UID2Encryption.cs

usingOrg.BouncyCastle.Crypto.Engines;
usingOrg.BouncyCastle.Crypto.Modes;
usingOrg.BouncyCastle.Crypto.Parameters;
usingSystem;
usingSystem.IO;
usingSystem.Security.Cryptography;
usingSystem.Text;
usingUID2.Client.Utils;

namespaceUID2.Client
{
internalenumClientType
{
Sharing,
Bidstream,
LegacyWithoutDomainOrAppNameCheck,
LegacyWithDomainOrAppNameCheck
}

internalstaticclassUID2Encryption
{
publicconstintGCM_AUTHTAG_LENGTH=16;
publicconstintGCM_IV_LENGTH=12;
publicconstintTOKEN_V2_LENGTH=133;
publicconstintTOKEN_V3_MIN_LENGTH=163;
privatestaticchar[]BASE64_URL_SPECIAL_CHARS={'-','_'};


internalstaticDecryptionResponseDecrypt(stringtoken,KeyContainerkeys,DateTimenow,stringdomainOrAppName,IdentityScopeidentityScope,ClientTypeclientType)
{
if(token.Length<4)
{
returnDecryptionResponse.MakeError(DecryptionStatus.InvalidPayload);
}

stringheaderStr=token.Substring(0,4);
BooleanisBase64UrlEncoding=headerStr.IndexOfAny(BASE64_URL_SPECIAL_CHARS)!=-1;
byte[]data=isBase64UrlEncoding?UID2Base64UrlCoder.Decode(headerStr):Convert.FromBase64String(headerStr);

if(data[0]==2)
{
returnDecryptV2(Convert.FromBase64String(token),keys,now,domainOrAppName,clientType);
}

if(data[1]==(int)AdvertisingTokenVersion.V3)
{
returnDecryptV3(Convert.FromBase64String(token),keys,now,identityScope,3,domainOrAppName,clientType);
}

if(data[1]==(int)AdvertisingTokenVersion.V4)
{
//same as V3 but use Base64URL encoding
returnDecryptV3(UID2Base64UrlCoder.Decode(token),keys,now,identityScope,4,domainOrAppName,clientType);
}

returnDecryptionResponse.MakeError(DecryptionStatus.VersionNotSupported);
}

privatestaticDecryptionResponseDecryptV2(byte[]encryptedId,KeyContainerkeys,DateTimenow,stringdomainOrAppName,ClientTypeclientType)
{
if(encryptedId.Length!=TOKEN_V2_LENGTH)
{
returnDecryptionResponse.MakeError(DecryptionStatus.InvalidPayload);
}

varreader=newBigEndianByteReader(newMemoryStream(encryptedId));

// version
reader.ReadByte();

varmasterKeyId=reader.ReadInt32();

KeymasterKey=null;
if(!keys.TryGetKey(masterKeyId,outmasterKey))
{
returnDecryptionResponse.MakeError(DecryptionStatus.NotAuthorizedForMasterKey);
}

varmasterDecrypted=Decrypt(newByteArraySlice(encryptedId,21,encryptedId.Length-21),
reader.ReadBytes(16),masterKey.Secret);

varmasterPayloadReader=newBigEndianByteReader(newMemoryStream(masterDecrypted));

longexpiresMilliseconds=masterPayloadReader.ReadInt64();

varsiteKeyId=masterPayloadReader.ReadInt32();

KeysiteKey=null;
if(!keys.TryGetKey(siteKeyId,outsiteKey))
{
returnDecryptionResponse.MakeError(DecryptionStatus.NotAuthorizedForKey);
}

varidentityDecrypted=Decrypt(newByteArraySlice(masterDecrypted,28,masterDecrypted.Length-28),masterPayloadReader.ReadBytes(16),siteKey.Secret);

varidentityPayloadReader=newBigEndianByteReader(newMemoryStream(identityDecrypted));

varsiteId=identityPayloadReader.ReadInt32();
varidLength=identityPayloadReader.ReadInt32();

