crypto.h

Go to the documentation of this file.

 
#ifndef QB_IO_CRYPTO_H
#define QB_IO_CRYPTO_H
 
#ifndef QB_IO_WITH_SSL
#error "missing OpenSSL Library"
#endif
 
#include <algorithm>
#include <cmath>
#include <iomanip>
#include <istream>
#include <openssl/aes.h>
#include <openssl/buffer.h>
#include <openssl/ec.h>
#include <openssl/evp.h>
#include <openssl/hmac.h>
#include <openssl/md5.h>
#include <openssl/pem.h>
#include <openssl/rand.h>
#include <openssl/rsa.h>
#include <openssl/sha.h>
#include <optional>
#include <random>
#include <sstream>
#include <stdexcept>
#include <string>
#include <vector>
#include <array>
 
#undef hex_to_string
 
namespace qb {
 
#if _MSC_VER == 1700 // MSVS 2012 has no definition for round()
inline double
round(double x) noexcept { // Custom definition of round() for positive numbers
    return floor(x + 0.5);
}
#endif

class crypto {
    const static std::size_t buffer_size = 131072;
 
public:
    constexpr static const std::string_view range_numeric = "0123456789";

    constexpr static const std::string_view range_alpha = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
                                                          "abcdefghijklmnopqrstuvwxyz";

    constexpr static const std::string_view range_alpha_lower =
        "abcdefghijklmnopqrstuvwxyz";

    constexpr static const std::string_view range_alpha_upper =
        "ABCDEFGHIJKLMNOPQRSTUVWXYZ";

    constexpr static const std::string_view range_alpha_numeric =
        "0123456789"
        "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
        "abcdefghijklmnopqrstuvwxyz";

    constexpr static const std::string_view range_alpha_numeric_special =
        "0123456789"
        " !\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~"
        "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
        "abcdefghijklmnopqrstuvwxyz";

    constexpr static const std::string_view range_hex_upper = "0123456789ABCDEF";

    constexpr static const std::string_view range_hex_lower = "0123456789abcdef";

    constexpr static const std::string_view range_byte =
        "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0A\x0B\x0C\x0D\x0E\x0F"
        "\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1A\x1B\x1C\x1D\x1E\x1F"
        "\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2A\x2B\x2C\x2D\x2E\x2F"
        "\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3A\x3B\x3C\x3D\x3E\x3F"
        "\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4A\x4B\x4C\x4D\x4E\x4F"
        "\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5A\x5B\x5C\x5D\x5E\x5F"
        "\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6A\x6B\x6C\x6D\x6E\x6F"
        "\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7A\x7B\x7C\x7D\x7E\x7F"
        "\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8A\x8B\x8C\x8D\x8E\x8F"
        "\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9A\x9B\x9C\x9D\x9E\x9F"
        "\xA0\xA1\xA2\xA3\xA4\xA5\xA6\xA7\xA8\xA9\xAA\xAB\xAC\xAD\xAE\xAF"
        "\xB0\xB1\xB2\xB3\xB4\xB5\xB6\xB7\xB8\xB9\xBA\xBB\xBC\xBD\xBE\xBF"
        "\xC0\xC1\xC2\xC3\xC4\xC5\xC6\xC7\xC8\xC9\xCA\xCB\xCC\xCD\xCE\xCF"
        "\xD0\xD1\xD2\xD3\xD4\xD5\xD6\xD7\xD8\xD9\xDA\xDB\xDC\xDD\xDE\xDF"
        "\xE0\xE1\xE2\xE3\xE4\xE5\xE6\xE7\xE8\xE9\xEA\xEB\xEC\xED\xEE\xEF"
        "\xF0\xF1\xF2\xF3\xF4\xF5\xF6\xF7\xF8\xF9\xFA\xFB\xFC\xFD\xFE\xFF";

    enum class SymmetricAlgorithm {
        AES_128_CBC,
        AES_192_CBC,
        AES_256_CBC,
        AES_128_GCM,
        AES_192_GCM,
        AES_256_GCM,
        CHACHA20_POLY1305
    };

