Encryption

1    const payload = "hello"
2    var iv = CryptoJS.enc.Utf8.parse("1020304050607080");
3
4    var test = CryptoJS.AES.encrypt(
5        payload,
6        derived_key,
7        {iv: iv, mode: CryptoJS.mode.CBC}
8    ).toString();
9
10    console.log(test)
11from Crypto.Cipher import AES
12from Crypto.Util.Padding import pad,unpad
13
14iv = "1020304050607080"
15
16test_enc = "y+In4kriw0qy4lji6/x14g=="
17enc = base64.b64decode(test_enc)
18
19cipher = AES.new(derived_key, AES.MODE_CBC, iv.encode('utf-8'))
20
21print(base64.b64decode(cipher.decrypt(enc)))
22
23print(unpad(cipher.decrypt(enc),16))
24from cryptography.hazmat.primitives.asymmetric import ec
25from cryptography.hazmat.primitives.kdf.hkdf import HKDF
26from cryptography.hazmat.primitives import hashes
27from cryptography.hazmat.primitives import serialization
28import base64
29
30
31from Crypto.Cipher import AES
32from Crypto.Util.Padding import pad,unpad
33
34
35def deriveKey():
36
37  server_pkcs8 = b'''-----BEGIN PRIVATE KEY-----
38MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDBReGpDVmoVTzxNbJx6
39aL4L9z1EdB91eonAmAw7mKDocLfCJITXZPUAmM46c6AipTmhZANiAAR3t96P0ZhU
40jtW3rHkHpeGu4e+YT+ufMiMeanE/w8p+d9aCslvIbZyBBzeZ/266yqTUUoiYDzqv
41Hb5q8rz7vEgr3DG4XfHYpCqfE2nttQGK3emHKGnvY239AteZkdwMpcs=
42-----END PRIVATE KEY-----'''
43
44  client_x509 = b'''-----BEGIN PUBLIC KEY-----
45MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEm0xeyy3nVnYpOpx/CV/FnlNEdWUZaqtB
46AGf7flKxXEjmlSUjseYzCd566sLpNg56Gw6hcFx+rWTLGR4eDRWfmwlXhyUasuEg
47mb0BQf8XJLBdvadb9eFx2CP1yjBsiy8e
48-----END PUBLIC KEY-----'''
49
50  client_public_key = serialization.load_pem_public_key(client_x509)
51  server_private_key = serialization.load_pem_private_key(server_pkcs8, password=None)
52  shared_secret = server_private_key.exchange(ec.ECDH(), client_public_key)
53  print('Shared secret: ' + base64.b64encode(shared_secret).decode('utf8')) # Shared secret: xbU6oDHMTYj3O71liM5KEJof3/0P4HlHJ28k7qtdqU/36llCizIlOWXtj8v+IngF
54
55  salt_bytes = "12345678".encode('utf-8')
56  info_bytes = "abc".encode('utf-8')
57
58  derived_key = HKDF(
59    algorithm=hashes.SHA256(),
60    length=32,
61    salt=salt_bytes,
62    info=info_bytes,
63  ).derive(shared_secret)
64  print('Derived key:   ' + base64.b64encode(derived_key).decode('utf8'))
65  return derived_key
66
67derived_key = deriveKey()
68iv = "1020304050607080"
69
70test_enc = "y+In4kriw0qy4lji6/x14g=="
71enc = base64.b64decode(test_enc)
72
73cipher = AES.new(derived_key, AES.MODE_CBC, iv.encode('utf-8'))
74
75print(base64.b64decode(cipher.decrypt(enc)))
76
77print(unpad(cipher.decrypt(enc),16))
78const payload = "hello"
79var derived_key = CryptoJS.enc.Base64.parse("LefjQ2pEXmiy/nNZvEJ43i8hJuaAnzbA1Cbn1hOuAgA=")
80var iv = CryptoJS.enc.Utf8.parse("1020304050607080");
81var test = CryptoJS.AES.encrypt(payload, derived_key, {iv: iv, mode: CryptoJS.mode.CBC}).toString();
82document.getElementById("ct").innerHTML = test; // bLdmGA+HLLyFEVtBEuCzVg==

1    const payload = "hello"
2    var iv = CryptoJS.enc.Utf8.parse("1020304050607080");
3
4    var test = CryptoJS.AES.encrypt(
5        payload,
6        derived_key,
7        {iv: iv, mode: CryptoJS.mode.CBC}
8    ).toString();
9
10    console.log(test)
11from Crypto.Cipher import AES
12from Crypto.Util.Padding import pad,unpad
13
14iv = "1020304050607080"
15
16test_enc = "y+In4kriw0qy4lji6/x14g=="
17enc = base64.b64decode(test_enc)
18
19cipher = AES.new(derived_key, AES.MODE_CBC, iv.encode('utf-8'))
20
21print(base64.b64decode(cipher.decrypt(enc)))
22
23print(unpad(cipher.decrypt(enc),16))
24from cryptography.hazmat.primitives.asymmetric import ec
25from cryptography.hazmat.primitives.kdf.hkdf import HKDF
26from cryptography.hazmat.primitives import hashes
27from cryptography.hazmat.primitives import serialization
28import base64
29
30
31from Crypto.Cipher import AES
32from Crypto.Util.Padding import pad,unpad
33
34
35def deriveKey():
36
37  server_pkcs8 = b'''-----BEGIN PRIVATE KEY-----
38MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDBReGpDVmoVTzxNbJx6
39aL4L9z1EdB91eonAmAw7mKDocLfCJITXZPUAmM46c6AipTmhZANiAAR3t96P0ZhU
40jtW3rHkHpeGu4e+YT+ufMiMeanE/w8p+d9aCslvIbZyBBzeZ/266yqTUUoiYDzqv
41Hb5q8rz7vEgr3DG4XfHYpCqfE2nttQGK3emHKGnvY239AteZkdwMpcs=
42-----END PRIVATE KEY-----'''
43
44  client_x509 = b'''-----BEGIN PUBLIC KEY-----
45MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEm0xeyy3nVnYpOpx/CV/FnlNEdWUZaqtB
46AGf7flKxXEjmlSUjseYzCd566sLpNg56Gw6hcFx+rWTLGR4eDRWfmwlXhyUasuEg
47mb0BQf8XJLBdvadb9eFx2CP1yjBsiy8e
48-----END PUBLIC KEY-----'''
49
50  client_public_key = serialization.load_pem_public_key(client_x509)
51  server_private_key = serialization.load_pem_private_key(server_pkcs8, password=None)
52  shared_secret = server_private_key.exchange(ec.ECDH(), client_public_key)
53  print('Shared secret: ' + base64.b64encode(shared_secret).decode('utf8')) # Shared secret: xbU6oDHMTYj3O71liM5KEJof3/0P4HlHJ28k7qtdqU/36llCizIlOWXtj8v+IngF
54
55  salt_bytes = "12345678".encode('utf-8')
56  info_bytes = "abc".encode('utf-8')
57
58  derived_key = HKDF(
59    algorithm=hashes.SHA256(),
60    length=32,
61    salt=salt_bytes,
62    info=info_bytes,
63  ).derive(shared_secret)
64  print('Derived key:   ' + base64.b64encode(derived_key).decode('utf8'))
65  return derived_key
66
67derived_key = deriveKey()
68iv = "1020304050607080"
69
70test_enc = "y+In4kriw0qy4lji6/x14g=="
71enc = base64.b64decode(test_enc)
72
73cipher = AES.new(derived_key, AES.MODE_CBC, iv.encode('utf-8'))
74
75print(base64.b64decode(cipher.decrypt(enc)))
76
77print(unpad(cipher.decrypt(enc),16))
78const payload = "hello"
79var derived_key = CryptoJS.enc.Base64.parse("LefjQ2pEXmiy/nNZvEJ43i8hJuaAnzbA1Cbn1hOuAgA=")
80var iv = CryptoJS.enc.Utf8.parse("1020304050607080");
81var test = CryptoJS.AES.encrypt(payload, derived_key, {iv: iv, mode: CryptoJS.mode.CBC}).toString();
82document.getElementById("ct").innerHTML = test; // bLdmGA+HLLyFEVtBEuCzVg==<script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js"></script>
83<p style="font-family:'Courier New', monospace;" id="ct"></p>