varidString=Encoding.UTF8.GetString(identityPayloadReader.ReadBytes(idLength));

varprivacyBits=newPrivacyBits(identityPayloadReader.ReadInt32());

varestablishedMilliseconds=identityPayloadReader.ReadInt64();

varestablished=DateTimeUtils.FromEpochMilliseconds(establishedMilliseconds);

constintadvertisingTokenVersion=2;
varexpiry=DateTimeUtils.FromEpochMilliseconds(expiresMilliseconds);
if(expiry<now)
{
returnnewDecryptionResponse(DecryptionStatus.ExpiredToken,null,established,siteId,siteKey.SiteId,null,advertisingTokenVersion,privacyBits.IsClientSideGenerated,expiry);
}

if(privacyBits.IsOptedOut)
{
returnnewDecryptionResponse(DecryptionStatus.UserOptedOut,null,established,siteId,siteKey.SiteId,null,advertisingTokenVersion,privacyBits.IsClientSideGenerated,expiry);
}

if(!IsDomainOrAppNameAllowedForSite(clientType,privacyBits,siteId,domainOrAppName,keys))
{
returnnewDecryptionResponse(DecryptionStatus.DomainOrAppNameCheckFailed,null,established,siteId,siteKey.SiteId,null,advertisingTokenVersion,privacyBits.IsClientSideGenerated,expiry);
}

if(!DoesTokenHaveValidLifetime(clientType,keys,now,expiry,now))
returnnewDecryptionResponse(DecryptionStatus.InvalidTokenLifetime,null,established,siteId,siteKey.SiteId,null,advertisingTokenVersion,privacyBits.IsClientSideGenerated,expiry);

returnnewDecryptionResponse(DecryptionStatus.Success,idString,established,siteId,siteKey.SiteId,null,advertisingTokenVersion,privacyBits.IsClientSideGenerated,expiry);
}

privatestaticDecryptionResponseDecryptV3(byte[]encryptedId,KeyContainerkeys,DateTimenow,IdentityScopeidentityScope,intadvertisingTokenVersion,stringdomainOrAppName,ClientTypeclientType)
{
if(encryptedId.Length<TOKEN_V3_MIN_LENGTH)
{
returnDecryptionResponse.MakeError(DecryptionStatus.InvalidPayload);
}

IdentityTypeidentityType=GetIdentityType(encryptedId);

varreader=newBigEndianByteReader(newMemoryStream(encryptedId));

varprefix=reader.ReadByte();
if(DecodeIdentityScopeV3(prefix)!=identityScope)
{
returnDecryptionResponse.MakeError(DecryptionStatus.InvalidIdentityScope);
}

// version
reader.ReadByte();

varmasterKeyId=reader.ReadInt32();

if(!keys.TryGetKey(masterKeyId,outvarmasterKey))
{
returnDecryptionResponse.MakeError(DecryptionStatus.NotAuthorizedForMasterKey);
}

varmasterDecrypted=DecryptGCM(newByteArraySlice(encryptedId,6,encryptedId.Length-6),masterKey.Secret);
varmasterPayloadReader=newBigEndianByteReader(newMemoryStream(masterDecrypted));

longexpiresMilliseconds=masterPayloadReader.ReadInt64();
longgeneratedMilliseconds=masterPayloadReader.ReadInt64();
vargenerated=DateTimeUtils.FromEpochMilliseconds(generatedMilliseconds);

intoperatorSiteId=masterPayloadReader.ReadInt32();
byteoperatorType=masterPayloadReader.ReadByte();
intoperatorVersion=masterPayloadReader.ReadInt32();
intoperatorKeyId=masterPayloadReader.ReadInt32();

varsiteKeyId=masterPayloadReader.ReadInt32();

if(!keys.TryGetKey(siteKeyId,outvarsiteKey))
{
returnDecryptionResponse.MakeError(DecryptionStatus.NotAuthorizedForKey);
}

varsitePayload=DecryptGCM(newByteArraySlice(masterDecrypted,33,masterDecrypted.Length-33),siteKey.Secret);
varsitePayloadReader=newBigEndianByteReader(newMemoryStream(sitePayload));