    enum class DigestAlgorithm {
        MD5,
        SHA1,
        SHA224,
        SHA256,
        SHA384,
        SHA512,
        BLAKE2B512,
        BLAKE2S256
    };

    template <typename T = std::mt19937>
    static auto
    random_generator() {
        auto constexpr seed_bytes = sizeof(typename T::result_type) * T::state_size;
        auto constexpr seed_len   = seed_bytes / sizeof(std::seed_seq::result_type);
        auto seed                 = std::array<std::seed_seq::result_type, seed_len>();
        auto dev                  = std::random_device();
        std::generate_n(std::begin(seed), seed_len, std::ref(dev));
        auto seed_seq = std::seed_seq(std::begin(seed), std::end(seed));
        return T{seed_seq};
    }

    template <typename T>
    static std::string
    generate_random_string(std::size_t len, T const &range) {
        thread_local auto rng    = random_generator<>();
        auto              dist   = std::uniform_int_distribution{{}, range.size() - 1};
        auto              result = std::string(len, '\0');
        std::generate_n(std::begin(result), len, [&]() { return range[dist(rng)]; });
        return result;
    }

    template <typename T, std::size_t N>
    std::string
    generate_random_string(std::size_t len, const T range[N]) {
        return generate_random_string(len, std::string_view(range, sizeof(range) - 1));
    }

    class base64 {
    public:
        static std::string encode(const std::string &input) noexcept;

        static std::string decode(const std::string &base64) noexcept;
    };

    static std::string
    to_hex_string(const std::string      &input,
                  std::string_view const &range = range_hex_upper) noexcept;

    static int hex_value(unsigned char hex_digit) noexcept;

    static std::string hex_to_string(const std::string &input) noexcept;

    static std::string evp(std::istream &stream, const EVP_MD *md) noexcept;

    static std::string md5(const std::string &input,
                           std::size_t        iterations = 1) noexcept;

    static std::string md5(std::istream &stream, std::size_t iterations = 1) noexcept;

    static std::string sha1(const std::string &input,
                            std::size_t        iterations = 1) noexcept;

    static std::string sha1(std::istream &stream, std::size_t iterations = 1) noexcept;

    static std::string sha256(const std::string &input,
                              std::size_t        iterations = 1) noexcept;

    static std::string sha256(std::istream &stream, std::size_t iterations = 1) noexcept;

    static std::string sha512(const std::string &input,
                              std::size_t        iterations = 1) noexcept;

    static std::string sha512(std::istream &stream, std::size_t iterations = 1) noexcept;

    static std::string pbkdf2(const std::string &password, const std::string &salt,
                              int iterations, int key_size) noexcept;

    static std::string base64_encode(const unsigned char *data, size_t len);

    static std::vector<unsigned char> base64_decode(const std::string &input);

    static std::vector<unsigned char> hmac_sha256(const std::vector<unsigned char> &key,
                                                  const std::string &data);

    static std::vector<unsigned char> sha256(const std::vector<unsigned char> &data);

    static std::vector<unsigned char> xor_bytes(const std::vector<unsigned char> &a,
                                                const std::vector<unsigned char> &b);

    static std::vector<unsigned char> generate_random_bytes(size_t size);

    static std::vector<unsigned char> generate_iv(SymmetricAlgorithm algorithm);

    static std::vector<unsigned char> generate_key(SymmetricAlgorithm algorithm);

    static std::vector<unsigned char>
    encrypt(const std::vector<unsigned char> &plaintext,
            const std::vector<unsigned char> &key, const std::vector<unsigned char> &iv,
            SymmetricAlgorithm algorithm, const std::vector<unsigned char> &aad = {});

    static std::vector<unsigned char>
    decrypt(const std::vector<unsigned char> &ciphertext,
            const std::vector<unsigned char> &key, const std::vector<unsigned char> &iv,
            SymmetricAlgorithm algorithm, const std::vector<unsigned char> &aad = {});