1    const payload = "hello"
2    var iv = CryptoJS.enc.Utf8.parse("1020304050607080");
3
4    var test = CryptoJS.AES.encrypt(
5        payload,
6        derived_key,
7        {iv: iv, mode: CryptoJS.mode.CBC}
8    ).toString();
9
10    console.log(test)
11from Crypto.Cipher import AES
12from Crypto.Util.Padding import pad,unpad
13
14iv = "1020304050607080"
15
16test_enc = "y+In4kriw0qy4lji6/x14g=="
17enc = base64.b64decode(test_enc)
18
19cipher = AES.new(derived_key, AES.MODE_CBC, iv.encode('utf-8'))
20
21print(base64.b64decode(cipher.decrypt(enc)))
22
23print(unpad(cipher.decrypt(enc),16))
24from cryptography.hazmat.primitives.asymmetric import ec
25from cryptography.hazmat.primitives.kdf.hkdf import HKDF
26from cryptography.hazmat.primitives import hashes
27from cryptography.hazmat.primitives import serialization
28import base64
29
30
31from Crypto.Cipher import AES
32from Crypto.Util.Padding import pad,unpad
33
34
35def deriveKey():
36
37  server_pkcs8 = b'''-----BEGIN PRIVATE KEY-----
38MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDBReGpDVmoVTzxNbJx6
39aL4L9z1EdB91eonAmAw7mKDocLfCJITXZPUAmM46c6AipTmhZANiAAR3t96P0ZhU
40jtW3rHkHpeGu4e+YT+ufMiMeanE/w8p+d9aCslvIbZyBBzeZ/266yqTUUoiYDzqv
41Hb5q8rz7vEgr3DG4XfHYpCqfE2nttQGK3emHKGnvY239AteZkdwMpcs=
42-----END PRIVATE KEY-----'''
43
44  client_x509 = b'''-----BEGIN PUBLIC KEY-----
45MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEm0xeyy3nVnYpOpx/CV/FnlNEdWUZaqtB
46AGf7flKxXEjmlSUjseYzCd566sLpNg56Gw6hcFx+rWTLGR4eDRWfmwlXhyUasuEg
47mb0BQf8XJLBdvadb9eFx2CP1yjBsiy8e
48-----END PUBLIC KEY-----'''
49
50  client_public_key = serialization.load_pem_public_key(client_x509)
51  server_private_key = serialization.load_pem_private_key(server_pkcs8, password=None)
52  shared_secret = server_private_key.exchange(ec.ECDH(), client_public_key)
53  print('Shared secret: ' + base64.b64encode(shared_secret).decode('utf8')) # Shared secret: xbU6oDHMTYj3O71liM5KEJof3/0P4HlHJ28k7qtdqU/36llCizIlOWXtj8v+IngF
54
55  salt_bytes = "12345678".encode('utf-8')
56  info_bytes = "abc".encode('utf-8')
57
58  derived_key = HKDF(
59    algorithm=hashes.SHA256(),
60    length=32,
61    salt=salt_bytes,
62    info=info_bytes,
63  ).derive(shared_secret)
64  print('Derived key:   ' + base64.b64encode(derived_key).decode('utf8'))
65  return derived_key
66
67derived_key = deriveKey()
68iv = "1020304050607080"
69
70test_enc = "y+In4kriw0qy4lji6/x14g=="
71enc = base64.b64decode(test_enc)
72
73cipher = AES.new(derived_key, AES.MODE_CBC, iv.encode('utf-8'))
74
75print(base64.b64decode(cipher.decrypt(enc)))
76
77print(unpad(cipher.decrypt(enc),16))
78const payload = "hello"
79var derived_key = CryptoJS.enc.Base64.parse("LefjQ2pEXmiy/nNZvEJ43i8hJuaAnzbA1Cbn1hOuAgA=")
80var iv = CryptoJS.enc.Utf8.parse("1020304050607080");
81var test = CryptoJS.AES.encrypt(payload, derived_key, {iv: iv, mode: CryptoJS.mode.CBC}).toString();
82document.getElementById("ct").innerHTML = test; // bLdmGA+HLLyFEVtBEuCzVg==<script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js"></script>
83<p style="font-family:'Courier New', monospace;" id="ct"></p>from Crypto.Cipher import AES
84from Crypto.Util.Padding import unpad
85import base64
86
87test_enc = "bLdmGA+HLLyFEVtBEuCzVg=="
88enc = base64.b64decode(test_enc)
89derived_key = base64.b64decode("LefjQ2pEXmiy/nNZvEJ43i8hJuaAnzbA1Cbn1hOuAgA=")
90iv = "1020304050607080"
91cipher = AES.new(derived_key, AES.MODE_CBC, iv.encode('utf-8'))
92print(unpad(cipher.decrypt(enc),16)) # b'hello'
93

1-----BEGIN ENCRYPTED PRIVATE KEY-----
2MIIFLTBXBgkqhkiG9w0BBQ0wSjApBgkqhkiG9w0BBQwwHAQILbKY9hPxYSoCAggA
3MAwGCCqGSIb3DQIJBQAwHQYJYIZIAWUDBAEqBBCvaGt2Hmm2NpHpxbLvHKyOBIIE
40IQ7dVrAGXLZl0exYIvyxLAu6zO00jL6b3sb/agTcCFOz8JU6fBanxY0d5aYO4Dn
5mynQG7BoljU470s0zIwW/wk0MmdUFl4nXWBX/4qnG0sZqZ9KZ7I8R/WrBkmpX8C/
64pjdVhu8Ht8dfOYbkbjMBTohDJz8vJ0QwDIXi9yFjjef+QjwrFOl6kAeDJFVMGqc
7s7K/wOnhsL1XxfW9uTulPiZh5YTZKcatMkeGDR7c+cg5I+Mutim92diWuCekhNoa
8uvhUy1M3cbs7Azp1Mhz+V0CDKklI95EvN4u23WhiJPCjAofC/e45/heOP3Dwm7WZ
9zHEY1C/X8PsTl6MEEIF3ZJP+4Vr0corAs1L2FqE6oOng8dFFYmF5eRyBx6bxFd05
10iYbfOH24/b3qtFKPC689kGEd0gWp1dwES35SNNK+cJqVRTjgI0oKhOai3rhbGnmp
11tx4+JqploQgTorj4w9asbtZ/qZA2mYSSR/Q64SHv7LfoUCI9bgx73MqRQBgvI5yS
12b4BoFBnuEgOduZLaGKGjKVW3m5/q8oiDAaspcSLCJMIrdOTYWJB+7mfxX4Xy0vEe
135m2jXpSLQmrfjgpSTpHDKi/3b6OzKOcHjSFBf8IoiHuLc5DVvLECzDUxxaMrTZ71
140YXvEPwl2R9BzEANwwR9ghJvFg1Be/d5W/WA1Efe6cNQNBlmErxD6l+4KDUgGjTr
15Aaksp9SZAv8uQAsg7C57NFHpTA5Hznr5JctL+WlO+Gk0cAV6i4Py3kA6EcfatsnS
16PqP2KbxT+rb2ATMUZqgWc20QvDt6j0CTA1BuVD1PNhnAUFvb2ocyEEXOra22DPPS
17UPu6jirSIyFcjqFjJ9A1FD9L4/UuX2UkDSLqblFlYB1+G55KZp+EKz8SZoN5qXy1
18LyMtnacEP5OtRDrOjopzVNiuV1Uv63M9QVi1hZlVLJEomgjWuvuyEuIwDaY2uryW
19vx+jJEZyySFkb1JwAbrm+p6sCTFnbQ/URKC2cit/FJyKqNim6VQvGL8Sez34qV3z
20D13QJgTZfsy+BaZoaQ6cJTXtJ8cN0IcQciOiDNBKMW66zO6ujS8G+KNviNQypDm6
21h4sOgjMqLaZ4ezPEdNj/gaxV7Y15nVRu0re8dVkaa5t9ft/sh6A+yeTD5tS5hHkf
22NI7uJPTaTXVoz7xq2PAJUTWujMLMZKtmNOzNqYvxWRy3tCOFobBQkMxqEBEwHd+x
23SA+gFcJKJ+aNfCGZJ5fFr8rNlhtOF6uMwOAlfiUlP/pCUDUCKPjZVj4K95yNc8Io
24jSZSPb5tGPe0HqXgc6IAfQarlUZt90oVtzL0OfOfTxe1bEzS2ccNadbx/6vjLBc4
25q5UuUBppl3rXpbuZ7J1Rp3n2byF4APxFdT2LHKq+MYMfWUToau/TCMT4lFIM9tM8
267TuuyUT2PKzf/xlsl4iScw96z9xxGPQrXn7IA2W5iL+0eCLztJdjNRX1FisdfIBL
27PraOVlmF8jHKbFdRZ8Yi8pApbQjvHi24g7dX7u/cq1FH/VE+nJ0O8YVCYVDw13CW
28h0p7yD7BuB0R+0WnR0yvkp30vK4/rtCB+Ob8bH/+HvAZrAU5X8jq/wsQbLkrLHZV
296A6GGfX8+hy5AoaXsH1BHnMyXkaF6Mv29z8JcslDJxX/
30-----END ENCRYPTED PRIVATE KEY-----
31 InputStream privateKeyInputStream = getPrivateKeyInputStream(); // reads the key file from classpath and share as DataStream
32 logger.info("InputStreamExists --> {} ", privateKeyInputStream.available());
33 PEMParser pemParser = new PEMParser(new InputStreamReader(privateKeyInputStream));
34 Object pemObject = pemParser.readObject();
35 if (pemObject instanceof PKCS8EncryptedPrivateKeyInfo) {
36     // Handle the case where the private key is encrypted.
37     PKCS8EncryptedPrivateKeyInfo encryptedPrivateKeyInfo = (PKCS8EncryptedPrivateKeyInfo) pemObject;
38     InputDecryptorProvider pkcs8Prov =
39            new JceOpenSSLPKCS8DecryptorProviderBuilder().build(passphrase.toCharArray());
40     privateKeyInfo = encryptedPrivateKeyInfo.decryptPrivateKeyInfo(pkcs8Prov); // fails here
41}
42
43InputStream resourceAsStream = null;
44    if ("local".equals(privateKeyMode)) {
45      resourceAsStream = this.getClass().getResourceAsStream(privateKeyPath);
46    } else {
47      File keyFile = new File(privateKeyPath);
48      logger.info(
49          "Key file found in {} mode. FileName : {}, Exists : {}",
50          privateKeyMode,
51          keyFile.getName(),
52          keyFile.exists());
53      try {
54        resourceAsStream = new DataInputStream(new FileInputStream(keyFile));
55      } catch (FileNotFoundException e) {
56        e.printStackTrace();
57      }
58org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: failed to construct sequence from byte[]: Extra data detected in stream
59snowflake-report-sync    |      at org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo.decryptPrivateKeyInfo(Unknown Source) ~[bcpkix-jdk15on-1.64.jar!/:1.64.00.0]
60snowflake-report-sync    |      at com.optum.snowflakereportsync.configuration.SnowFlakeConfig.getPrivateKey(SnowFlakeConfig.java:103) ~[classes!/:na]
61snowflake-report-sync    |      at com.optum.snowflakereportsync.configuration.SnowFlakeConfig.getConnectionProperties(SnowFlakeConfig.java:67) ~[classes!/:na]
62FROM adoptopenjdk/openjdk11-openj9:latest
63COPY build/libs/snowflake-report-sync-*.jar snowflake-report-sync.jar
64RUN mkdir /encryption-keys
65COPY encryption-keys/ /encryption-keys/ #keys are picked from docker filesystem when running in container
66EXPOSE 8080
67CMD java -Dcom.sun.management.jmxremote -noverify ${JAVA_OPTS} -jar snowflake-report-sync.jar
68new JceOpenSSLPKCS8DecryptorProviderBuilder()
69    .setProvider(BouncyCastleProvider.PROVIDER_NAME) // add this line
70    .build(passphrase.toCharArray());
71

