App Platform Prometheus

SecureFolderFS.slnx

@@ -93,6 +93,7 @@
     </Project>
   </Folder>
   <Folder Name="/src/Sdk/">
+    <Project Path="src/Sdk/SecureFolderFS.Sdk.AppPlatform/SecureFolderFS.Sdk.AppPlatform.csproj" />
     <Project Path="src/Sdk/SecureFolderFS.Sdk.Accounts/SecureFolderFS.Sdk.Accounts.csproj" />
     <Project Path="src/Sdk/SecureFolderFS.Sdk.DeviceLink/SecureFolderFS.Sdk.DeviceLink.csproj" />
     <Project Path="src/Sdk/SecureFolderFS.Sdk.Dropbox/SecureFolderFS.Sdk.Dropbox.csproj" />

global.json

@@ -1,5 +1,5 @@
 {
   "msbuild-sdks": {
-    "Uno.Sdk": "6.6.29"
+    "Uno.Sdk": "6.6.33"
   }
 }

src/Core/SecureFolderFS.Core.Cryptography/Cipher/AesGcm256.cs

@@ -1,19 +1,37 @@
 using System;
 using System.Security.Cryptography;
+using Org.BouncyCastle.Crypto;
+using Org.BouncyCastle.Crypto.Engines;
+using Org.BouncyCastle.Crypto.Modes;
+using Org.BouncyCastle.Crypto.Parameters;
 
 namespace SecureFolderFS.Core.Cryptography.Cipher
 {
     public static class AesGcm256
     {
+        private const int TAG_SIZE = 16;
+
         public static void Encrypt(ReadOnlySpan<byte> bytes, ReadOnlySpan<byte> key, ReadOnlySpan<byte> nonce, Span<byte> tag, Span<byte> result, ReadOnlySpan<byte> associatedData)
         {
-            using var aesGcm = new AesGcm(key, Constants.Crypto.Chunks.AesGcm.CHUNK_TAG_SIZE);
+            if (Constants.PreferBouncyCastle)
+            {
+                BcEncrypt(bytes, key, nonce, tag, result, associatedData);
+                return;
+            }
+
+            using var aesGcm = new AesGcm(key, TAG_SIZE);
             aesGcm.Encrypt(nonce, bytes, result, tag, associatedData);
         }
 
         public static void Decrypt(ReadOnlySpan<byte> bytes, ReadOnlySpan<byte> key, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> tag, Span<byte> result, ReadOnlySpan<byte> associatedData)
         {
-            using var aesGcm = new AesGcm(key, Constants.Crypto.Chunks.AesGcm.CHUNK_TAG_SIZE);
+            if (Constants.PreferBouncyCastle)
+            {
+                BcDecrypt(bytes, key, nonce, tag, result, associatedData);
+                return;
+            }
+
+            using var aesGcm = new AesGcm(key, TAG_SIZE);
             aesGcm.Decrypt(nonce, bytes, tag, result, associatedData);
         }
 
@@ -29,5 +47,44 @@ public static bool TryDecrypt(ReadOnlySpan<byte> bytes, ReadOnlySpan<byte> key,
                 return false;
             }
         }
+
+        private static void BcEncrypt(ReadOnlySpan<byte> bytes, ReadOnlySpan<byte> key, ReadOnlySpan<byte> nonce, Span<byte> tag, Span<byte> result, ReadOnlySpan<byte> associatedData)
+        {
+            var gcm = new GcmBlockCipher(new AesEngine());
+            gcm.Init(true, new AeadParameters(new KeyParameter(key.ToArray()), TAG_SIZE * 8, nonce.ToArray(), associatedData.ToArray()));
+
+            // BC concatenates ciphertext || tag into a single output buffer.
+            var output = new byte[gcm.GetOutputSize(bytes.Length)];
+            var written = gcm.ProcessBytes(bytes.ToArray(), 0, bytes.Length, output, 0);
+            gcm.DoFinal(output, written);
+
+            output.AsSpan(0, bytes.Length).CopyTo(result);
+            output.AsSpan(bytes.Length, TAG_SIZE).CopyTo(tag);
+        }
+
+        private static void BcDecrypt(ReadOnlySpan<byte> bytes, ReadOnlySpan<byte> key, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> tag, Span<byte> result, ReadOnlySpan<byte> associatedData)
+        {
+            var gcm = new GcmBlockCipher(new AesEngine());
+            gcm.Init(false, new AeadParameters(new KeyParameter(key.ToArray()), TAG_SIZE * 8, nonce.ToArray(), associatedData.ToArray()));
+
+            // BC expects ciphertext || tag as one input buffer.
+            var input = new byte[bytes.Length + tag.Length];
+            bytes.CopyTo(input);
+            tag.CopyTo(input.AsSpan(bytes.Length));
+
+            var output = new byte[gcm.GetOutputSize(input.Length)];
+            try
+            {
+                var written = gcm.ProcessBytes(input, 0, input.Length, output, 0);
+                gcm.DoFinal(output, written);
+            }
+            catch (InvalidCipherTextException ex)
+            {
+                // Match the native AesGcm contract so TryDecrypt and callers behave identically.
+                throw new CryptographicException("The authentication tag did not match.", ex);
+            }
+
+            output.AsSpan(0, result.Length).CopyTo(result);
+        }
     }
 }

