(#195) Message Bus Encryption: RabbitMQ

phongnguyend · Sep 14, 2023 · 5255833 · 5255833
1 parent e5bfbc8
commit 5255833
Show file tree

Hide file tree

Showing 6 changed files with 45 additions and 15 deletions.
diff --git a/...oservices/Common/ClassifiedAds.Infrastructure/MessageBrokers/RabbitMQ/RabbitMQReceiver.cs b/...oservices/Common/ClassifiedAds.Infrastructure/MessageBrokers/RabbitMQ/RabbitMQReceiver.cs
@@ -82,8 +82,15 @@ public Task ReceiveAsync(Func<T, MetaData, Task> action, CancellationToken cance
 
                 if (_options.MessageEncryptionEnabled)
                 {
-                    bodyText = ea.Body.Span.ToArray().UseAES(_options.MessageEncryptionKey.FromBase64String())
-                    .WithCipher(CipherMode.ECB)
+                    var parts = Encoding.UTF8.GetString(ea.Body.Span).Split('.');
+
+                    var iv = parts[0].FromBase64String();
+                    var encryptedBytes = parts[1].FromBase64String();
+
+                    bodyText = encryptedBytes.UseAES(_options.MessageEncryptionKey.FromBase64String())
+                    .WithCipher(CipherMode.CBC)
+                    .WithIV(iv)
+                    .WithPadding(PaddingMode.PKCS7)
                     .Decrypt()
                     .GetString();
                 }

diff --git a/...croservices/Common/ClassifiedAds.Infrastructure/MessageBrokers/RabbitMQ/RabbitMQSender.cs b/...croservices/Common/ClassifiedAds.Infrastructure/MessageBrokers/RabbitMQ/RabbitMQSender.cs
@@ -44,9 +44,12 @@ public async Task SendAsync(T message, MetaData metaData = null, CancellationTok
 
             if (_options.MessageEncryptionEnabled)
             {
-                body = body.UseAES(_options.MessageEncryptionKey.FromBase64String())
-                .WithCipher(CipherMode.ECB)
-                .Encrypt();
+                var iv = SymmetricCrypto.GenerateKey(16);
+                body = (iv.ToBase64String() + "." + body.UseAES(_options.MessageEncryptionKey.FromBase64String())
+                .WithCipher(CipherMode.CBC)
+                .WithIV(iv)
+                .WithPadding(PaddingMode.PKCS7)
+                .Encrypt().ToBase64String()).GetBytes();
             }
 
             var properties = channel.CreateBasicProperties();

diff --git a/src/ModularMonolith/ClassifiedAds.Infrastructure/MessageBrokers/RabbitMQ/RabbitMQReceiver.cs b/src/ModularMonolith/ClassifiedAds.Infrastructure/MessageBrokers/RabbitMQ/RabbitMQReceiver.cs
@@ -82,8 +82,15 @@ public Task ReceiveAsync(Func<T, MetaData, Task> action, CancellationToken cance
 
                 if (_options.MessageEncryptionEnabled)
                 {
-                    bodyText = ea.Body.Span.ToArray().UseAES(_options.MessageEncryptionKey.FromBase64String())
-                    .WithCipher(CipherMode.ECB)
+                    var parts = Encoding.UTF8.GetString(ea.Body.Span).Split('.');
+
+                    var iv = parts[0].FromBase64String();
+                    var encryptedBytes = parts[1].FromBase64String();
+
+                    bodyText = encryptedBytes.UseAES(_options.MessageEncryptionKey.FromBase64String())
+                    .WithCipher(CipherMode.CBC)
+                    .WithIV(iv)
+                    .WithPadding(PaddingMode.PKCS7)
                     .Decrypt()
                     .GetString();
                 }

diff --git a/src/ModularMonolith/ClassifiedAds.Infrastructure/MessageBrokers/RabbitMQ/RabbitMQSender.cs b/src/ModularMonolith/ClassifiedAds.Infrastructure/MessageBrokers/RabbitMQ/RabbitMQSender.cs
@@ -44,9 +44,12 @@ public async Task SendAsync(T message, MetaData metaData = null, CancellationTok
 
             if (_options.MessageEncryptionEnabled)
             {
-                body = body.UseAES(_options.MessageEncryptionKey.FromBase64String())
-                .WithCipher(CipherMode.ECB)
-                .Encrypt();
+                var iv = SymmetricCrypto.GenerateKey(16);
+                body = (iv.ToBase64String() + "." + body.UseAES(_options.MessageEncryptionKey.FromBase64String())
+                .WithCipher(CipherMode.CBC)
+                .WithIV(iv)
+                .WithPadding(PaddingMode.PKCS7)
+                .Encrypt().ToBase64String()).GetBytes();
             }
 
             var properties = channel.CreateBasicProperties();

diff --git a/src/Monolith/ClassifiedAds.Infrastructure/MessageBrokers/RabbitMQ/RabbitMQReceiver.cs b/src/Monolith/ClassifiedAds.Infrastructure/MessageBrokers/RabbitMQ/RabbitMQReceiver.cs
@@ -82,8 +82,15 @@ public Task ReceiveAsync(Func<T, MetaData, Task> action, CancellationToken cance
 
                 if (_options.MessageEncryptionEnabled)
                 {
-                    bodyText = ea.Body.Span.ToArray().UseAES(_options.MessageEncryptionKey.FromBase64String())
-                    .WithCipher(CipherMode.ECB)
+                    var parts = Encoding.UTF8.GetString(ea.Body.Span).Split('.');
+
+                    var iv = parts[0].FromBase64String();
+                    var encryptedBytes = parts[1].FromBase64String();
+
+                    bodyText = encryptedBytes.UseAES(_options.MessageEncryptionKey.FromBase64String())
+                    .WithCipher(CipherMode.CBC)
+                    .WithIV(iv)
+                    .WithPadding(PaddingMode.PKCS7)
                     .Decrypt()
                     .GetString();
                 }

diff --git a/src/Monolith/ClassifiedAds.Infrastructure/MessageBrokers/RabbitMQ/RabbitMQSender.cs b/src/Monolith/ClassifiedAds.Infrastructure/MessageBrokers/RabbitMQ/RabbitMQSender.cs
@@ -44,9 +44,12 @@ public async Task SendAsync(T message, MetaData metaData = null, CancellationTok
 
             if (_options.MessageEncryptionEnabled)
             {
-                body = body.UseAES(_options.MessageEncryptionKey.FromBase64String())
-                .WithCipher(CipherMode.ECB)
-                .Encrypt();
+                var iv = SymmetricCrypto.GenerateKey(16);
+                body = (iv.ToBase64String() + "." + body.UseAES(_options.MessageEncryptionKey.FromBase64String())
+                .WithCipher(CipherMode.CBC)
+                .WithIV(iv)
+                .WithPadding(PaddingMode.PKCS7)
+                .Encrypt().ToBase64String()).GetBytes();
             }
 
             var properties = channel.CreateBasicProperties();