1-----BEGIN ENCRYPTED PRIVATE KEY-----
2MIIFLTBXBgkqhkiG9w0BBQ0wSjApBgkqhkiG9w0BBQwwHAQILbKY9hPxYSoCAggA
3MAwGCCqGSIb3DQIJBQAwHQYJYIZIAWUDBAEqBBCvaGt2Hmm2NpHpxbLvHKyOBIIE
40IQ7dVrAGXLZl0exYIvyxLAu6zO00jL6b3sb/agTcCFOz8JU6fBanxY0d5aYO4Dn
5mynQG7BoljU470s0zIwW/wk0MmdUFl4nXWBX/4qnG0sZqZ9KZ7I8R/WrBkmpX8C/
64pjdVhu8Ht8dfOYbkbjMBTohDJz8vJ0QwDIXi9yFjjef+QjwrFOl6kAeDJFVMGqc
7s7K/wOnhsL1XxfW9uTulPiZh5YTZKcatMkeGDR7c+cg5I+Mutim92diWuCekhNoa
8uvhUy1M3cbs7Azp1Mhz+V0CDKklI95EvN4u23WhiJPCjAofC/e45/heOP3Dwm7WZ
9zHEY1C/X8PsTl6MEEIF3ZJP+4Vr0corAs1L2FqE6oOng8dFFYmF5eRyBx6bxFd05
10iYbfOH24/b3qtFKPC689kGEd0gWp1dwES35SNNK+cJqVRTjgI0oKhOai3rhbGnmp
11tx4+JqploQgTorj4w9asbtZ/qZA2mYSSR/Q64SHv7LfoUCI9bgx73MqRQBgvI5yS
12b4BoFBnuEgOduZLaGKGjKVW3m5/q8oiDAaspcSLCJMIrdOTYWJB+7mfxX4Xy0vEe
135m2jXpSLQmrfjgpSTpHDKi/3b6OzKOcHjSFBf8IoiHuLc5DVvLECzDUxxaMrTZ71
140YXvEPwl2R9BzEANwwR9ghJvFg1Be/d5W/WA1Efe6cNQNBlmErxD6l+4KDUgGjTr
15Aaksp9SZAv8uQAsg7C57NFHpTA5Hznr5JctL+WlO+Gk0cAV6i4Py3kA6EcfatsnS
16PqP2KbxT+rb2ATMUZqgWc20QvDt6j0CTA1BuVD1PNhnAUFvb2ocyEEXOra22DPPS
17UPu6jirSIyFcjqFjJ9A1FD9L4/UuX2UkDSLqblFlYB1+G55KZp+EKz8SZoN5qXy1
18LyMtnacEP5OtRDrOjopzVNiuV1Uv63M9QVi1hZlVLJEomgjWuvuyEuIwDaY2uryW
19vx+jJEZyySFkb1JwAbrm+p6sCTFnbQ/URKC2cit/FJyKqNim6VQvGL8Sez34qV3z
20D13QJgTZfsy+BaZoaQ6cJTXtJ8cN0IcQciOiDNBKMW66zO6ujS8G+KNviNQypDm6
21h4sOgjMqLaZ4ezPEdNj/gaxV7Y15nVRu0re8dVkaa5t9ft/sh6A+yeTD5tS5hHkf
22NI7uJPTaTXVoz7xq2PAJUTWujMLMZKtmNOzNqYvxWRy3tCOFobBQkMxqEBEwHd+x
23SA+gFcJKJ+aNfCGZJ5fFr8rNlhtOF6uMwOAlfiUlP/pCUDUCKPjZVj4K95yNc8Io
24jSZSPb5tGPe0HqXgc6IAfQarlUZt90oVtzL0OfOfTxe1bEzS2ccNadbx/6vjLBc4
25q5UuUBppl3rXpbuZ7J1Rp3n2byF4APxFdT2LHKq+MYMfWUToau/TCMT4lFIM9tM8
267TuuyUT2PKzf/xlsl4iScw96z9xxGPQrXn7IA2W5iL+0eCLztJdjNRX1FisdfIBL
27PraOVlmF8jHKbFdRZ8Yi8pApbQjvHi24g7dX7u/cq1FH/VE+nJ0O8YVCYVDw13CW
28h0p7yD7BuB0R+0WnR0yvkp30vK4/rtCB+Ob8bH/+HvAZrAU5X8jq/wsQbLkrLHZV
296A6GGfX8+hy5AoaXsH1BHnMyXkaF6Mv29z8JcslDJxX/
30-----END ENCRYPTED PRIVATE KEY-----
31 InputStream privateKeyInputStream = getPrivateKeyInputStream(); // reads the key file from classpath and share as DataStream
32 logger.info("InputStreamExists --> {} ", privateKeyInputStream.available());
33 PEMParser pemParser = new PEMParser(new InputStreamReader(privateKeyInputStream));
34 Object pemObject = pemParser.readObject();
35 if (pemObject instanceof PKCS8EncryptedPrivateKeyInfo) {
36     // Handle the case where the private key is encrypted.
37     PKCS8EncryptedPrivateKeyInfo encryptedPrivateKeyInfo = (PKCS8EncryptedPrivateKeyInfo) pemObject;
38     InputDecryptorProvider pkcs8Prov =
39            new JceOpenSSLPKCS8DecryptorProviderBuilder().build(passphrase.toCharArray());
40     privateKeyInfo = encryptedPrivateKeyInfo.decryptPrivateKeyInfo(pkcs8Prov); // fails here
41}
42
43InputStream resourceAsStream = null;
44    if ("local".equals(privateKeyMode)) {
45      resourceAsStream = this.getClass().getResourceAsStream(privateKeyPath);
46    } else {
47      File keyFile = new File(privateKeyPath);
48      logger.info(
49          "Key file found in {} mode. FileName : {}, Exists : {}",
50          privateKeyMode,
51          keyFile.getName(),
52          keyFile.exists());
53      try {
54        resourceAsStream = new DataInputStream(new FileInputStream(keyFile));
55      } catch (FileNotFoundException e) {
56        e.printStackTrace();
57      }
58org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: failed to construct sequence from byte[]: Extra data detected in stream
59snowflake-report-sync    |      at org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo.decryptPrivateKeyInfo(Unknown Source) ~[bcpkix-jdk15on-1.64.jar!/:1.64.00.0]
60snowflake-report-sync    |      at com.optum.snowflakereportsync.configuration.SnowFlakeConfig.getPrivateKey(SnowFlakeConfig.java:103) ~[classes!/:na]
61snowflake-report-sync    |      at com.optum.snowflakereportsync.configuration.SnowFlakeConfig.getConnectionProperties(SnowFlakeConfig.java:67) ~[classes!/:na]
62FROM adoptopenjdk/openjdk11-openj9:latest
63COPY build/libs/snowflake-report-sync-*.jar snowflake-report-sync.jar
64RUN mkdir /encryption-keys
65COPY encryption-keys/ /encryption-keys/ #keys are picked from docker filesystem when running in container
66EXPOSE 8080
67CMD java -Dcom.sun.management.jmxremote -noverify ${JAVA_OPTS} -jar snowflake-report-sync.jar
68new JceOpenSSLPKCS8DecryptorProviderBuilder()
69    .setProvider(BouncyCastleProvider.PROVIDER_NAME) // add this line
70    .build(passphrase.toCharArray());
71FROM adoptopenjdk:11-jre-hotspot
72

