Functions/ConvertFrom-FipsSecureString.ps1
|
<#
.SYNOPSIS Converts a SecureString object into encrypted text with a FIPS compliant algorithm using a pre-shared key. The Pre-Shared key can be provided as either a 32 byte array or a SecureString value. .PARAMETER SecureString The SecureString object that will returned as an encrypted string. .PARAMETER Key An array of 32 bytes that will be used as a the pre-shared key for encryption. .PARAMETER SecureKey A SecureString that will be converted into a 32 byte array used as the pre-shared key for encryption. .EXAMPLE ConvertFrom-FIPSSecureString -SecureString $MySecretValue -SecureKey ( ConvertTo-SecureString -String 'Pr3$haredK3y' -AsPlainText -Force ) | Out-File ./encryptedText.txt Encrypts a SecureString object and saves it to disk. #> function ConvertFrom-FIPSSecureString { [CmdletBinding()] param ( [Parameter(Mandatory=$True,Position=1,ValueFromPipeline=$true,ParameterSetName="KeyByte")] [Parameter(Mandatory=$True,Position=1,ValueFromPipeline=$true,ParameterSetName="SecureKey")] [ValidateNotNullOrEmpty()] [System.Security.SecureString] $SecureString, [Parameter(Mandatory=$True,ParameterSetName='KeyByte')] [ValidateNotNullOrEmpty()] [System.Byte[]] $Key, [Parameter(Mandatory=$True,ParameterSetName='SecureKey')] [ValidateNotNullOrEmpty()] [System.Security.SecureString] $SecureKey ) if ($PSBoundParameters.ContainsKey('SecureKey')) { $Key = Convert-SecureStringTo32ByteKey -SecureString $SecureKey } if ($null -eq $Key -or $Key.GetLength(0) -ne 32) { throw 'Key must be provided as a 32byte (256bit) byte array' } $btsr = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($SecureString) $dataBytes = [System.Text.Encoding]::UTF8.GetBytes([Runtime.InteropServices.Marshal]::PtrToStringAuto($btsr)) [Runtime.InteropServices.Marshal]::ZeroFreeBSTR($btsr) $aes = New-Object -TypeName System.Security.Cryptography.AesCryptoServiceProvider $aes.Mode = [System.Security.Cryptography.CipherMode]::CBC $aes.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7 $aes.BlockSize = 128 $aes.KeySize = 256 $aes.Key = $Key $encryptionObject = $aes.CreateEncryptor() Write-Verbose -Message 'Converting SecureString to encrypted string with AESCryptoServiceProvider' [System.Byte[]]$encryptedDataBytes = $aes.IV + ($encryptionObject.TransformFinalBlock($dataBytes,0,$dataBytes.Length)) $aes.Dispose() return [System.Convert]::ToBase64String($encryptedDataBytes) } |