varsiteId=sitePayloadReader.ReadInt32();
varpublisherId=sitePayloadReader.ReadInt64();
varpublisherKeyId=sitePayloadReader.ReadInt32();

varprivacyBits=newPrivacyBits(sitePayloadReader.ReadInt32());

varestablishedMilliseconds=sitePayloadReader.ReadInt64();
varrefreshedMilliseconds=sitePayloadReader.ReadInt64();

varid=sitePayloadReader.ReadBytes(sitePayload.Length-36);

varestablished=DateTimeUtils.FromEpochMilliseconds(establishedMilliseconds);
varidString=Convert.ToBase64String(id);

varexpiry=DateTimeUtils.FromEpochMilliseconds(expiresMilliseconds);
if(expiry<now)
{
returnnewDecryptionResponse(DecryptionStatus.ExpiredToken,null,established,siteId,siteKey.SiteId,identityType,advertisingTokenVersion,privacyBits.IsClientSideGenerated,expiry);
}

if(privacyBits.IsOptedOut)
{
returnnewDecryptionResponse(DecryptionStatus.UserOptedOut,null,established,siteId,siteKey.SiteId,identityType,advertisingTokenVersion,privacyBits.IsClientSideGenerated,expiry);
}

if(!IsDomainOrAppNameAllowedForSite(clientType,privacyBits,siteId,domainOrAppName,keys))
{
returnnewDecryptionResponse(DecryptionStatus.DomainOrAppNameCheckFailed,null,established,siteId,siteKey.SiteId,identityType,advertisingTokenVersion,privacyBits.IsClientSideGenerated,expiry);
}

if(!DoesTokenHaveValidLifetime(clientType,keys,generated,expiry,now))
returnnewDecryptionResponse(DecryptionStatus.InvalidTokenLifetime,null,established,siteId,siteKey.SiteId,identityType,advertisingTokenVersion,privacyBits.IsClientSideGenerated,expiry);

returnnewDecryptionResponse(DecryptionStatus.Success,idString,established,siteId,siteKey.SiteId,identityType,advertisingTokenVersion,privacyBits.IsClientSideGenerated,expiry);
}

privatestaticboolDoesTokenHaveValidLifetime(ClientTypeclientType,KeyContainerkeys,DateTimegeneratedOrNow,DateTimeexpiry,DateTimenow)
{
longmaxLifetimeSeconds;
switch(clientType)
{
caseClientType.Bidstream:
maxLifetimeSeconds=keys.MaxBidstreamLifetimeSeconds;
break;
caseClientType.Sharing:
maxLifetimeSeconds=keys.MaxSharingLifetimeSeconds;
break;
default://Legacy
returntrue;
}

//generatedOrNow allows "now" for token v2, since v2 does not contain a "token generated" field. v2 therefore checks against remaining lifetime rather than total lifetime.
returnDoesTokenHaveValidLifetimeImpl(generatedOrNow,expiry,now,maxLifetimeSeconds,keys.AllowClockSkewSeconds);
}


privatestaticboolDoesTokenHaveValidLifetimeImpl(DateTimegeneratedOrNow,DateTimeexpiry,DateTimenow,longmaxLifetimeSeconds,longallowClockSkewSeconds)
{
if((expiry-generatedOrNow).TotalSeconds>maxLifetimeSeconds)
returnfalse;

return(generatedOrNow-now).TotalSeconds<=allowClockSkewSeconds;//returns false if token generated too far in the future
}

privatestaticboolIsDomainOrAppNameAllowedForSite(ClientTypeclientType,PrivacyBitsprivacyBits,intsiteId,stringdomainOrAppName,KeyContainerkeys)
{
if(!privacyBits.IsClientSideGenerated)
returntrue;

if(clientType!=ClientType.Bidstream&&clientType!=ClientType.LegacyWithDomainOrAppNameCheck)
returntrue;