1func aesEncrypt(stringToEncrypt: String, key: Array<UInt8>, iv: Array<UInt8>) throws -> String {
2    let data = stringToEncrypt.data(using: String.Encoding.utf8)
3    let encrypted = try AES(key: key, blockMode: CFB(iv: iv), padding: .noPadding).encrypt((data?.bytes)!)
4    return encrypted.toHexString()
5}
6
7let ivString = "4198816658388141"
8let keyString = "9004786896524916"
9
10let key = [UInt8](keyString.utf8)
11let iv = [UInt8](ivString.utf8)
12
13let encryptedSsid = try! aesEncrypt(stringToEncrypt: ssid!, key: key, iv: iv)
14KEY = b'9004786896524916'
15IV = b'4198816658388141'
16MODE = AES.MODE_CFB
17
18def decrypt(key, iv, encrypted_text):
19    logger.info(f"Encrypted: {encrypted_text}")
20    aes = AES.new(key, MODE, iv, segment_size=128)
21    encrypted_text_bytes = binascii.a2b_hex(encrypted_text)
22    decrypted_text = aes.decrypt(encrypted_text_bytes).decode("utf-8")
23    logger.info(f"Decrypted: {decrypted_text}")
24    return decrypted_text
25KEY = b'9004786896524916'
26IV = b'4198816658388141'
27MODE = AES.MODE_CFB
28
29def encrypt(key, decrypted_text):
30    # Create cipher object and encrypt the data
31    logger.info(f"Decrypted: {decrypted_text}")
32    cipher = AES.new(key, MODE, segment_size=128)  # Create a AES cipher object with the key using the mode CBC
33    #encrypted_text = cipher.encrypt(pad(decrypted_text, AES.block_size))  # Pad the input data and then encrypt
34    encrypted_text = cipher.encrypt(decrypted_text)  # Pad the input data and then encrypt
35    logger.info(f"Encrypted: {encrypted_text}")
36    return encrypted_text
37    ...
38    encrypt(KEY, returnString('utf-8'))
39func aesDecrypt(stringToDecrypt: String, key: Array<UInt8>, iv: Array<UInt8>) throws -> String {
40    let data = stringToDecrypt.data(using: String.Encoding.utf8)
41    let decrypted = try AES(key: key, blockMode: CFB(iv: iv), padding: .noPadding).decrypt((data?.bytes)!)
42    return decrypted.toHexString()
43}
44let ivString = "4198816658388141"
45let keyString = "9004786896524916"
46
47let key = [UInt8](keyString.utf8)
48let iv = [UInt8](ivString.utf8)
49var message = try! aesDecrypt(stringToDecrypt: charString, key: key, iv: iv)
50from Crypto.Cipher import AES
51import binascii
52
53def encrypt(key, iv, plaintext):
54    cipher = AES.new(key, MODE, iv, segment_size=128)  
55    plaintext_bytes = plaintext.encode("utf-8")
56    ciphertext = cipher.encrypt(plaintext_bytes)
57    ciphertext_hex = binascii.b2a_hex(ciphertext)  
58    return ciphertext_hex
59

1func aesEncrypt(stringToEncrypt: String, key: Array<UInt8>, iv: Array<UInt8>) throws -> String {
2    let data = stringToEncrypt.data(using: String.Encoding.utf8)
3    let encrypted = try AES(key: key, blockMode: CFB(iv: iv), padding: .noPadding).encrypt((data?.bytes)!)
4    return encrypted.toHexString()
5}
6
7let ivString = "4198816658388141"
8let keyString = "9004786896524916"
9
10let key = [UInt8](keyString.utf8)
11let iv = [UInt8](ivString.utf8)
12
13let encryptedSsid = try! aesEncrypt(stringToEncrypt: ssid!, key: key, iv: iv)
14KEY = b'9004786896524916'
15IV = b'4198816658388141'
16MODE = AES.MODE_CFB
17
18def decrypt(key, iv, encrypted_text):
19    logger.info(f"Encrypted: {encrypted_text}")
20    aes = AES.new(key, MODE, iv, segment_size=128)
21    encrypted_text_bytes = binascii.a2b_hex(encrypted_text)
22    decrypted_text = aes.decrypt(encrypted_text_bytes).decode("utf-8")
23    logger.info(f"Decrypted: {decrypted_text}")
24    return decrypted_text
25KEY = b'9004786896524916'
26IV = b'4198816658388141'
27MODE = AES.MODE_CFB
28
29def encrypt(key, decrypted_text):
30    # Create cipher object and encrypt the data
31    logger.info(f"Decrypted: {decrypted_text}")
32    cipher = AES.new(key, MODE, segment_size=128)  # Create a AES cipher object with the key using the mode CBC
33    #encrypted_text = cipher.encrypt(pad(decrypted_text, AES.block_size))  # Pad the input data and then encrypt
34    encrypted_text = cipher.encrypt(decrypted_text)  # Pad the input data and then encrypt
35    logger.info(f"Encrypted: {encrypted_text}")
36    return encrypted_text
37    ...
38    encrypt(KEY, returnString('utf-8'))
39func aesDecrypt(stringToDecrypt: String, key: Array<UInt8>, iv: Array<UInt8>) throws -> String {
40    let data = stringToDecrypt.data(using: String.Encoding.utf8)
41    let decrypted = try AES(key: key, blockMode: CFB(iv: iv), padding: .noPadding).decrypt((data?.bytes)!)
42    return decrypted.toHexString()
43}
44let ivString = "4198816658388141"
45let keyString = "9004786896524916"
46
47let key = [UInt8](keyString.utf8)
48let iv = [UInt8](ivString.utf8)
49var message = try! aesDecrypt(stringToDecrypt: charString, key: key, iv: iv)
50from Crypto.Cipher import AES
51import binascii
52
53def encrypt(key, iv, plaintext):
54    cipher = AES.new(key, MODE, iv, segment_size=128)  
55    plaintext_bytes = plaintext.encode("utf-8")
56    ciphertext = cipher.encrypt(plaintext_bytes)
57    ciphertext_hex = binascii.b2a_hex(ciphertext)  
58    return ciphertext_hex
59func aesDecrypt(stringToDecrypt: String, key: Array<UInt8>, iv: Array<UInt8>) throws -> String {
60    let data = Array<UInt8>(hex: stringToDecrypt)
61    let decrypted = try AES(key: key, blockMode: CFB(iv: iv), padding: .noPadding).decrypt(data)
62    return String(bytes: decrypted, encoding: .utf8)!
63}
64

