POC: Embedding Encryption Key-Version Within Encrypted Payload In Lucee CFML 5.3.8.201

<cfscript>

	encryptionKeys = [
		// Let's assume that our very first implementation of encryption used the default
		// algorithm, CFMX_COMPAT, the weakest of the algorithms.
		1: "ThisIsTheOldCfmxCompatKey",

		// Then, we changed our algorithm over to AES (Advanced Encryption Standard) and,
		// over time, rotated our keys to have increasing complexity in order to keep pace
		// with computer hardware processing power. The following keys were generated with
		// the geneateSecretKey() function using 128, 192, and 256 bit sizes respectively.
		2: "Aio9pV1k6f1RFM6oVniM8Q==",
		3: "H1F6/7/tQfdMn/s5cjyOINK/VG6fkNrJ",
		4: "DCdLfVh3bmA24jpUewrjj7trohJADZaJqx7mwfReTME="
	];

	messageEncrypter = new MessageEncrypter( encryptionKeys, 4 );

	// ------------------------------------------------------------------------------- //
	// ------------------------------------------------------------------------------- //

	inputs = [
		// Imagine that our first input here represents the very first implementation of
		// the encrypted values when we were still using CFMX_COMPAT, before we even
		// introduced the idea of key rotation and key versions. This payload will contain
		// JUST THE ENCRYPTED MESSAGE, and will be ASSUMED to be using the oldest key.
		encrypt( "That's kablamo!", encryptionKeys[ 1 ], "cfmx_compat", "hex" ),

		// The rest of the inputs will be "properly versioned" payloads using the much
		// more secure AES encryption algorithm.
		messageEncrypter.encryptMessage( "That's kablamo!", 2 ),
		messageEncrypter.encryptMessage( "That's kablamo!", 3 ),
		messageEncrypter.encryptMessage( "That's kablamo!", 4 ),
		messageEncrypter.encryptMessage( "That's kablamo!" )
	];

	// For each input, let's see if we can property decrypt the message.
	for ( input in inputs ) {

		dump( input );
		dump( messageEncrypter.decryptMessage( input ) );
		echo( "<br />" );

	}

</cfscript>

component
	output = false
	hint = "I provide methods for encrypting and decrypting messages using key versioning."
	{

	/**
	* I initialize the encrypter with the given keys and the preferred key version.
	*/
	public void function init(
		required struct encryptionKeys,
		required numeric desiredKeyVersion,
		string desiredAlgorithm = "aes"
		) {

		variables.encryptionKeys = arguments.encryptionKeys;
		variables.desiredKeyVersion = arguments.desiredKeyVersion;
		variables.desiredAlgorithm = arguments.desiredAlgorithm.lcase();
		// For now, we're hard-coding the encoding for all messages.
		variables.desiredEncoding = "hex";

		if ( ! encryptionKeys.keyExists( desiredKeyVersion ) ) {

			throwVersionNotFoundError( desiredKeyVersion );

		}

	}

	// ---
	// PUBLIC METHODS.
	// ---

	/**
	* I decrypt the following input and return the unencrypted message.
	*/
	public string function decryptMessage( required string input ) {

		var segments = parseInput( input );
		
		return( decrypt( segments.message, segments.key, segments.algorithm, segments.encoding ) );

	}


	/**
	* I encrypt the following input using the desired parameters and return the encrypted
	* payload.
	*/
	public string function encryptMessage(
		required string message,
		numeric keyVersion = desiredKeyVersion,
		string algorithm = desiredAlgorithm
		) {

		var key = encryptionKeys[ keyVersion ];
		var algorithm = algorithm.lcase();
		var encoding = desiredEncoding;

		// The encrypted payload is actually a multi-part opaque token in which the
		// encrypted message is last segment. The encrypted payload also includes the key
		// version and algorithm used to encrypt the message.
		var segments = [
			"v=#keyVersion#",
			"a=#algorithm#",
			encrypt( message, key, algorithm, encoding )
		];

		return( segments.toList().lcase() );

	}

	// ---
	// PRIVATE METHODS.
	// ---

	/**
	* I parse the opaque token input into the individually addressable segments.
	*/
	private struct function parseInput( required string input ) {

		var segments = input.listToArray();

		// Versioned payloads will have a proper list-length.
		if ( segments.len() == 3 ) {

			var keyVersion = segments[ 1 ].listRest( "=" );
			var algorithm = segments[ 2 ].listRest( "=" );
			var message = segments[ 3 ];

		// Any non-versioned payload is assumed to be using the old CFMX_COMPAT algorithm
		// before we changed over to AES and started to version our encryption keys.
		} else {

			var keyVersion = 1;
			var algorithm = "cfmx_compat";
			var message = segments[ 1 ];

		}

		if ( ! encryptionKeys.keyExists( keyVersion ) ) {

			throwVersionNotFoundError( keyVersion );

		}

		return({
			message: message,
			key: encryptionKeys[ keyVersion ],
			algorithm: algorithm,
			encoding: desiredEncoding
		});

	}


	/**
	* I throw a version not found error when the desired version is not in the list of
	* available keys.
	*/
	private void function throwVersionNotFoundError( required numeric version ) {

		throw(
			type = "MessageEncrypter.VersionNotFound",
			message = "The desired encryption key version was not found in the set of available keys.",
			detail = "Desired version: #version#",
			extendedInfo = "Available versions: #encryptionKeys.keyList()#"
		);

	}

}