Initial version #1

josesimoes · 2023-10-27T19:41:55Z

Description

Initial version.
Setup project and CI-CD.

Motivation and Context

Addresses Expose native "utilities" like CRC32 calculation, SHA-1, SHA-256 Home#648.

How Has This Been Tested?

Screenshots

Types of changes

Improvement (non-breaking change that improves a feature, code or algorithm)
Bug fix (non-breaking change which fixes an issue with code or algorithm)
New feature (non-breaking change which adds functionality to code)
Breaking change (fix or feature that would cause existing functionality to change)
Config and build (change in the configuration and build system, has no impact on code or features)
Dependencies (update dependencies and changes associated, has no impact on code or features)
Unit Tests (add new Unit Test(s) or improved existing one(s), has no impact on code or features)
Documentation (changes or updates in the documentation, has no impact on code or features)

Checklist:

My code follows the code style of this project (only if there are changes in source code).
My changes require an update to the documentation (there are changes that require the docs website to be updated).
I have updated the documentation accordingly (the changes require an update on the docs in this repo).
I have read the CONTRIBUTING document.
I have tested everything locally and all new and existing tests passed (only if there are changes in source code).
I have added new tests to cover my changes.

github-advanced-security · 2023-10-27T19:49:39Z

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

Ellerbach

Looks real good. Just open question to clarify on elements related to native and requirement on the device side. Just to make sure we can have it on any firmware to allow the modem managed implementations to use those security elements

README.md

Ellerbach · 2023-10-30T08:24:21Z

System.Security.Cryptography/HMACSHA256.cs

+        }
+
+        [MethodImpl(MethodImplOptions.InternalCall)]
+        extern private static byte[] HashCore(byte[] key, byte[] source);


Is this always present in all the firmware? Otherwise we should provide as well a pure managed version for modem implementation where we want to be able to run this on any system, not just those have System.Net enabled.

System.Net is not a requirement to have this.
Just like any other assembly the availability on the fw image is dependent on a build option.
We can bring in this independent of it.
If the target doesn't have support for it, VS won't deploy.

but then, we are loosing the capability to have this done on a pure managed way. I would prefer to have then a native pure software implementation when it's not implemented with some native platform functions.
And somehow have those few API always available on the native side. So regardless, we're sure we can count on them.

Having cryptography always available in all targets adds a bunch of code that's most likely not going to be used.
Particularly impactful for devices with small flash.

Of course we can offer a pure managed version of all these. The code is already available. It's a matter of moving it here.

If you ask me: my gut feeling is that 99.99% of projects using cryptography are also using network, therefore will benefit from the native availability of the images we're enabling this.
For the few others, that will be a simple matter of doing a local build and enabling this feature. Just as it happens with several other build options.

we just added modem support with purely managed classes. So then, we would have to provide as well, like it is today and only for the purely managed the HMACCSHA256 (and SHA256) as purely managed. So we will have this purely managed implementation.
And so, then, ok to have this one not on all devices and on build. The path then should be clear:
-> wifi/ethnet => the Azure lib + all this new nuget
-> modem => managed Azure lib only (it will come with managed crypto)

I think I'm fine with this! (not CRC32 is a different discussion ;-))

I actually see 3 paths here... each with benefits and pitfalls...

in the managed class, if an exception is thrown (because the feature is not available) call a managed class.

implement the "native" software emulated implementation.

throw a warning to "suggest" using an independent lib that includes it.

Adding a forth...

Have 2 nugets available, one purely managed and one using the native implementation... We kind of do that for some other libs.

On a project referencing Sys.Sec.Cryptography, if this is not available in the target device, the deployment won't even happen, so 1. above is technically impossible.

All these cryptography implementations are supplied through Mbed TLS. They are all software based. On some platforms there are hardware accelerators for some algorithms, but this is a just a detail on the implementation.

I'm convinced that enabling cryptography for all targets it's a mistake because those that do not have network enabled (and please keep in mind that this is independent of it, just mentioning it for the sake of this conversation) are meant to be slim and have no use for it. This is exposed as a build option and one can always build this if needed.

We can also split the distribution of this library by the various features, but maybe that would be overengineering this a bit too much and getting into a granularity level that's not reasonable...

This could be treated similarly to what we have with Math library: support for DP and "full" double type, or standard build/distribution with the lightweight one.

We come up with what are the classes that are the "basic" cryptography (seems to be HMACCSHA256 + SHA256) and have those available as the "default" in native implementation. The remaining ones are available in the C# API and either have their implementation provided as build option, or simply throw an NotAvailableException.

Tests/System.Security.CryptographyTests/HmacSha256Tests.cs

Tests/System.Security.CryptographyTests/Properties/AssemblyInfo.cs

- Add license header. - Add description.

Co-authored-by: Laurent Ellerbach <laurelle@microsoft.com>

Ellerbach

Great! And as always, bonus points for the tests ;-)

System.Security.Cryptography/HMACSHA256.cs

josesimoes · 2023-10-30T16:43:41Z

Great! And as always, bonus points for the tests ;-)

Yes! It's really awesome that we can rely on this tool.

sonarqubecloud · 2023-10-30T17:10:40Z

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities
0 Security Hotspots
6 Code Smells

No Coverage information
0.0% Duplication

josesimoes mentioned this pull request Oct 27, 2023

Add hashing and cryptography libraries nanoframework/nf-interpreter#2803

Merged

13 tasks

josesimoes force-pushed the initial-version branch from f345499 to 208fa41 Compare October 27, 2023 19:43

josesimoes force-pushed the initial-version branch from 208fa41 to 1dfd47a Compare October 27, 2023 19:51

nfbot added Type: enhancement New feature or request Area: Config-and-Build Type: Unit Tests labels Oct 27, 2023

josesimoes added the hacktoberfest-accepted label Oct 27, 2023

josesimoes force-pushed the initial-version branch from 1dfd47a to 4044916 Compare October 27, 2023 19:59

Initial version

adcfef8

josesimoes force-pushed the initial-version branch from 4044916 to adcfef8 Compare October 28, 2023 00:29

Ellerbach reviewed Oct 30, 2023

View reviewed changes

josesimoes added 2 commits October 30, 2023 13:52

Add back test assert

137e71e

Changes from review

4f94db3

- Add license header. - Add description.

josesimoes mentioned this pull request Oct 30, 2023

Initial version nanoframework/System.IO.Hashing#1

Merged

14 tasks

Update README.md

21900e2

Co-authored-by: Laurent Ellerbach <laurelle@microsoft.com>

Ellerbach approved these changes Oct 30, 2023

View reviewed changes

System.Security.Cryptography/HMACSHA256.cs Show resolved Hide resolved

System.Security.Cryptography/HMACSHA256.cs Show resolved Hide resolved

Improve comments about params check

8678a30

josesimoes merged commit 1bd7350 into main Oct 30, 2023

josesimoes deleted the initial-version branch October 30, 2023 18:10

Uh oh!

Initial version #1

Initial version #1

Uh oh!

Conversation

josesimoes commented Oct 27, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Motivation and Context

How Has This Been Tested?

Screenshots

Types of changes

Checklist:

Uh oh!

github-advanced-security bot commented Oct 27, 2023

Uh oh!

Ellerbach left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

networkfusion Oct 30, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Ellerbach left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

josesimoes commented Oct 30, 2023

Uh oh!

sonarqubecloud bot commented Oct 30, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

josesimoes commented Oct 27, 2023 •

edited

Loading

networkfusion Oct 30, 2023 •

edited

Loading