1EncryptionAlgorithmSpecType = Literal["RSAES_OAEP_SHA_1", "RSAES_OAEP_SHA_256", "SYMMETRIC_DEFAULT"]
2import boto3
3from mypy_boto3_kms.literals import EncryptionAlgorithmSpecType
4
5def getEncryptionAlgorithmLiteral(algorithm: str) -> EncryptionAlgorithmSpecType:
6  result: EncryptionAlgorithmSpecType
7  if algorithm == "RSAES_OAEP_SHA_1":
8    result = "RSAES_OAEP_SHA_1"
9  elif algorithm == "RSAES_OAEP_SHA_256":
10    result = "RSAES_OAEP_SHA_256"
11  elif algorithm == "SYMMETRIC_DEFAULT":
12    result = "SYMMETRIC_DEFAULT"
13  else:
14    raise Exception(f"Unexpected algorithm '{algorithm}'. It must be one of {EncryptionAlgorithmSpecType}")
15  return result
16
17def main(binaryEncData: bytes, keyId: str, algorithm: str):
18  kms = boto3.client('kms')
19  kmsResult = kms.decrypt(CiphertextBlob=binaryEncData, 
20                          KeyId=keyId,
21                          EncryptionAlgorithm=getEncryptionAlgorithmLiteral(algorithm))
22
23from typing import cast
24# Import below from `typing` in Python 3.8+
25from typing_extensions import Literal, get_args
26
27
28# noinspection SpellCheckingInspection
29EncryptionAlgorithmSpecType = Literal["RSAES_OAEP_SHA_1",
30                                      "RSAES_OAEP_SHA_256",
31                                      "SYMMETRIC_DEFAULT"]
32
33_valid_algorithms = get_args(EncryptionAlgorithmSpecType)
34print(_valid_algorithms)
35
36
37def get_encryption_algorithm_literal(
38        algorithm: str) -> EncryptionAlgorithmSpecType:
39
40    if algorithm not in _valid_algorithms:
41        valid_values = str(list(_valid_algorithms)).replace("'", "")
42        raise Exception(f"Unexpected algorithm '{algorithm}'. "
43                        f"It must be one of {valid_values}")
44
45    # cast string to literal, so static type checkers such as 'mypy'
46    # don't complain.
47    return cast(EncryptionAlgorithmSpecType, algorithm)
48
49
50def main():
51    # noinspection SpellCheckingInspection
52    string = 'RSAES_OAEP_SHA_256'
53
54    my_algorithm = get_encryption_algorithm_literal(string)
55    print(type(my_algorithm), my_algorithm)
56
57
58if __name__ == '__main__':
59    main()
60

1EncryptionAlgorithmSpecType = Literal["RSAES_OAEP_SHA_1", "RSAES_OAEP_SHA_256", "SYMMETRIC_DEFAULT"]
2import boto3
3from mypy_boto3_kms.literals import EncryptionAlgorithmSpecType
4
5def getEncryptionAlgorithmLiteral(algorithm: str) -> EncryptionAlgorithmSpecType:
6  result: EncryptionAlgorithmSpecType
7  if algorithm == "RSAES_OAEP_SHA_1":
8    result = "RSAES_OAEP_SHA_1"
9  elif algorithm == "RSAES_OAEP_SHA_256":
10    result = "RSAES_OAEP_SHA_256"
11  elif algorithm == "SYMMETRIC_DEFAULT":
12    result = "SYMMETRIC_DEFAULT"
13  else:
14    raise Exception(f"Unexpected algorithm '{algorithm}'. It must be one of {EncryptionAlgorithmSpecType}")
15  return result
16
17def main(binaryEncData: bytes, keyId: str, algorithm: str):
18  kms = boto3.client('kms')
19  kmsResult = kms.decrypt(CiphertextBlob=binaryEncData, 
20                          KeyId=keyId,
21                          EncryptionAlgorithm=getEncryptionAlgorithmLiteral(algorithm))
22
23from typing import cast
24# Import below from `typing` in Python 3.8+
25from typing_extensions import Literal, get_args
26
27
28# noinspection SpellCheckingInspection
29EncryptionAlgorithmSpecType = Literal["RSAES_OAEP_SHA_1",
30                                      "RSAES_OAEP_SHA_256",
31                                      "SYMMETRIC_DEFAULT"]
32
33_valid_algorithms = get_args(EncryptionAlgorithmSpecType)
34print(_valid_algorithms)
35
36
37def get_encryption_algorithm_literal(
38        algorithm: str) -> EncryptionAlgorithmSpecType:
39
40    if algorithm not in _valid_algorithms:
41        valid_values = str(list(_valid_algorithms)).replace("'", "")
42        raise Exception(f"Unexpected algorithm '{algorithm}'. "
43                        f"It must be one of {valid_values}")
44
45    # cast string to literal, so static type checkers such as 'mypy'
46    # don't complain.
47    return cast(EncryptionAlgorithmSpecType, algorithm)
48
49
50def main():
51    # noinspection SpellCheckingInspection
52    string = 'RSAES_OAEP_SHA_256'
53
54    my_algorithm = get_encryption_algorithm_literal(string)
55    print(type(my_algorithm), my_algorithm)
56
57
58if __name__ == '__main__':
59    main()
60('RSAES_OAEP_SHA_1', 'RSAES_OAEP_SHA_256', 'SYMMETRIC_DEFAULT')
61<class 'str'> RSAES_OAEP_SHA_256
62

1EncryptionAlgorithmSpecType = Literal["RSAES_OAEP_SHA_1", "RSAES_OAEP_SHA_256", "SYMMETRIC_DEFAULT"]
2import boto3
3from mypy_boto3_kms.literals import EncryptionAlgorithmSpecType
4
5def getEncryptionAlgorithmLiteral(algorithm: str) -> EncryptionAlgorithmSpecType:
6  result: EncryptionAlgorithmSpecType
7  if algorithm == "RSAES_OAEP_SHA_1":
8    result = "RSAES_OAEP_SHA_1"
9  elif algorithm == "RSAES_OAEP_SHA_256":
10    result = "RSAES_OAEP_SHA_256"
11  elif algorithm == "SYMMETRIC_DEFAULT":
12    result = "SYMMETRIC_DEFAULT"
13  else:
14    raise Exception(f"Unexpected algorithm '{algorithm}'. It must be one of {EncryptionAlgorithmSpecType}")
15  return result
16
17def main(binaryEncData: bytes, keyId: str, algorithm: str):
18  kms = boto3.client('kms')
19  kmsResult = kms.decrypt(CiphertextBlob=binaryEncData, 
20                          KeyId=keyId,
21                          EncryptionAlgorithm=getEncryptionAlgorithmLiteral(algorithm))
22
23from typing import cast
24# Import below from `typing` in Python 3.8+
25from typing_extensions import Literal, get_args
26
27
28# noinspection SpellCheckingInspection
29EncryptionAlgorithmSpecType = Literal["RSAES_OAEP_SHA_1",
30                                      "RSAES_OAEP_SHA_256",
31                                      "SYMMETRIC_DEFAULT"]
32
33_valid_algorithms = get_args(EncryptionAlgorithmSpecType)
34print(_valid_algorithms)
35
36
37def get_encryption_algorithm_literal(
38        algorithm: str) -> EncryptionAlgorithmSpecType:
39
40    if algorithm not in _valid_algorithms:
41        valid_values = str(list(_valid_algorithms)).replace("'", "")
42        raise Exception(f"Unexpected algorithm '{algorithm}'. "
43                        f"It must be one of {valid_values}")
44
45    # cast string to literal, so static type checkers such as 'mypy'
46    # don't complain.
47    return cast(EncryptionAlgorithmSpecType, algorithm)
48
49
50def main():
51    # noinspection SpellCheckingInspection
52    string = 'RSAES_OAEP_SHA_256'
53
54    my_algorithm = get_encryption_algorithm_literal(string)
55    print(type(my_algorithm), my_algorithm)
56
57
58if __name__ == '__main__':
59    main()
60('RSAES_OAEP_SHA_1', 'RSAES_OAEP_SHA_256', 'SYMMETRIC_DEFAULT')
61<class 'str'> RSAES_OAEP_SHA_256
62Traceback (most recent call last):
63  ...
64    raise Exception(...)
65Exception: Unexpected algorithm 'RSAES_OAEP_SHA_2567'. It must be one of [RSAES_OAEP_SHA_1, RSAES_OAEP_SHA_256, SYMMETRIC_DEFAULT]
66

