79 lines
2.9 KiB
C#
79 lines
2.9 KiB
C#
using System.Security.Cryptography;
|
|
using System.Text;
|
|
using ScadaLink.Transport.Encryption;
|
|
|
|
namespace ScadaLink.Transport.Tests.Encryption;
|
|
|
|
public sealed class BundleSecretEncryptorTests
|
|
{
|
|
private const int TestIterations = 10_000; // Lower than production for test speed.
|
|
|
|
[Fact]
|
|
public void Encrypt_then_Decrypt_roundtrips_arbitrary_bytes()
|
|
{
|
|
var sut = new BundleSecretEncryptor();
|
|
var plaintext = Encoding.UTF8.GetBytes("the quick brown fox jumps over the lazy dog");
|
|
|
|
var (ciphertext, metadata) = sut.Encrypt(plaintext, "correct-horse-battery-staple", TestIterations);
|
|
var recovered = sut.Decrypt(ciphertext, metadata, "correct-horse-battery-staple");
|
|
|
|
Assert.Equal(plaintext, recovered);
|
|
}
|
|
|
|
[Fact]
|
|
public void Decrypt_with_wrong_passphrase_throws_CryptographicException()
|
|
{
|
|
var sut = new BundleSecretEncryptor();
|
|
var plaintext = Encoding.UTF8.GetBytes("secret payload");
|
|
|
|
var (ciphertext, metadata) = sut.Encrypt(plaintext, "right-pass", TestIterations);
|
|
|
|
Assert.ThrowsAny<CryptographicException>(() => sut.Decrypt(ciphertext, metadata, "wrong-pass"));
|
|
}
|
|
|
|
[Fact]
|
|
public void Decrypt_with_tampered_ciphertext_throws_CryptographicException()
|
|
{
|
|
var sut = new BundleSecretEncryptor();
|
|
var plaintext = Encoding.UTF8.GetBytes("secret payload");
|
|
|
|
var (ciphertext, metadata) = sut.Encrypt(plaintext, "pass", TestIterations);
|
|
ciphertext[0] ^= 0xFF; // Flip every bit in the first ciphertext byte.
|
|
|
|
Assert.ThrowsAny<CryptographicException>(() => sut.Decrypt(ciphertext, metadata, "pass"));
|
|
}
|
|
|
|
[Fact]
|
|
public void Encrypt_produces_distinct_ciphertext_for_same_input_due_to_random_iv()
|
|
{
|
|
var sut = new BundleSecretEncryptor();
|
|
var plaintext = Encoding.UTF8.GetBytes("same input");
|
|
|
|
var (ct1, meta1) = sut.Encrypt(plaintext, "pass", TestIterations);
|
|
var (ct2, meta2) = sut.Encrypt(plaintext, "pass", TestIterations);
|
|
|
|
Assert.NotEqual(ct1, ct2);
|
|
Assert.NotEqual(meta1.IvB64, meta2.IvB64);
|
|
Assert.NotEqual(meta1.SaltB64, meta2.SaltB64);
|
|
}
|
|
|
|
[Fact]
|
|
public void Encrypt_emits_metadata_matching_decryption_inputs()
|
|
{
|
|
var sut = new BundleSecretEncryptor();
|
|
var plaintext = Encoding.UTF8.GetBytes("payload");
|
|
|
|
var (ciphertext, metadata) = sut.Encrypt(plaintext, "pass", TestIterations);
|
|
|
|
Assert.Equal("AES-256-GCM", metadata.Algorithm);
|
|
Assert.Equal("PBKDF2-SHA256", metadata.Kdf);
|
|
Assert.Equal(TestIterations, metadata.Iterations);
|
|
// Salt is 16 bytes (24 chars b64 incl padding), Iv is 12 bytes (16 chars b64 incl padding).
|
|
Assert.Equal(16, Convert.FromBase64String(metadata.SaltB64).Length);
|
|
Assert.Equal(12, Convert.FromBase64String(metadata.IvB64).Length);
|
|
|
|
var recovered = sut.Decrypt(ciphertext, metadata, "pass");
|
|
Assert.Equal(plaintext, recovered);
|
|
}
|
|
}
|