    static std::vector<unsigned char> hash(const std::vector<unsigned char> &data,
                                           DigestAlgorithm                   algorithm);

    static std::vector<unsigned char> hmac(const std::vector<unsigned char> &data,
                                           const std::vector<unsigned char> &key,
                                           DigestAlgorithm                   algorithm);

    static std::pair<std::string, std::string> generate_rsa_keypair(int bits = 2048);

    static std::pair<std::string, std::string>
    generate_ec_keypair(const std::string &curve = "prime256v1");

    static std::vector<unsigned char>
    rsa_sign(const std::vector<unsigned char> &data, const std::string &private_key,
             DigestAlgorithm digest = DigestAlgorithm::SHA256);

    static bool rsa_verify(const std::vector<unsigned char> &data,
                           const std::vector<unsigned char> &signature,
                           const std::string                &public_key,
                           DigestAlgorithm digest = DigestAlgorithm::SHA256);

    static std::vector<unsigned char>
    ec_sign(const std::vector<unsigned char> &data, const std::string &private_key,
            DigestAlgorithm digest = DigestAlgorithm::SHA256);

    static bool ec_verify(const std::vector<unsigned char> &data,
                          const std::vector<unsigned char> &signature,
                          const std::string                &public_key,
                          DigestAlgorithm digest = DigestAlgorithm::SHA256);

    static std::vector<unsigned char>
    ecdh_derive_secret(const std::string &private_key,
                       const std::string &peer_public_key);

    static bool secure_random_fill(std::vector<unsigned char> &buffer);

    static const EVP_MD *get_evp_md(DigestAlgorithm algorithm);
 
    // New types for added functions
    struct Argon2Params {
        uint32_t    t_cost;      
        uint32_t    m_cost;      
        uint32_t    parallelism; 
        std::string salt;        
 
        Argon2Params()
            : t_cost(3)
            , m_cost(1 << 16)
            , parallelism(1) {}
    };

    enum class Argon2Variant {
        Argon2d, // Optimized for resistance to GPU attacks, but vulnerable to
                 // side-channel attacks
        Argon2i, // Optimized for resistance to side-channel attacks
        Argon2id // Hybrid, recommended for most use cases
    };

    enum class KdfAlgorithm { PBKDF2, HKDF, Argon2 };

    enum class ECIESMode { STANDARD, AES_GCM, CHACHA20 };

    enum class EnvelopeFormat {
        RAW,   // Raw data (IV + ciphertext + tag)
        JSON,  // JSON format with metadata
        BASE64 // Base64 format with delimiters
    };

    static std::vector<unsigned char>
    argon2_kdf(const std::string &password, size_t key_length,
               const Argon2Params &params,
               Argon2Variant       variant = Argon2Variant::Argon2id);

    static std::vector<unsigned char>
    hkdf(const std::vector<unsigned char> &input_key_material,
         const std::vector<unsigned char> &salt, const std::vector<unsigned char> &info,
         size_t output_length, DigestAlgorithm digest = DigestAlgorithm::SHA256);

    static std::vector<unsigned char>
    derive_key(const std::string &password, const std::vector<unsigned char> &salt,
               size_t key_length, KdfAlgorithm algorithm = KdfAlgorithm::Argon2,
               int                 iterations    = 10000,
               const Argon2Params &argon2_params = Argon2Params());

    static std::vector<unsigned char>
    ecies_encrypt(const std::vector<unsigned char> &plaintext,
                  const std::string                &recipient_public_key,
                  ECIESMode                         mode   = ECIESMode::AES_GCM,
                  DigestAlgorithm                   digest = DigestAlgorithm::SHA256);

    static std::vector<unsigned char>
    ecies_decrypt(const std::vector<unsigned char> &ciphertext,
                  const std::string &private_key, ECIESMode mode = ECIESMode::AES_GCM,
                  DigestAlgorithm digest = DigestAlgorithm::SHA256);