1const crypto = require('crypto');
2
3const pass = 'some,password:)with>spec(chars*'
4const cipher1 = crypto.createCipher('aes-256-cbc', pass)
5const c1 = cipher1.update(input, 'utf8', 'hex') + cipher1.final('hex')
6const CryptoJS = require('crypto-js');
7
8const pass = 'some,password:)with>spec(chars*'
9const cipher2 = CryptoJS.AES.encrypt(input, pass, {
10    mode: CryptoJS.mode.CBC,
11});
12const c2 = cipher2.ciphertext.toString(CryptoJS.enc.Hex);
13var input = "The quick brown fox jumps over the lazy dog";
14var pass = 'some,password:)with>spec(chars*'
15
16var keySize = 32/4;
17var ivSize = 16/4;
18var kdf = CryptoJS.algo.EvpKDF.create({ keySize: keySize + ivSize, hasher: CryptoJS.algo.MD5 }).compute(pass, ''); // no salt!
19var key = CryptoJS.lib.WordArray.create(kdf.words.slice(0, keySize), keySize * 4);
20var iv = CryptoJS.lib.WordArray.create(kdf.words.slice(keySize), ivSize * 4);
21var ciphertextCP = CryptoJS.AES.encrypt(input, key, {iv: iv}); // default: CBC, PKCS#7 padding
22var ciphertext = ciphertextCP.ciphertext.toString(CryptoJS.enc.Hex);
23document.getElementById("ct").innerHTML = ciphertext; // d98cf2d285bf0c1d796226190bf54d9c5540300ee1c6f35618f8bb3564b5053920ec958d31b41bbe4e4880e23543d709

1const crypto = require('crypto');
2
3const pass = 'some,password:)with>spec(chars*'
4const cipher1 = crypto.createCipher('aes-256-cbc', pass)
5const c1 = cipher1.update(input, 'utf8', 'hex') + cipher1.final('hex')
6const CryptoJS = require('crypto-js');
7
8const pass = 'some,password:)with>spec(chars*'
9const cipher2 = CryptoJS.AES.encrypt(input, pass, {
10    mode: CryptoJS.mode.CBC,
11});
12const c2 = cipher2.ciphertext.toString(CryptoJS.enc.Hex);
13var input = "The quick brown fox jumps over the lazy dog";
14var pass = 'some,password:)with>spec(chars*'
15
16var keySize = 32/4;
17var ivSize = 16/4;
18var kdf = CryptoJS.algo.EvpKDF.create({ keySize: keySize + ivSize, hasher: CryptoJS.algo.MD5 }).compute(pass, ''); // no salt!
19var key = CryptoJS.lib.WordArray.create(kdf.words.slice(0, keySize), keySize * 4);
20var iv = CryptoJS.lib.WordArray.create(kdf.words.slice(keySize), ivSize * 4);
21var ciphertextCP = CryptoJS.AES.encrypt(input, key, {iv: iv}); // default: CBC, PKCS#7 padding
22var ciphertext = ciphertextCP.ciphertext.toString(CryptoJS.enc.Hex);
23document.getElementById("ct").innerHTML = ciphertext; // d98cf2d285bf0c1d796226190bf54d9c5540300ee1c6f35618f8bb3564b5053920ec958d31b41bbe4e4880e23543d709<script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js"></script>
24<p style="font-family:'Courier New', monospace;" id="ct"></p>

1public static class StringCipher
2{
3    // This constant is used to determine the keysize of the encryption algorithm in bits.
4    // We divide this by 8 within the code below to get the equivalent number of bytes.
5    private const int Keysize = 128;
6
7    // This constant determines the number of iterations for the password bytes generation function.
8    private const int DerivationIterations = 1000;
9
10    public static string Encrypt(string plainText, string passPhrase)
11    {
12        // Salt and IV is randomly generated each time, but is preprended to encrypted cipher text
13        // so that the same Salt and IV values can be used when decrypting.  
14        var saltStringBytes = Generate128BitsOfRandomEntropy();
15        var ivStringBytes = Generate128BitsOfRandomEntropy();
16        var plainTextBytes = Encoding.UTF8.GetBytes(plainText);
17        using (var password = new Rfc2898DeriveBytes(passPhrase, saltStringBytes, DerivationIterations))
18        {
19            var keyBytes = password.GetBytes(Keysize / 8);
20            using (var symmetricKey = Aes.Create())
21            {
22                symmetricKey.BlockSize = 128;
23                symmetricKey.Mode = CipherMode.CBC;
24                symmetricKey.Padding = PaddingMode.PKCS7;
25                using (var encryptor = symmetricKey.CreateEncryptor(keyBytes, ivStringBytes))
26                {
27                    using (var memoryStream = new MemoryStream())
28                    {
29                        using (var cryptoStream = new CryptoStream(memoryStream, encryptor, CryptoStreamMode.Write))
30                        {
31                            cryptoStream.Write(plainTextBytes, 0, plainTextBytes.Length);
32                            cryptoStream.FlushFinalBlock();
33                            // Create the final bytes as a concatenation of the random salt bytes, the random iv bytes and the cipher bytes.
34                            var cipherTextBytes = saltStringBytes;
35                            cipherTextBytes = cipherTextBytes.Concat(ivStringBytes).ToArray();
36                            cipherTextBytes = cipherTextBytes.Concat(memoryStream.ToArray()).ToArray();
37                            memoryStream.Close();
38                            cryptoStream.Close();
39                            return Convert.ToBase64String(cipherTextBytes);
40                        }
41                    }
42                }
43            }
44        }
45    }
46
47    public static string Decrypt(string cipherText, string passPhrase)
48    {
49        // Get the complete stream of bytes that represent:
50        // [32 bytes of Salt] + [16 bytes of IV] + [n bytes of CipherText]
51        var cipherTextBytesWithSaltAndIv = Convert.FromBase64String(cipherText);
52        // Get the saltbytes by extracting the first 16 bytes from the supplied cipherText bytes.
53        var saltStringBytes = cipherTextBytesWithSaltAndIv.Take(Keysize / 8).ToArray();
54        // Get the IV bytes by extracting the next 16 bytes from the supplied cipherText bytes.
55        var ivStringBytes = cipherTextBytesWithSaltAndIv.Skip(Keysize / 8).Take(Keysize / 8).ToArray();
56        // Get the actual cipher text bytes by removing the first 64 bytes from the cipherText string.
57        var cipherTextBytes = cipherTextBytesWithSaltAndIv.Skip((Keysize / 8) * 2).Take(cipherTextBytesWithSaltAndIv.Length - ((Keysize / 8) * 2)).ToArray();
58
59        using (var password = new Rfc2898DeriveBytes(passPhrase, saltStringBytes, DerivationIterations))
60        {
61            var keyBytes = password.GetBytes(Keysize / 8);
62            using (var symmetricKey = Aes.Create())
63            {
64                symmetricKey.BlockSize = 128;
65                symmetricKey.Mode = CipherMode.CBC;
66                symmetricKey.Padding = PaddingMode.PKCS7;
67                using (var decryptor = symmetricKey.CreateDecryptor(keyBytes, ivStringBytes))
68                {
69                    using (var memoryStream = new MemoryStream(cipherTextBytes))
70                    {
71                        using (var cryptoStream = new CryptoStream(memoryStream, decryptor, CryptoStreamMode.Read))
72                        {
73                            var plainTextBytes = new byte[cipherTextBytes.Length];
74                            var decryptedByteCount = cryptoStream.Read(plainTextBytes, 0, plainTextBytes.Length);
75                            memoryStream.Close();
76                            cryptoStream.Close();
77                            return Encoding.UTF8.GetString(plainTextBytes, 0, decryptedByteCount);
78                        }
79                    }
80                }
81            }
82        }
83    }
84
85    private static byte[] Generate128BitsOfRandomEntropy()
86    {
87        var randomBytes = new byte[16]; // 16 Bytes will give us 128 bits.
88        using (var rngCsp = RandomNumberGenerator.Create())
89        {
90            // Fill the array with cryptographically secure random bytes.
91            rngCsp.GetBytes(randomBytes);
92        }
93        return randomBytes;
94    }
95}
96var input = "12345678901234567890";
97var inputLength = input.Length;
98var inputBytes = Encoding.UTF8.GetBytes(input);
99
100var encrypted = StringCipher.Encrypt(input, "nzv86ri4H2qYHqc&m6rL");
101
102var output = StringCipher.Decrypt(encrypted, "nzv86ri4H2qYHqc&m6rL");
103var outputLength = output.Length;
104var outputBytes = Encoding.UTF8.GetBytes(output);
105
106var lengthDiff = inputLength - outputLength;
107using (var cryptoStream = new CryptoStream(memoryStream, decryptor, CryptoStreamMode.Read))
108{
109    var plainTextBytes = new byte[cipherTextBytes.Length];
110    var decryptedByteCount = cryptoStream.Read(plainTextBytes, 0, plainTextBytes.Length);
111    memoryStream.Close();
112    cryptoStream.Close();
113    return Encoding.UTF8.GetString(plainTextBytes, 0, decryptedByteCount);
114}
115