returnkeys.IsDomainOrAppNameAllowedForSite(siteId,domainOrAppName);
}

internalstaticEncryptionDataResponseEncrypt(stringrawUid,KeyContainerkeys,IdentityScopeidentityScope,DateTimenow)
{
if(keys==null)
{
returnEncryptionDataResponse.MakeError(EncryptionStatus.NotInitialized);
}
elseif(!keys.IsValid(now))
{
returnEncryptionDataResponse.MakeError(EncryptionStatus.KeysNotSynced);
}


if(!keys.TryGetMasterKey(now,outvarmasterKey))
{
returnEncryptionDataResponse.MakeError(EncryptionStatus.NotAuthorizedForMasterKey);
}

if(!keys.TryGetDefaultKey(now,outvardefaultKey))
{
returnEncryptionDataResponse.MakeError(EncryptionStatus.NotAuthorizedForKey);
}

varexpiry=now.AddSeconds(keys.TokenExpirySeconds);
#pragma warning disable CS0618//warning CS0618: 'UID2TokenGenerator' is obsolete: 'This class shouldn't be used outside of the SDK and will be made internal in a future release'
varencryptParams=UID2TokenGenerator.DefaultParams.WithTokenGenerated(now).WithTokenExpiry(expiry);

try
{
stringadvertisingToken=(identityScope==IdentityScope.UID2)
?UID2TokenGenerator.GenerateUid2TokenV4(rawUid,masterKey,keys.CallerSiteId,defaultKey,encryptParams)
:UID2TokenGenerator.GenerateEuidTokenV4(rawUid,masterKey,keys.CallerSiteId,defaultKey,encryptParams);
#pragma warning restore CS0618//warning CS0618: 'UID2TokenGenerator' is obsolete: 'This class shouldn't be used outside of the SDK and will be made internal in a future release'
returnEncryptionDataResponse.MakeSuccess(advertisingToken);
}
catch(Exception)
{
returnEncryptionDataResponse.MakeError(EncryptionStatus.EncryptionFailure);
}
}

internalstaticEncryptionDataResponseEncryptData(EncryptionDataRequestrequest,KeyContainerkeys,IdentityScopeidentityScope)
{
if(request.Data==null)
{
thrownewArgumentNullException("data");
}

DateTimenow=request.Now;
Keykey=request.Key;
intsiteId=-1;
if(key==null)
{
intsiteKeySiteId=-1;
if(keys==null)
{
returnEncryptionDataResponse.MakeError(EncryptionStatus.NotInitialized);
}
elseif(!keys.IsValid(now))
{
returnEncryptionDataResponse.MakeError(EncryptionStatus.KeysNotSynced);
}
elseif(request.SiteId.HasValue&&request.AdvertisingToken!=null)
{
thrownewArgumentException("only one of siteId or advertisingToken can be specified");
}
elseif(request.SiteId.HasValue)
{
siteId=request.SiteId.Value;
siteKeySiteId=siteId;
}
else
{
try
{
// if the enableDomainOrAppNameCheck param is enabled , the caller would have to provide siteId as part of the EncryptionDataRequest.
DecryptionResponsedecryptedToken=Decrypt(request.AdvertisingToken,keys,now,domainOrAppName:null,identityScope,ClientType.LegacyWithoutDomainOrAppNameCheck);
if(!decryptedToken.Success)
{
returnEncryptionDataResponse.MakeError(EncryptionStatus.TokenDecryptFailure);
}

siteId=decryptedToken.SiteId.Value;
siteKeySiteId=decryptedToken.SiteKeySiteId.Value;
}
catch(Exception)
{
returnEncryptionDataResponse.MakeError(EncryptionStatus.TokenDecryptFailure);
}
}

if(!keys.TryGetActiveSiteKey(siteKeySiteId,now,outkey))
{
returnEncryptionDataResponse.MakeError(EncryptionStatus.NotAuthorizedForKey);
}
}
elseif(!key.IsActive(now))
{
returnEncryptionDataResponse.MakeError(EncryptionStatus.KeyInactive);
}
else
{
siteId=key.SiteId;
}