    static std::string
    envelope_encrypt(const std::vector<unsigned char> &plaintext,
                     const std::string                &recipient_public_key,
                     SymmetricAlgorithm algorithm = SymmetricAlgorithm::AES_256_GCM,
                     EnvelopeFormat     format    = EnvelopeFormat::BASE64);

    static std::vector<unsigned char>
    envelope_decrypt(const std::string &ciphertext, const std::string &private_key,
                     EnvelopeFormat format = EnvelopeFormat::BASE64);

    static bool constant_time_compare(const std::vector<unsigned char> &a,
                                      const std::vector<unsigned char> &b);

    static std::string generate_token(const std::string                &payload,
                                      const std::vector<unsigned char> &key,
                                      uint64_t                          ttl = 0);

    static std::string verify_token(const std::string                &token,
                                    const std::vector<unsigned char> &key);

    static std::string base64url_encode(const std::vector<unsigned char> &data);

    static std::vector<unsigned char> base64url_decode(const std::string &input);

    static std::vector<unsigned char> generate_salt(size_t length);

    static std::string hash_password(const std::string &password,
                                     Argon2Variant variant = Argon2Variant::Argon2id);

    static bool verify_password(const std::string &password, const std::string &hash);

    static std::pair<std::string, std::string> generate_ed25519_keypair();

    static std::pair<std::vector<unsigned char>, std::vector<unsigned char>>
    generate_ed25519_keypair_bytes();

    static std::vector<unsigned char>
    ed25519_sign(const std::vector<unsigned char> &data, const std::string &private_key);

    static std::vector<unsigned char>
    ed25519_sign(const std::vector<unsigned char> &data,
                 const std::vector<unsigned char> &private_key);

    static bool ed25519_verify(const std::vector<unsigned char> &data,
                               const std::vector<unsigned char> &signature,
                               const std::string                &public_key);

    static bool ed25519_verify(const std::vector<unsigned char> &data,
                               const std::vector<unsigned char> &signature,
                               const std::vector<unsigned char> &public_key);

    static std::pair<std::string, std::string> generate_x25519_keypair();

    static std::pair<std::vector<unsigned char>, std::vector<unsigned char>>
    generate_x25519_keypair_bytes();

    static std::vector<unsigned char>
    x25519_key_exchange(const std::vector<unsigned char> &private_key,
                        const std::vector<unsigned char> &peer_public_key);

    static std::vector<unsigned char>
    x25519_key_exchange(const std::string &private_key_pem,
                        const std::string &peer_public_key_pem);

    static std::vector<unsigned char> generate_unique_iv(size_t size = 12);

    static std::string encrypt_with_metadata(
        const std::vector<unsigned char> &plaintext,
        const std::vector<unsigned char> &key, const std::string &metadata,
        SymmetricAlgorithm algorithm = SymmetricAlgorithm::AES_256_GCM);

    static std::optional<std::pair<std::vector<unsigned char>, std::string>>
    decrypt_with_metadata(
        const std::string &ciphertext, const std::vector<unsigned char> &key,
        SymmetricAlgorithm algorithm = SymmetricAlgorithm::AES_256_GCM);
 
    // ECIES functions
 
    // ECIES encryption (using X25519 and AEAD)
    static std::pair<std::vector<unsigned char>, std::vector<unsigned char>>
    ecies_encrypt(const std::vector<unsigned char> &data,
                  const std::vector<unsigned char> &recipient_public_key,
                  const std::vector<unsigned char> &optional_shared_info = {},
                  ECIESMode                         mode = ECIESMode::AES_GCM);
 
    // ECIES decryption
    static std::vector<unsigned char>
    ecies_decrypt(const std::vector<unsigned char> &encrypted_data,
                  const std::vector<unsigned char> &ephemeral_public_key,
                  const std::vector<unsigned char> &recipient_private_key,
                  const std::vector<unsigned char> &optional_shared_info = {},
                  ECIESMode                         mode = ECIESMode::AES_GCM);
};
} // namespace qb
 
#endif // QB_IO_CRYPTO_H