1public static class StringCipher
2{
3    // This constant is used to determine the keysize of the encryption algorithm in bits.
4    // We divide this by 8 within the code below to get the equivalent number of bytes.
5    private const int Keysize = 128;
6
7    // This constant determines the number of iterations for the password bytes generation function.
8    private const int DerivationIterations = 1000;
9
10    public static string Encrypt(string plainText, string passPhrase)
11    {
12        // Salt and IV is randomly generated each time, but is preprended to encrypted cipher text
13        // so that the same Salt and IV values can be used when decrypting.  
14        var saltStringBytes = Generate128BitsOfRandomEntropy();
15        var ivStringBytes = Generate128BitsOfRandomEntropy();
16        var plainTextBytes = Encoding.UTF8.GetBytes(plainText);
17        using (var password = new Rfc2898DeriveBytes(passPhrase, saltStringBytes, DerivationIterations))
18        {
19            var keyBytes = password.GetBytes(Keysize / 8);
20            using (var symmetricKey = Aes.Create())
21            {
22                symmetricKey.BlockSize = 128;
23                symmetricKey.Mode = CipherMode.CBC;
24                symmetricKey.Padding = PaddingMode.PKCS7;
25                using (var encryptor = symmetricKey.CreateEncryptor(keyBytes, ivStringBytes))
26                {
27                    using (var memoryStream = new MemoryStream())
28                    {
29                        using (var cryptoStream = new CryptoStream(memoryStream, encryptor, CryptoStreamMode.Write))
30                        {
31                            cryptoStream.Write(plainTextBytes, 0, plainTextBytes.Length);
32                            cryptoStream.FlushFinalBlock();
33                            // Create the final bytes as a concatenation of the random salt bytes, the random iv bytes and the cipher bytes.
34                            var cipherTextBytes = saltStringBytes;
35                            cipherTextBytes = cipherTextBytes.Concat(ivStringBytes).ToArray();
36                            cipherTextBytes = cipherTextBytes.Concat(memoryStream.ToArray()).ToArray();
37                            memoryStream.Close();
38                            cryptoStream.Close();
39                            return Convert.ToBase64String(cipherTextBytes);
40                        }
41                    }
42                }
43            }
44        }
45    }
46
47    public static string Decrypt(string cipherText, string passPhrase)
48    {
49        // Get the complete stream of bytes that represent:
50        // [32 bytes of Salt] + [16 bytes of IV] + [n bytes of CipherText]
51        var cipherTextBytesWithSaltAndIv = Convert.FromBase64String(cipherText);
52        // Get the saltbytes by extracting the first 16 bytes from the supplied cipherText bytes.
53        var saltStringBytes = cipherTextBytesWithSaltAndIv.Take(Keysize / 8).ToArray();
54        // Get the IV bytes by extracting the next 16 bytes from the supplied cipherText bytes.
55        var ivStringBytes = cipherTextBytesWithSaltAndIv.Skip(Keysize / 8).Take(Keysize / 8).ToArray();
56        // Get the actual cipher text bytes by removing the first 64 bytes from the cipherText string.
57        var cipherTextBytes = cipherTextBytesWithSaltAndIv.Skip((Keysize / 8) * 2).Take(cipherTextBytesWithSaltAndIv.Length - ((Keysize / 8) * 2)).ToArray();
58
59        using (var password = new Rfc2898DeriveBytes(passPhrase, saltStringBytes, DerivationIterations))
60        {
61            var keyBytes = password.GetBytes(Keysize / 8);
62            using (var symmetricKey = Aes.Create())
63            {
64                symmetricKey.BlockSize = 128;
65                symmetricKey.Mode = CipherMode.CBC;
66                symmetricKey.Padding = PaddingMode.PKCS7;
67                using (var decryptor = symmetricKey.CreateDecryptor(keyBytes, ivStringBytes))
68                {
69                    using (var memoryStream = new MemoryStream(cipherTextBytes))
70                    {
71                        using (var cryptoStream = new CryptoStream(memoryStream, decryptor, CryptoStreamMode.Read))
72                        {
73                            var plainTextBytes = new byte[cipherTextBytes.Length];
74                            var decryptedByteCount = cryptoStream.Read(plainTextBytes, 0, plainTextBytes.Length);
75                            memoryStream.Close();
76                            cryptoStream.Close();
77                            return Encoding.UTF8.GetString(plainTextBytes, 0, decryptedByteCount);
78                        }
79                    }
80                }
81            }
82        }
83    }
84
85    private static byte[] Generate128BitsOfRandomEntropy()
86    {
87        var randomBytes = new byte[16]; // 16 Bytes will give us 128 bits.
88        using (var rngCsp = RandomNumberGenerator.Create())
89        {
90            // Fill the array with cryptographically secure random bytes.
91            rngCsp.GetBytes(randomBytes);
92        }
93        return randomBytes;
94    }
95}
96var input = "12345678901234567890";
97var inputLength = input.Length;
98var inputBytes = Encoding.UTF8.GetBytes(input);
99
100var encrypted = StringCipher.Encrypt(input, "nzv86ri4H2qYHqc&m6rL");
101
102var output = StringCipher.Decrypt(encrypted, "nzv86ri4H2qYHqc&m6rL");
103var outputLength = output.Length;
104var outputBytes = Encoding.UTF8.GetBytes(output);
105
106var lengthDiff = inputLength - outputLength;
107using (var cryptoStream = new CryptoStream(memoryStream, decryptor, CryptoStreamMode.Read))
108{
109    var plainTextBytes = new byte[cipherTextBytes.Length];
110    var decryptedByteCount = cryptoStream.Read(plainTextBytes, 0, plainTextBytes.Length);
111    memoryStream.Close();
112    cryptoStream.Close();
113    return Encoding.UTF8.GetString(plainTextBytes, 0, decryptedByteCount);
114}
115using (var plainTextStream = new MemoryStream())
116{
117    cryptoStream.CopyTo(plainTextStream);
118    var plainTextBytes = plainTextStream.ToArray();
119    return Encoding.UTF8.GetString(plainTextBytes, 0, plainTextBytes.Length);
120} 
121