src/Core/SecureFolderFS.Core.Cryptography/Cipher/AesSiv256.cs

@@ -1,56 +1,92 @@
-using System;
+using System;
 using System.Runtime.CompilerServices;
+using System.Security.Cryptography;
 using Miscreant;
 
 namespace SecureFolderFS.Core.Cryptography.Cipher
 {
     public sealed class AesSiv256 : IDisposable
     {
-        private readonly Aead _aesCmacSiv;
+        private readonly Aead? _aesCmacSiv;
+        private readonly bool _preferBouncyCastle;
 
-        private AesSiv256(Aead aesCmacSiv)
+        /// <summary>
+        /// Holds the concatenated DEK and MAC key.
+        /// </summary>
+        /// <remarks>
+        /// Allocated pinned so the garbage collector cannot relocate it and leave copies of the
+        /// master keys scattered across the heap, and zeroed in <see cref="Dispose"/> so it does
+        /// not survive in a memory image after the vault is locked.
+        /// </remarks>
+        private readonly byte[] _longKey;
+
+        private AesSiv256(Aead? aesCmacSiv, byte[] longKey, bool preferBouncyCastle)
         {
             _aesCmacSiv = aesCmacSiv;
+            _longKey = longKey;
+            _preferBouncyCastle = preferBouncyCastle;
         }
 
         public static AesSiv256 CreateInstance(ReadOnlySpan<byte> dekKey, ReadOnlySpan<byte> macKey)
         {
             // The longKey will be split into two keys - one for S2V and the other one for CTR
-            var longKey = new byte[dekKey.Length + macKey.Length];
-            var longKeySpan = longKey.AsSpan();
+            var longKey = GC.AllocateArray<byte>(dekKey.Length + macKey.Length, pinned: true);
+            try
+            {
+                var longKeySpan = longKey.AsSpan();
 
-            // Copy keys
-            dekKey.CopyTo(longKeySpan);
-            macKey.CopyTo(longKeySpan.Slice(dekKey.Length));
+                // Copy keys
+                dekKey.CopyTo(longKeySpan);
+                macKey.CopyTo(longKeySpan.Slice(dekKey.Length));
 
-            var aesCmacSiv = Aead.CreateAesCmacSiv(longKey);
-            return new AesSiv256(aesCmacSiv);
+                if (Constants.PreferBouncyCastle)
+                    return new AesSiv256(null, longKey, true);
+
+                var aesCmacSiv = Aead.CreateAesCmacSiv(longKey);
+                return new AesSiv256(aesCmacSiv, longKey, false);
+            }
+            catch (Exception)
+            {
+                CryptographicOperations.ZeroMemory(longKey);
+                throw;
+            }
         }
 
         [MethodImpl(MethodImplOptions.Synchronized)]
         public byte[] Encrypt(ReadOnlySpan<byte> bytes, ReadOnlySpan<byte> associatedData)
         {
-            return _aesCmacSiv.Seal(bytes.ToArray(), data: associatedData.ToArray());
+            if (_preferBouncyCastle)
+                return BouncyCastleAesSiv.Seal(_longKey, associatedData, bytes);
+
+            return _aesCmacSiv!.Seal(bytes.ToArray(), data: associatedData.ToArray());
         }
 
         [MethodImpl(MethodImplOptions.Synchronized)]
         public byte[] Decrypt(ReadOnlySpan<byte> bytes, ReadOnlySpan<byte> associatedData)
         {
-            return _aesCmacSiv.Open(bytes.ToArray(), data: associatedData.ToArray());
+            if (_preferBouncyCastle)
+                return BouncyCastleAesSiv.Open(_longKey, associatedData, bytes);
+
+            return _aesCmacSiv!.Open(bytes.ToArray(), data: associatedData.ToArray());
         }
 
         /// <inheritdoc/>
         public void Dispose()
         {
             try
             {
-                _aesCmacSiv.Dispose();
+                _aesCmacSiv?.Dispose();
             }
             catch (Exception ex)
             {
                 // TODO: Investigate. Sometimes an exception is thrown when disposing the Aead instance
                 _ = ex;
             }
+            finally
+            {
+                // Zero the master key material last, so the AEAD is torn down before its key disappears
+                CryptographicOperations.ZeroMemory(_longKey);
+            }
         }
     }
 }

src/Core/SecureFolderFS.Core.Cryptography/Cipher/Argon2id.cs

@@ -1,29 +1,95 @@
 using System;
+using System.Security.Cryptography;
+using System.Threading.Tasks;
 
