EncryptedAndAuthenticatedData 클래스

정의

네임스페이스:

Windows.Security.Cryptography.Core

암호화 및 인증된 데이터에서 검색할 수 있는 데이터를 포함합니다. 인증된 암호화 알고리즘은 SymmetricKeyAlgorithmProvider 클래스를 사용하여 열립니다.

public ref class EncryptedAndAuthenticatedData sealed

/// [Windows.Foundation.Metadata.ContractVersion(Windows.Foundation.UniversalApiContract, 65536)]
/// [Windows.Foundation.Metadata.MarshalingBehavior(Windows.Foundation.Metadata.MarshalingType.Agile)]
class EncryptedAndAuthenticatedData final

[Windows.Foundation.Metadata.ContractVersion(typeof(Windows.Foundation.UniversalApiContract), 65536)]
[Windows.Foundation.Metadata.MarshalingBehavior(Windows.Foundation.Metadata.MarshalingType.Agile)]
public sealed class EncryptedAndAuthenticatedData

Public NotInheritable Class EncryptedAndAuthenticatedData

상속

Object Platform::Object IInspectable EncryptedAndAuthenticatedData

특성

ContractVersionAttribute MarshalingBehaviorAttribute

Windows 요구 사항

디바이스 패밀리	Windows 10 (10.0.10240.0에서 도입되었습니다.)
API contract	Windows.Foundation.UniversalApiContract (v1.0에서 도입되었습니다.)

예제

using Windows.Security.Cryptography;
using Windows.Security.Cryptography.Core;
using Windows.Storage.Streams;

namespace SampleEncryptedAndAuthenticatedData
{
    sealed partial class EncryptedAuthenticatedDataApp : Application
    {
        // Initialize a static nonce value.
        static byte[] NonceBytes = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };

        public EncryptedAuthenticatedDataApp()
        {
            // Initialize the application.
            this.InitializeComponent();

            // Initialize the encryption method.
            String strMsg = "This is a message.";   // Message to encrypt and authenticate.
            String strAlgName = SymmetricAlgorithmNames.AesGcm;
            UInt32 keyLength = 32;                  // Length of the key, in bytes
            BinaryStringEncoding encoding;          // Binary encoding
            IBuffer buffNonce;                      // Nonce
            CryptographicKey key;                   // Symmetric key

            // Encrypt and authenticate the message.
            EncryptedAndAuthenticatedData objEncrypted = this.AuthenticatedEncryption(
                strMsg,
                strAlgName,
                keyLength,
                out encoding,
                out buffNonce,
                out key);

            // Decrypt the encrypted data.
            this.AuthenticatedDecryption(
                strAlgName,
                key,
                objEncrypted,
                encoding,
                buffNonce);
        }

        public EncryptedAndAuthenticatedData AuthenticatedEncryption(
            String strMsg,
            String strAlgName, 
            UInt32 keyLength, 
            out BinaryStringEncoding encoding, 
            out IBuffer buffNonce,
            out CryptographicKey key)
        {
            // Open a SymmetricKeyAlgorithmProvider object for the specified algorithm.
            SymmetricKeyAlgorithmProvider objAlgProv = SymmetricKeyAlgorithmProvider.OpenAlgorithm(strAlgName);

            // Create a buffer that contains the data to be encrypted.
            encoding = BinaryStringEncoding.Utf8;
            IBuffer buffMsg = CryptographicBuffer.ConvertStringToBinary(strMsg, encoding);

            // Generate a symmetric key.
            IBuffer keyMaterial = CryptographicBuffer.GenerateRandom(keyLength);
            key = objAlgProv.CreateSymmetricKey(keyMaterial);

            // Generate a new nonce value.
            buffNonce = GetNonce();

            // Encrypt and authenticate the message.
            EncryptedAndAuthenticatedData objEncrypted = CryptographicEngine.EncryptAndAuthenticate(
                key,
                buffMsg,
                buffNonce,
                null);

            return objEncrypted;

        }

        public void AuthenticatedDecryption(
            String strAlgName, 
            CryptographicKey key,
            EncryptedAndAuthenticatedData objEncrypted,
            BinaryStringEncoding encoding, 
            IBuffer buffNonce)
        {
            // Declare a buffer to contain the decrypted data.
            IBuffer buffDecrypted;

            // Open a SymmetricKeyAlgorithmProvider object for the specified algorithm.
            SymmetricKeyAlgorithmProvider objAlgProv = SymmetricKeyAlgorithmProvider.OpenAlgorithm(strAlgName);

            // The input key must be securely shared between the sender of the encrypted message
            // and the recipient. The nonce must also be shared but does not need to be shared
            // in a secure manner. If the sender encodes the message string to a buffer, the
            // binary encoding method must also be shared with the recipient.
            // The recipient uses the DecryptAndAuthenticate() method as follows to decrypt the 
            // message, authenticate it, and verify that it has not been altered in transit.
            buffDecrypted = CryptographicEngine.DecryptAndAuthenticate(
                key,
                objEncrypted.EncryptedData,
                buffNonce,
                objEncrypted.AuthenticationTag,
                null);

            // Convert the decrypted buffer to a string (for display). If the sender created the
            // original message buffer from a string, the sender must tell the recipient what 
            // BinaryStringEncoding value was used. Here, BinaryStringEncoding.Utf8 is used to
            // convert the message to a buffer before encryption and to convert the decrypted
            // buffer back to the original plaintext.
            String strDecrypted = CryptographicBuffer.ConvertBinaryToString(encoding, buffDecrypted);

        }

        IBuffer GetNonce()
        {
            // Security best practises require that an ecryption operation not
            // be called more than once with the same nonce for the same key.
            // A nonce value can be predictable, but must be unique for each
            // secure session.

            NonceBytes[0]++;
            for (int i = 0; i < NonceBytes.Length - 1; i++)
            {
                if (NonceBytes[i] == 255)
                {
                    NonceBytes[i + 1]++;
                }
            }

            return CryptographicBuffer.CreateFromByteArray(NonceBytes);
        }
    }
}

설명

인증된 암호화는 한 작업에서 콘텐츠를 암호화하고 인증합니다. 태그라고도 하는 인증자는 암호화 중에 사용되며 프로세스의 출력에는 태그-암호 텍스트 쌍이 포함됩니다. 자세한 내용은 AuthenticationTag 및 EncryptedData 속성을 참조하세요. 암호 해독 프로세스는 태그에 대해 암호 텍스트를 확인합니다.

SymmetricKeyAlgorithmProvider 클래스에서 OpenAlgorithm 메서드를 호출하고 열 알고리즘의 이름을 지정한 후 인증된 암호화 알고리즘을 사용할 수 있습니다. 인증된 암호화 및 암호 해독에는 다음 알고리즘 이름이 지원됩니다.

• AES_GCM
• AES_CCM

속성

AuthenticationTag	인증 태그를 가져옵니다.
EncryptedData	암호화된 데이터를 가져옵니다.

추가 정보

• CryptographicEngine
• DecryptAndAuthenticate(CryptographicKey, IBuffer, IBuffer, IBuffer, IBuffer)
• EncryptAndAuthenticate(CryptographicKey, IBuffer, IBuffer, IBuffer)
• SymmetricKeyAlgorithmProvider