1public static class StringCipher
2{
3    // This constant is used to determine the keysize of the encryption algorithm in bits.
4    // We divide this by 8 within the code below to get the equivalent number of bytes.
5    private const int Keysize = 128;
6
7    // This constant determines the number of iterations for the password bytes generation function.
8    private const int DerivationIterations = 1000;
9
10    public static string Encrypt(string plainText, string passPhrase)
11    {
12        // Salt and IV is randomly generated each time, but is preprended to encrypted cipher text
13        // so that the same Salt and IV values can be used when decrypting.  
14        var saltStringBytes = Generate128BitsOfRandomEntropy();
15        var ivStringBytes = Generate128BitsOfRandomEntropy();
16        var plainTextBytes = Encoding.UTF8.GetBytes(plainText);
17        using (var password = new Rfc2898DeriveBytes(passPhrase, saltStringBytes, DerivationIterations))
18        {
19            var keyBytes = password.GetBytes(Keysize / 8);
20            using (var symmetricKey = Aes.Create())
21            {
22                symmetricKey.BlockSize = 128;
23                symmetricKey.Mode = CipherMode.CBC;
24                symmetricKey.Padding = PaddingMode.PKCS7;
25                using (var encryptor = symmetricKey.CreateEncryptor(keyBytes, ivStringBytes))
26                {
27                    using (var memoryStream = new MemoryStream())
28                    {
29                        using (var cryptoStream = new CryptoStream(memoryStream, encryptor, CryptoStreamMode.Write))
30                        {
31                            cryptoStream.Write(plainTextBytes, 0, plainTextBytes.Length);
32                            cryptoStream.FlushFinalBlock();
33                            // Create the final bytes as a concatenation of the random salt bytes, the random iv bytes and the cipher bytes.
34                            var cipherTextBytes = saltStringBytes;
35                            cipherTextBytes = cipherTextBytes.Concat(ivStringBytes).ToArray();
36                            cipherTextBytes = cipherTextBytes.Concat(memoryStream.ToArray()).ToArray();
37                            memoryStream.Close();
38                            cryptoStream.Close();
39                            return Convert.ToBase64String(cipherTextBytes);
40                        }
41                    }
42                }
43            }
44        }
45    }
46
47    public static string Decrypt(string cipherText, string passPhrase)
48    {
49        // Get the complete stream of bytes that represent:
50        // [32 bytes of Salt] + [16 bytes of IV] + [n bytes of CipherText]
51        var cipherTextBytesWithSaltAndIv = Convert.FromBase64String(cipherText);
52        // Get the saltbytes by extracting the first 16 bytes from the supplied cipherText bytes.
53        var saltStringBytes = cipherTextBytesWithSaltAndIv.Take(Keysize / 8).ToArray();
54        // Get the IV bytes by extracting the next 16 bytes from the supplied cipherText bytes.
55        var ivStringBytes = cipherTextBytesWithSaltAndIv.Skip(Keysize / 8).Take(Keysize / 8).ToArray();
56        // Get the actual cipher text bytes by removing the first 64 bytes from the cipherText string.
57        var cipherTextBytes = cipherTextBytesWithSaltAndIv.Skip((Keysize / 8) * 2).Take(cipherTextBytesWithSaltAndIv.Length - ((Keysize / 8) * 2)).ToArray();
58
59        using (var password = new Rfc2898DeriveBytes(passPhrase, saltStringBytes, DerivationIterations))
60        {
61            var keyBytes = password.GetBytes(Keysize / 8);
62            using (var symmetricKey = Aes.Create())
63            {
64                symmetricKey.BlockSize = 128;
65                symmetricKey.Mode = CipherMode.CBC;
66                symmetricKey.Padding = PaddingMode.PKCS7;
67                using (var decryptor = symmetricKey.CreateDecryptor(keyBytes, ivStringBytes))
68                {
69                    using (var memoryStream = new MemoryStream(cipherTextBytes))
70                    {
71                        using (var cryptoStream = new CryptoStream(memoryStream, decryptor, CryptoStreamMode.Read))
72                        {
73                            var plainTextBytes = new byte[cipherTextBytes.Length];
74                            var decryptedByteCount = cryptoStream.Read(plainTextBytes, 0, plainTextBytes.Length);
75                            memoryStream.Close();
76                            cryptoStream.Close();
77                            return Encoding.UTF8.GetString(plainTextBytes, 0, decryptedByteCount);
78                        }
79                    }
80                }
81            }
82        }
83    }
84
85    private static byte[] Generate128BitsOfRandomEntropy()
86    {
87        var randomBytes = new byte[16]; // 16 Bytes will give us 128 bits.
88        using (var rngCsp = RandomNumberGenerator.Create())
89        {
90            // Fill the array with cryptographically secure random bytes.
91            rngCsp.GetBytes(randomBytes);
92        }
93        return randomBytes;
94    }
95}
96var input = "12345678901234567890";
97var inputLength = input.Length;
98var inputBytes = Encoding.UTF8.GetBytes(input);
99
100var encrypted = StringCipher.Encrypt(input, "nzv86ri4H2qYHqc&m6rL");
101
102var output = StringCipher.Decrypt(encrypted, "nzv86ri4H2qYHqc&m6rL");
103var outputLength = output.Length;
104var outputBytes = Encoding.UTF8.GetBytes(output);
105
106var lengthDiff = inputLength - outputLength;
107using (var cryptoStream = new CryptoStream(memoryStream, decryptor, CryptoStreamMode.Read))
108{
109    var plainTextBytes = new byte[cipherTextBytes.Length];
110    var decryptedByteCount = cryptoStream.Read(plainTextBytes, 0, plainTextBytes.Length);
111    memoryStream.Close();
112    cryptoStream.Close();
113    return Encoding.UTF8.GetString(plainTextBytes, 0, decryptedByteCount);
114}
115using (var plainTextStream = new MemoryStream())
116{
117    cryptoStream.CopyTo(plainTextStream);
118    var plainTextBytes = plainTextStream.ToArray();
119    return Encoding.UTF8.GetString(plainTextBytes, 0, plainTextBytes.Length);
120} 
121using (var plainTextReader = new StreamReader(cryptoStream))
122{
123    return plainTextReader.ReadToEnd();
124}  
125

1/**
2* Generating the shared secret with the merchant private key and the ephemeral public key(part of the payment token data)
3* using Elliptic Curve Diffie-Hellman (id-ecDH 1.3.132.1.12).
4* As the Apple Pay certificate is issued using prime256v1 encryption, create elliptic curve key instances using the package - https://www.npmjs.com/package/ec-key
5*/
6sharedSecret (privatePem) {
7    const prv = new ECKey(privatePem, 'pem') // Create a new ECkey instance from PEM formatted string
8    const publicEc = new ECKey(this.ephemeralPublicKey, 'spki') // Create a new ECKey instance from a base-64 spki string
9    return prv.computeSecret(publicEc).toString('hex') // Compute secret using private key for provided ephemeral public key
10  }
11MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEYtpZKqPDqavs4KzNnMoxWdIThKe/ErKMI/l34Y9/xVkt4DU4BrCaQnGLlRGx+Pn/WHPkQg3BYoRH4xUWswNhEA==
12from cryptography.hazmat.primitives.asymmetric.ec import SECP256R1, EllipticCurvePublicKey, ECDH
13from cryptography.hazmat.primitives.serialization import load_pem_private_key
14
15def __compute_shared_secret(ephemeral_public_key: str) -> bytes:
16    curve = SECP256R1()
17    key = base64.b64decode(ephemeral_public_key)
18    public_key = EllipticCurvePublicKey.from_encoded_point(curve, key)  # problem here
19    server_private_key = load_pem_private_key(<private_key>, password=None)
20    shared_secret = server_private_key.exchange(ECDH(), public_key)
21    return shared_secret
22ValueError: Unsupported elliptic curve point type
23const publicEc = new ECKey(this.ephemeralPublicKey, 'spki')
24

1/**
2* Generating the shared secret with the merchant private key and the ephemeral public key(part of the payment token data)
3* using Elliptic Curve Diffie-Hellman (id-ecDH 1.3.132.1.12).
4* As the Apple Pay certificate is issued using prime256v1 encryption, create elliptic curve key instances using the package - https://www.npmjs.com/package/ec-key
5*/
6sharedSecret (privatePem) {
7    const prv = new ECKey(privatePem, 'pem') // Create a new ECkey instance from PEM formatted string
8    const publicEc = new ECKey(this.ephemeralPublicKey, 'spki') // Create a new ECKey instance from a base-64 spki string
9    return prv.computeSecret(publicEc).toString('hex') // Compute secret using private key for provided ephemeral public key
10  }
11MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEYtpZKqPDqavs4KzNnMoxWdIThKe/ErKMI/l34Y9/xVkt4DU4BrCaQnGLlRGx+Pn/WHPkQg3BYoRH4xUWswNhEA==
12from cryptography.hazmat.primitives.asymmetric.ec import SECP256R1, EllipticCurvePublicKey, ECDH
13from cryptography.hazmat.primitives.serialization import load_pem_private_key
14
15def __compute_shared_secret(ephemeral_public_key: str) -> bytes:
16    curve = SECP256R1()
17    key = base64.b64decode(ephemeral_public_key)
18    public_key = EllipticCurvePublicKey.from_encoded_point(curve, key)  # problem here
19    server_private_key = load_pem_private_key(<private_key>, password=None)
20    shared_secret = server_private_key.exchange(ECDH(), public_key)
21    return shared_secret
22ValueError: Unsupported elliptic curve point type
23const publicEc = new ECKey(this.ephemeralPublicKey, 'spki')
24from cryptography.hazmat.primitives.serialization import load_der_public_key
25import base64
26...
27public_key = load_der_public_key(base64.b64decode(ephemeral_public_key))
28