41 lines
3.7 KiB
Swift
41 lines
3.7 KiB
Swift
// Fixtura: CommonCrypto, Security.framework si TLS-ul clientului (URLSession, Network). Formele sunt cele din documentatia Apple:
|
|
// CC_SHA256 / CCCrypt / CCHmac / CCKeyDerivationPBKDF (CommonCrypto.h), SecKeyCreateRandomKey cu kSecAttrKeyType si kSecAttrKeySizeInBits
|
|
// (developer.apple.com/documentation/security/generating-new-cryptographic-keys), SecKeyCreateSignature / SecKeyVerifySignature /
|
|
// SecKeyCreateEncryptedData cu SecKeyAlgorithm, SecTrustEvaluateWithError, URLSessionConfiguration.tlsMinimumSupportedProtocolVersion,
|
|
// NWProtocolTLS.Options + sec_protocol_options_set_min_tls_protocol_version. Nu se compileaza; e text pentru scaner.
|
|
import Foundation
|
|
import CommonCrypto
|
|
import Security
|
|
import Network
|
|
|
|
func exemple(data: Data, keyData: Data, password: String, salt: Data, trust: SecTrust, privateKey: SecKey, publicKey: SecKey) throws {
|
|
var hash = [UInt8](repeating: 0, count: Int(CC_SHA256_DIGEST_LENGTH))
|
|
data.withUnsafeBytes { _ = CC_SHA256($0.baseAddress, CC_LONG(data.count), &hash) } // EXPECT: SHA-256 | quantum-safe
|
|
_ = CC_MD5(nil, 0, &hash) // EXPECT: MD5 | weak-now
|
|
_ = CC_SHA1(nil, 0, &hash) // EXPECT: SHA-1 | weak-now
|
|
let status = CCCrypt(CCOperation(kCCEncrypt), CCAlgorithm(kCCAlgorithmAES), CCOptions(kCCOptionPKCS7Padding), keyBytes, kCCKeySizeAES256, iv, dataBytes, data.count, outBytes, outLength, &moved) // EXPECT: AES-256-CBC | quantum-safe
|
|
let s3des = CCCrypt(CCOperation(kCCDecrypt), CCAlgorithm(kCCAlgorithm3DES), CCOptions(kCCOptionECBMode), keyBytes, kCCKeySize3DES, nil, dataBytes, data.count, outBytes, outLength, &moved) // EXPECT: 3DES-ECB | weak-now
|
|
CCHmac(CCHmacAlgorithm(kCCHmacAlgSHA256), keyBytes, keyData.count, dataBytes, data.count, &hash) // EXPECT: HMAC-SHA-256 | quantum-safe
|
|
let r = CCKeyDerivationPBKDF(CCPBKDFAlgorithm(kCCPBKDF2), password, password.utf8.count, saltBytes, salt.count, CCPseudoRandomAlgorithm(kCCPRFHmacAlgSHA1), 10000, derived, 32) // EXPECT: PBKDF2-HMAC-SHA1 | weak-now
|
|
|
|
let attributes: [String: Any] = [
|
|
kSecAttrKeyType as String: kSecAttrKeyTypeECSECPrimeRandom,
|
|
kSecAttrKeySizeInBits as String: 256,
|
|
]
|
|
var error: Unmanaged<CFError>?
|
|
let ecKey = SecKeyCreateRandomKey(attributes as CFDictionary, &error) // dictionarul e variabila de mai sus; EXPECT: EC-secp256r1 | quantum-vulnerable
|
|
let rsaKey = SecKeyCreateRandomKey([kSecAttrKeyType as String: kSecAttrKeyTypeRSA, kSecAttrKeySizeInBits as String: 2048] as CFDictionary, &error) // EXPECT: RSA-2048 | quantum-vulnerable
|
|
let sig = SecKeyCreateSignature(privateKey, .ecdsaSignatureMessageX962SHA256, data as CFData, &error) // EXPECT: ECDSA | quantum-vulnerable
|
|
let sig2 = SecKeyCreateSignature(privateKey, .rsaSignatureMessagePSSSHA256, data as CFData, &error) // EXPECT: RSA | quantum-vulnerable
|
|
let ok = SecKeyVerifySignature(publicKey, .rsaSignatureMessagePKCS1v15SHA1, data as CFData, sig!, &error) // EXPECT: RSA | weak-now
|
|
let ct = SecKeyCreateEncryptedData(publicKey, .rsaEncryptionOAEPSHA256, data as CFData, &error) // EXPECT: RSA | quantum-vulnerable
|
|
let trusted = SecTrustEvaluateWithError(trust, &error) // lantul de incredere TLS: autentificare, nu schimb de cheie; EXPECT: X.509 chain validation (PKIX) | quantum-vulnerable
|
|
|
|
let config = URLSessionConfiguration.default
|
|
config.tlsMinimumSupportedProtocolVersion = .TLSv12 // EXPECT: TLSv1.2 | quantum-vulnerable
|
|
config.tlsMaximumSupportedProtocolVersion = .TLSv13 // EXPECT: TLSv1.3 | unknown
|
|
let tls = NWProtocolTLS.Options() // EXPECT: TLS (negotiated) | unknown
|
|
sec_protocol_options_set_min_tls_protocol_version(tls.securityProtocolOptions, .TLSv13) // EXPECT: TLSv1.3 | unknown
|
|
_ = (status, s3des, r, ecKey, rsaKey, sig2, ok, ct, trusted, config)
|
|
}
|