byte[]iv=request.InitializationVector;
if(iv==null)
{
iv=GenerateIV(GCM_IV_LENGTH);
}

try
{
varpayloadStream=newMemoryStream(request.Data.Length+12);
varpayloadWriter=newBigEndianByteWriter(payloadStream);
payloadWriter.Write(DateTimeUtils.DateTimeToEpochMilliseconds(now));
payloadWriter.Write(siteId);
payloadWriter.Write(request.Data);

byte[]encryptedData=EncryptGCM(payloadStream.ToArray(),iv,key.Secret);
varms=newMemoryStream(encryptedData.Length+GCM_IV_LENGTH+GCM_AUTHTAG_LENGTH+6);
varwriter=newBigEndianByteWriter(ms);
writer.Write((byte)((int)PayloadType.ENCRYPTED_DATA_V3|((int)identityScope<<4)|0xB));
writer.Write((byte)112);// version
writer.Write((int)key.Id);
writer.Write(iv);
writer.Write(encryptedData);
returnEncryptionDataResponse.MakeSuccess(Convert.ToBase64String(ms.ToArray()));
}
catch(Exception)
{
returnEncryptionDataResponse.MakeError(EncryptionStatus.EncryptionFailure);
}
}

internalstaticDecryptionDataResponseDecryptData(byte[]encryptedBytes,KeyContainerkeys,IdentityScopeidentityScope)
{
if((encryptedBytes[0]&224)==(int)PayloadType.ENCRYPTED_DATA_V3)
{
returnDecryptDataV3(encryptedBytes,keys,identityScope);
}
else
{
returnDecryptDataV2(encryptedBytes,keys);
}
}

internalstaticDecryptionDataResponseDecryptDataV2(byte[]encryptedBytes,KeyContainerkeys)
{
varreader=newBigEndianByteReader(newMemoryStream(encryptedBytes));
if(reader.ReadByte()!=(byte)PayloadType.ENCRYPTED_DATA)
{
returnDecryptionDataResponse.MakeError(DecryptionStatus.InvalidPayloadType);
}

if(reader.ReadByte()!=1)
{
returnDecryptionDataResponse.MakeError(DecryptionStatus.VersionNotSupported);
}

DateTimeencryptedAt=DateTimeUtils.FromEpochMilliseconds(reader.ReadInt64());
intsiteId=reader.ReadInt32();
longkeyId=reader.ReadInt32();

if(!keys.TryGetKey(keyId,outvarkey))
{
returnDecryptionDataResponse.MakeError(DecryptionStatus.NotAuthorizedForKey);
}

byte[]iv=reader.ReadBytes(16);
byte[]decryptedData=Decrypt(newByteArraySlice(encryptedBytes,34,encryptedBytes.Length-34),iv,key.Secret);

returnDecryptionDataResponse.MakeSuccess(decryptedData,encryptedAt);
}

internalstaticDecryptionDataResponseDecryptDataV3(byte[]encryptedBytes,KeyContainerkeys,IdentityScopeidentityScope)
{
varreader=newBigEndianByteReader(newMemoryStream(encryptedBytes));
varpayloadScope=DecodeIdentityScopeV3(reader.ReadByte());
if(payloadScope!=identityScope)
{
returnDecryptionDataResponse.MakeError(DecryptionStatus.InvalidIdentityScope);
}

if(reader.ReadByte()!=112)
{
returnDecryptionDataResponse.MakeError(DecryptionStatus.VersionNotSupported);
}

longkeyId=reader.ReadInt32();
if(!keys.TryGetKey(keyId,outvarkey))
{
returnDecryptionDataResponse.MakeError(DecryptionStatus.NotAuthorizedForKey);
}

vardecryptedBytes=DecryptGCM(newByteArraySlice(encryptedBytes,6,encryptedBytes.Length-6),key.Secret);
vardecryptedReader=newBigEndianByteReader(newMemoryStream(decryptedBytes));

