
58+
[Parameter(Mandatory = true,
59+
Position = 0,
60+
ParameterSetName = ByKeyInputObjectParameterSet,
61+
ValueFromPipeline = true,
62+
HelpMessage = "Key object")]
63+
[ValidateNotNullOrEmpty]
64+
[Alias("Key")]
65+
public PSKeyVaultKeyIdentityItem InputObject { get; set; }
66+
67+
/// <summary>
68+
/// Key version.
69+
/// </summary>
70+
[Parameter(Mandatory = false,
71+
HelpMessage = "Key version.")]
72+
[Alias("KeyVersion")]
73+
public string Version { get; set; }
74+
75+
#endregion Input Parameter Definitions
76+
77+
internal void NormalizeParameterSets()
78+
{
79+
if (InputObject != null) {
80+
Name = InputObject.Name;
81+
Version = Version ?? InputObject.Version;
82+
83+
if (InputObject.IsHsm)
84+
{
85+
HsmName = InputObject.VaultName;
86+
}
87+
else
88+
{
89+
VaultName = InputObject.VaultName;
90+
}
91+
}
92+
}
93+
}
94+
}

‎src/KeyVault/KeyVault/Commands/RemoveAzureKeyVaultKey.cs renamed to ‎src/KeyVault/KeyVault/Commands/Key/RemoveAzureKeyVaultKey.cs

File renamed without changes.

‎src/KeyVault/KeyVault/Commands/RestoreAzureKeyVaultKey.cs renamed to ‎src/KeyVault/KeyVault/Commands/Key/RestoreAzureKeyVaultKey.cs

File renamed without changes.

‎src/KeyVault/KeyVault/Commands/UpdateAzureKeyVaultKey.cs renamed to ‎src/KeyVault/KeyVault/Commands/Key/UpdateAzureKeyVaultKey.cs

File renamed without changes.

‎src/KeyVault/KeyVault/Models/IKeyVaultDataServiceClient.cs

Lines changed: 43 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -25,56 +25,75 @@ namespace Microsoft.Azure.Commands.KeyVault.Models
2525
{
2626
public interface IKeyVaultDataServiceClient
2727
{
28-
#region Key actions
29-
PSKeyVaultKey CreateKey(string vaultName, string keyName, PSKeyVaultKeyAttributes keyAttributes, int? size, string curveName);
30-
31-
PSKeyVaultKey CreateManagedHsmKey(string managedHsmName, string keyName, PSKeyVaultKeyAttributes keyAttributes, int? size, string curveName);
28+
#region KeyVault key actions
29+
string BackupKey(string vaultName, string keyName, string outputBlobPath);
3230

33-
PSKeyVaultKey ImportKey(string vaultName, string keyName, PSKeyVaultKeyAttributes keyAttributes, JsonWebKey webKey, bool? importToHsm);
31+
PSKeyVaultKey CreateKey(string vaultName, string keyName, PSKeyVaultKeyAttributes keyAttributes, int? size, string curveName);
3432

35-
PSKeyVaultKey ImportManagedHsmKey(string managedHsmName, string keyName, Track2Sdk.JsonWebKey webKey);
33+
PSKeyOperationResult Decrypt(string vaultName, string keyName, string version, byte[] value, string encryptAlgorithm);
3634

37-
PSKeyVaultKey UpdateKey(string vaultName, string keyName, string keyVersion, PSKeyVaultKeyAttributes keyAttributes);
35+
PSDeletedKeyVaultKey DeleteKey(string vaultName, string keyName);
3836

39-
PSKeyVaultKey UpdateManagedHsmKey(string managedHsmName, string keyName, string keyVersion, PSKeyVaultKeyAttributes keyAttributes);
37+
PSKeyOperationResult Encrypt(string vaultName, string keyName, string version, byte[] value, string encryptAlgorithm);
4038

4139
PSKeyVaultKey GetKey(string vaultName, string keyName, string keyVersion);
4240

43-
PSKeyVaultKey GetManagedHsmKey(string managedHsmName, string keyName, string keyVersion);
44-
4541
PSDeletedKeyVaultKey GetDeletedKey(string managedHsmName, string keyName);
4642

47-
PSDeletedKeyVaultKey GetManagedHsmDeletedKey(string managedHsmName, string keyName);
48-
4943
IEnumerable<PSKeyVaultKeyIdentityItem> GetKeys(KeyVaultObjectFilterOptions options);
5044

51-
IEnumerable<PSKeyVaultKeyIdentityItem> GetManagedHsmKeys(string managedHsmName);
52-
5345
IEnumerable<PSKeyVaultKeyIdentityItem> GetKeyVersions(KeyVaultObjectFilterOptions options);
5446

