couchbase 3.0.3-universal-darwin-20

data/ext/couchbase/capabilities.hxx

@@ -0,0 +1,117 @@
+/* -*- Mode: C++; tab-width: 4; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/*
+ *     Copyright 2020 Couchbase, Inc.
+ *
+ *   Licensed under the Apache License, Version 2.0 (the "License");
+ *   you may not use this file except in compliance with the License.
+ *   You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *   Unless required by applicable law or agreed to in writing, software
+ *   distributed under the License is distributed on an "AS IS" BASIS,
+ *   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *   See the License for the specific language governing permissions and
+ *   limitations under the License.
+ */
+
+#pragma once
+
+#include <spdlog/fmt/fmt.h>
+
+namespace couchbase
+{
+enum class bucket_capability {
+    couchapi,
+    xattr,
+    dcp,
+    cbhello,
+    touch,
+    cccp,
+    xdcr_checkpointing,
+    nodes_ext,
+    collections,
+    durable_write,
+    tombstoned_user_xattrs,
+};
+
+enum class cluster_capability {
+    n1ql_cost_based_optimizer,
+    n1ql_index_advisor,
+    n1ql_javascript_functions,
+    n1ql_inline_functions,
+    n1ql_enhanced_prepared_statements,
+};
+} // namespace couchbase
+
+template<>
+struct fmt::formatter<couchbase::bucket_capability> : formatter<std::string_view> {
+    template<typename FormatContext>
+    auto format(couchbase::bucket_capability type, FormatContext& ctx)
+    {
+        string_view name = "unknown";
+        switch (type) {
+            case couchbase::bucket_capability::couchapi:
+                name = "couchapi";
+                break;
+            case couchbase::bucket_capability::xattr:
+                name = "xattr";
+                break;
+            case couchbase::bucket_capability::dcp:
+                name = "dcp";
+                break;
+            case couchbase::bucket_capability::cbhello:
+                name = "cbhello";
+                break;
+            case couchbase::bucket_capability::touch:
+                name = "touch";
+                break;
+            case couchbase::bucket_capability::cccp:
+                name = "cccp";
+                break;
+            case couchbase::bucket_capability::xdcr_checkpointing:
+                name = "xdcr_checkpointing";
+                break;
+            case couchbase::bucket_capability::nodes_ext:
+                name = "nodes_ext";
+                break;
+            case couchbase::bucket_capability::collections:
+                name = "collections";
+                break;
+            case couchbase::bucket_capability::durable_write:
+                name = "durable_write";
+                break;
+            case couchbase::bucket_capability::tombstoned_user_xattrs:
+                name = "tombstoned_user_xattrs";
+                break;
+        }
+        return formatter<string_view>::format(name, ctx);
+    }
+};
+
+template<>
+struct fmt::formatter<couchbase::cluster_capability> : formatter<std::string_view> {
+    template<typename FormatContext>
+    auto format(couchbase::cluster_capability type, FormatContext& ctx)
+    {
+        string_view name = "unknown";
+        switch (type) {
+            case couchbase::cluster_capability::n1ql_cost_based_optimizer:
+                name = "n1ql_cost_based_optimizer";
+                break;
+            case couchbase::cluster_capability::n1ql_index_advisor:
+                name = "n1ql_index_advisor";
+                break;
+            case couchbase::cluster_capability::n1ql_javascript_functions:
+                name = "n1ql_javascript_functions";
+                break;
+            case couchbase::cluster_capability::n1ql_inline_functions:
+                name = "n1ql_inline_functions";
+                break;
+            case couchbase::cluster_capability::n1ql_enhanced_prepared_statements:
+                name = "n1ql_enhanced_prepared_statements";
+                break;
+        }
+        return formatter<string_view>::format(name, ctx);
+    }
+};