DateTimeencryptedAt=DateTimeUtils.FromEpochMilliseconds(decryptedReader.ReadInt64());
intsiteId=decryptedReader.ReadInt32();

vardecryptedData=newbyte[decryptedBytes.Length-12];
Array.Copy(decryptedBytes,12,decryptedData,0,decryptedData.Length);

returnDecryptionDataResponse.MakeSuccess(decryptedData,encryptedAt);
}

privatestaticbyte[]Decrypt(ByteArraySlicearraySlice,byte[]iv,byte[]secret)
{
using(varr=newRijndaelManaged(){Key=secret,IV=iv,Mode=CipherMode.CBC})
using(varm=newMemoryStream(arraySlice.Buffer,arraySlice.Offset,arraySlice.Count))
using(varcs=newCryptoStream(m,r.CreateDecryptor(),CryptoStreamMode.Read))
using(varms=newMemoryStream())
{
cs.CopyTo(ms);
returnms.ToArray();
}
}

privatestaticbyte[]Encrypt(byte[]data,byte[]iv,byte[]secret)
{
using(varr=newRijndaelManaged(){Key=secret,IV=iv,Mode=CipherMode.CBC})
using(varm=newMemoryStream(data))
using(varcs=newCryptoStream(m,r.CreateEncryptor(),CryptoStreamMode.Read))
using(varms=newMemoryStream())
{
ms.Write(iv,0,16);
cs.CopyTo(ms);

returnms.ToArray();
}
}

internalstatic(byte[],byte[])EncryptGCM(byte[]data,byte[]secret)
{
variv=GenerateIV(GCM_IV_LENGTH);
return(iv,EncryptGCM(data,iv,secret));
}

internalstaticbyte[]EncryptGCM(byte[]data,byte[]iv,byte[]secret)
{
varcipher=newGcmBlockCipher(newAesEngine());
varparameters=newAeadParameters(newKeyParameter(secret),GCM_AUTHTAG_LENGTH*8,iv,null);
cipher.Init(true,parameters);
varcipherText=newbyte[cipher.GetOutputSize(data.Length)];
varlen=cipher.ProcessBytes(data,0,data.Length,cipherText,0);
cipher.DoFinal(cipherText,len);
returncipherText;
}

internalstaticbyte[]DecryptGCM(ByteArraySlicecipherText,byte[]secret)
{
variv=newbyte[GCM_IV_LENGTH];
Array.Copy(cipherText.Buffer,cipherText.Offset,iv,0,iv.Length);
varcipher=newGcmBlockCipher(newAesEngine());
varparameters=newAeadParameters(newKeyParameter(secret),GCM_AUTHTAG_LENGTH*8,iv,null);
cipher.Init(false,parameters);
varplainText=newbyte[cipher.GetOutputSize(cipherText.Count-GCM_IV_LENGTH)];
varlen=cipher.ProcessBytes(cipherText.Buffer,cipherText.Offset+GCM_IV_LENGTH,cipherText.Count-GCM_IV_LENGTH,plainText,0);
cipher.DoFinal(plainText,len);
returnplainText;
}

privatestaticbyte[]GenerateIV(intlen=16)
{
byte[]iv=newbyte[len];
RNGCryptoServiceProvider.Create().GetBytes(iv);
returniv;
}

privatestaticIdentityScopeDecodeIdentityScopeV3(bytevalue)
{
return(IdentityScope)((value>>4)&1);
}

privatestaticIdentityTypeGetIdentityType(byte[]encryptedId)
{
// For specifics about the bitwise logic, check:
// Confluence - UID2-79 UID2 Token v3/v4 and Raw UID2 format v3
// In the base64-encoded version of encryptedId, the first character is always either A/B/E/F.
// After converting to binary and performing the AND operation against 1100,the result is always 0X00.
// So just bitshift right twice to get 000X, which results in either 0 or 1.
byteidType=encryptedId[0];
bytepiiType=(byte)((idType&0b_1100)>>2);
returnpiiType==0?IdentityType.Email:IdentityType.Phone;
}
}
}