55-
IEnumerable<PSKeyVaultKeyIdentityItem> GetManagedHsmKeyAllVersions(string managedHsmName, string keyName);
56-
5747
IEnumerable<PSDeletedKeyVaultKeyIdentityItem> GetDeletedKeys(KeyVaultObjectFilterOptions options);
5848

59-
IEnumerable<PSDeletedKeyVaultKeyIdentityItem> GetManagedHsmDeletedKeys(string managedHsmName);
49+
PSKeyVaultKey ImportKey(string vaultName, string keyName, PSKeyVaultKeyAttributes keyAttributes, JsonWebKey webKey, bool? importToHsm);
6050

61-
PSDeletedKeyVaultKey DeleteKey(string vaultName, string keyName);
51+
PSKeyOperationResult UnwrapKey(string vaultName, string keyName, string keyVersion, byte[] value, string wrapAlgorithm);
6252

63-
PSDeletedKeyVaultKey DeleteManagedHsmKey(string ManagedHsm, string keyName);
53+
PSKeyVaultKey UpdateKey(string vaultName, string keyName, string keyVersion, PSKeyVaultKeyAttributes keyAttributes);
6454

65-
void PurgeKey(string vaultName, string name);
55+
PSKeyOperationResult WrapKey(string vaultName, string keyName, string keyVersion, byte[] wrapKey, string wrapAlgorithm);
6656

67-
void PurgeManagedHsmKey(string managedHsmName, string keyName);
57+
void PurgeKey(string vaultName, string name);
6858

6959
PSKeyVaultKey RecoverKey(string vaultName, string keyName);
7060

71-
PSKeyVaultKey RecoverManagedHsmKey(string managedHsmName, string keyName);
61+
PSKeyVaultKey RestoreKey(string vaultName, string inputBlobPath);
62+
#endregion
7263

73-
string BackupKey(string vaultName, string keyName, string outputBlobPath);
64+
#region Managed Hsm key actions
7465

7566
string BackupManagedHsmKey(string managedHsmName, string keyName, string outputBlobPath);
7667

77-
PSKeyVaultKey RestoreKey(string vaultName, string inputBlobPath);
68+
PSKeyVaultKey CreateManagedHsmKey(string managedHsmName, string keyName, PSKeyVaultKeyAttributes keyAttributes, int? size, string curveName);
69+
70+
PSDeletedKeyVaultKey DeleteManagedHsmKey(string ManagedHsm, string keyName);
71+
72+
PSKeyVaultKey GetManagedHsmKey(string managedHsmName, string keyName, string keyVersion);
73+
74+
PSDeletedKeyVaultKey GetManagedHsmDeletedKey(string managedHsmName, string keyName);
75+
76+
IEnumerable<PSKeyVaultKeyIdentityItem> GetManagedHsmKeys(string managedHsmName);
77+
78+
IEnumerable<PSKeyVaultKeyIdentityItem> GetManagedHsmKeyAllVersions(string managedHsmName, string keyName);
79+
80+
IEnumerable<PSDeletedKeyVaultKeyIdentityItem> GetManagedHsmDeletedKeys(string managedHsmName);
81+
82+
PSKeyVaultKey ImportManagedHsmKey(string managedHsmName, string keyName, Track2Sdk.JsonWebKey webKey);
83+
84+
PSKeyOperationResult ManagedHsmKeyDecrypt(string vaultName, string keyName, string version, byte[] value, string encryptAlgorithm);
85+
86+
PSKeyOperationResult ManagedHsmKeyEncrypt(string vaultName, string keyName, string version, byte[] value, string encryptAlgorithm);
87+
88+
PSKeyOperationResult ManagedHsmUnwrapKey(string vaultName, string keyName, string keyVersion, byte[] value, string wrapAlgorithm);
89+
90+
PSKeyOperationResult ManagedHsmWrapKey(string vaultName, string keyName, string keyVersion, byte[] wrapKey, string wrapAlgorithm);
91+
92+
PSKeyVaultKey UpdateManagedHsmKey(string managedHsmName, string keyName, string keyVersion, PSKeyVaultKeyAttributes keyAttributes);
93+
94+
void PurgeManagedHsmKey(string managedHsmName, string keyName);
95+
96+
PSKeyVaultKey RecoverManagedHsmKey(string managedHsmName, string keyName);
7897

7998
PSKeyVaultKey RestoreManagedHsmKey(string managedHsmName, string inputBlobPath);
8099
#endregion

0 commit comments

Comments
 (0)