 namespace SecureFolderFS.Core.Cryptography.Cipher
 {
     public static class Argon2id
     {
-        public static void V2_DeriveKey(ReadOnlySpan<byte> password, ReadOnlySpan<byte> salt, Span<byte> result)
+        /// <summary>
+        /// Derives a KEK without blocking the calling thread.
+        /// </summary>
+        /// <param name="password">The password.</param>
+        /// <param name="salt">The salt.</param>
+        /// <param name="result">The result.</param>
+        /// <remarks>
+        /// Parallelism lanes: defined by <see cref="Constants.Crypto.Argon2.DEGREE_OF_PARALLELISM"/>.<br/>
+        /// Iterations: defined by <see cref="Constants.Crypto.Argon2.ITERATIONS"/>.<br/>
+        /// Memory: defined by <see cref="Constants.Crypto.Argon2.MEMORY_SIZE_KIBIBYTES"/>.<br/>
+        /// </remarks>
+        public static async Task DeriveKeyAsync(byte[] password, byte[] salt, byte[] result)
         {
-            using var argon2id = new Konscious.Security.Cryptography.Argon2id(password.ToArray());
-            argon2id.Salt = salt.ToArray();
-            argon2id.DegreeOfParallelism = 8;
-            argon2id.Iterations = 8;
-            argon2id.MemorySize = 102400;
+            using var argon2id = new Konscious.Security.Cryptography.Argon2id(password);
+            argon2id.Salt = salt;
+            argon2id.DegreeOfParallelism = Constants.Crypto.Argon2.DEGREE_OF_PARALLELISM;
+            argon2id.Iterations = Constants.Crypto.Argon2.ITERATIONS;
+            argon2id.MemorySize = Constants.Crypto.Argon2.MEMORY_SIZE_KIBIBYTES;
 
-            argon2id.GetBytes(Constants.KeyTraits.ARGON2_KEK_LENGTH).CopyTo(result);
+            var kek = await argon2id.GetBytesAsync(Constants.KeyTraits.ARGON2_KEK_LENGTH).ConfigureAwait(false);
+            kek.CopyTo(result, 0);
+            CryptographicOperations.ZeroMemory(kek);
         }
 
+        /// <summary>
+        /// Derives a KEK synchronously.
+        /// </summary>
+        /// <param name="password">The password.</param>
+        /// <param name="salt">The salt.</param>
+        /// <param name="result">The result.</param>
+        /// <remarks>
+        /// Parallelism lanes: defined by <see cref="Constants.Crypto.Argon2.DEGREE_OF_PARALLELISM"/>.<br/>
+        /// Iterations: defined by <see cref="Constants.Crypto.Argon2.ITERATIONS"/>.<br/>
+        /// Memory: defined by <see cref="Constants.Crypto.Argon2.MEMORY_SIZE_KIBIBYTES"/>.<br/>
+        /// </remarks>
         public static void DeriveKey(ReadOnlySpan<byte> password, ReadOnlySpan<byte> salt, Span<byte> result)
         {
-            using var argon2id = new Konscious.Security.Cryptography.Argon2id(password.ToArray());
-            argon2id.Salt = salt.ToArray();
-            argon2id.DegreeOfParallelism = Constants.Crypto.Argon2.DEGREE_OF_PARALLELISM;
-            argon2id.Iterations = Constants.Crypto.Argon2.ITERATIONS;
-            argon2id.MemorySize = Constants.Crypto.Argon2.MEMORY_SIZE_KIBIBYTES;
+            DeriveKeyCore(
+                password,
+                salt,
+                result,
+                Constants.Crypto.Argon2.DEGREE_OF_PARALLELISM,
+                Constants.Crypto.Argon2.ITERATIONS,
+                Constants.Crypto.Argon2.MEMORY_SIZE_KIBIBYTES);
+        }
+
+        public static void V2_DeriveKey(ReadOnlySpan<byte> password, ReadOnlySpan<byte> salt, Span<byte> result)
+        {
+            DeriveKeyCore(
+                password,
+                salt,
+                result,
+                degreeOfParallelism: 8,
+                iterations: 8,
+                memorySize: 102400);
+        }
+
+        private static void DeriveKeyCore(
+            ReadOnlySpan<byte> password,
+            ReadOnlySpan<byte> salt,
+            Span<byte> result,
+            int degreeOfParallelism,
+            int iterations,
+            int memorySize)
+        {
+            var passwordCopy = password.ToArray();
+            byte[]? kek = null;
+            try
+            {
+                using var argon2id = new Konscious.Security.Cryptography.Argon2id(passwordCopy);
+                argon2id.Salt = salt.ToArray();
+                argon2id.DegreeOfParallelism = degreeOfParallelism;
+                argon2id.Iterations = iterations;
+                argon2id.MemorySize = memorySize;
 
-            argon2id.GetBytes(Constants.KeyTraits.ARGON2_KEK_LENGTH).CopyTo(result);
+                kek = argon2id.GetBytes(Constants.KeyTraits.ARGON2_KEK_LENGTH);
+                kek.CopyTo(result);
+            }
+            finally
+            {
+                CryptographicOperations.ZeroMemory(passwordCopy);
+                if (kek is not null)
+                    CryptographicOperations.ZeroMemory(kek);
+            }
         }
     }
 }