data/ext/couchbase/cbcrypto/cbcrypto.cc

@@ -0,0 +1,888 @@
+/* -*- Mode: C++; tab-width: 4; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/*
+ *     Copyright 2016 Couchbase, Inc.
+ *
+ *   Licensed under the Apache License, Version 2.0 (the "License");
+ *   you may not use this file except in compliance with the License.
+ *   You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *   Unless required by applicable law or agreed to in writing, software
+ *   distributed under the License is distributed on an "AS IS" BASIS,
+ *   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *   See the License for the specific language governing permissions and
+ *   limitations under the License.
+ */
+#include <cbcrypto/cbcrypto.h>
+
+#include <memory>
+#include <stdexcept>
+
+namespace internal
+{
+
+#ifdef _MSC_VER
+#include <windows.h>
+
+#include <bcrypt.h>
+
+struct HeapAllocDeleter {
+    void operator()(PBYTE bytes)
+    {
+        HeapFree(GetProcessHeap(), 0, bytes);
+    }
+};
+
+using uniqueHeapPtr = std::unique_ptr<BYTE, HeapAllocDeleter>;
+
+static inline std::string
+hash(std::string_view key, std::string_view data, LPCWSTR algorithm, int flags)
+{
+    BCRYPT_ALG_HANDLE hAlg;
+    NTSTATUS status = BCryptOpenAlgorithmProvider(&hAlg, algorithm, nullptr, flags);
+    if (status < 0) {
+        throw std::runtime_error("digest: BCryptOpenAlgorithmProvider return: " + std::to_string(status));
+    }
+
+    DWORD pcbResult = 0;
+    DWORD cbHashObject = 0;
+
+    // calculate the size of the buffer to hold the hash object
+    status = BCryptGetProperty(hAlg, BCRYPT_OBJECT_LENGTH, (PBYTE)&cbHashObject, sizeof(DWORD), &pcbResult, 0);
+    if (status < 0) {
+        BCryptCloseAlgorithmProvider(hAlg, 0);
+        throw std::runtime_error("digest: BCryptGetProperty return: " + std::to_string(status));
+    }
+
+    // calculate the length of the hash
+    DWORD cbHash = 0;
+    status = BCryptGetProperty(hAlg, BCRYPT_HASH_LENGTH, (PBYTE)&cbHash, sizeof(DWORD), &pcbResult, 0);
+    if (status < 0) {
+        BCryptCloseAlgorithmProvider(hAlg, 0);
+        throw std::runtime_error("digest: BCryptGetProperty return: " + std::to_string(status));
+    }
+
+    // allocate the hash object on the heap
+    uniqueHeapPtr pbHashObject((PBYTE)HeapAlloc(GetProcessHeap(), 0, cbHashObject));
+    if (!pbHashObject) {
+        BCryptCloseAlgorithmProvider(hAlg, 0);
+        throw std::bad_alloc();
+    }
+
+    std::string ret;
+    ret.resize(cbHash);
+
+    // create the hash
+    BCRYPT_HASH_HANDLE hHash;
+    status = BCryptCreateHash(hAlg, &hHash, pbHashObject.get(), cbHashObject, (PUCHAR)key.data(), ULONG(key.size()), 0);
+    if (status < 0) {
+        BCryptCloseAlgorithmProvider(hAlg, 0);
+        throw std::runtime_error("digest: BCryptCreateHash return: " + std::to_string(status));
+    }
+
+    status = BCryptHashData(hHash, (PBYTE)data.data(), ULONG(data.size()), 0);
+    if (status < 0) {
+        BCryptCloseAlgorithmProvider(hAlg, 0);
+        BCryptDestroyHash(hHash);
+        throw std::runtime_error("digest: BCryptHashData return: " + std::to_string(status));
+    }
+
+    status = BCryptFinishHash(hHash, reinterpret_cast<uint8_t*>(ret.data()), cbHash, 0);
+
+    // Release resources
+    BCryptCloseAlgorithmProvider(hAlg, 0);
+    BCryptDestroyHash(hHash);
+
+    if (status < 0) {
+        throw std::runtime_error("digest: BCryptFinishHash return: " + std::to_string(status));
+    }
+
+    return ret;
+}
+
+static std::string
+HMAC_SHA1(std::string_view key, std::string_view data)
+{
+    return hash(key, data, BCRYPT_SHA1_ALGORITHM, BCRYPT_ALG_HANDLE_HMAC_FLAG);
+}
+
+static std::string
+HMAC_SHA256(std::string_view key, std::string_view data)
+{
+    return hash(key, data, BCRYPT_SHA256_ALGORITHM, BCRYPT_ALG_HANDLE_HMAC_FLAG);
+}
+
+static std::string
+HMAC_SHA512(std::string_view key, std::string_view data)
+{
+    return hash(key, data, BCRYPT_SHA512_ALGORITHM, BCRYPT_ALG_HANDLE_HMAC_FLAG);
+}
+
+static inline std::string
+PBKDF2(const std::string& pass, std::string_view salt, unsigned int iterationCount, LPCWSTR algorithm)
+{
+    // open an algorithm handle
+    BCRYPT_ALG_HANDLE hAlg;
+    NTSTATUS status;
+
+    status = BCryptOpenAlgorithmProvider(&hAlg, algorithm, nullptr, BCRYPT_ALG_HANDLE_HMAC_FLAG);
+    if (status < 0) {
+        throw std::runtime_error("digest: BCryptOpenAlgorithmProvider return: " + std::to_string(status));
+    }
+
+    DWORD pcbResult = 0;
+    DWORD cbHashObject = 0;
+
+    // calculate the length of the hash
+    DWORD cbHash = 0;
+    status = BCryptGetProperty(hAlg, BCRYPT_HASH_LENGTH, (PBYTE)&cbHash, sizeof(DWORD), &pcbResult, 0);
+    if (status < 0) {
+        BCryptCloseAlgorithmProvider(hAlg, 0);
+        throw std::runtime_error("digest: BCryptGetProperty return: " + std::to_string(status));
+    }
+
+    std::string ret;
+    ret.resize(cbHash);
+
+    status = BCryptDeriveKeyPBKDF2(hAlg,
+                                   (PUCHAR)pass.data(),
+                                   ULONG(pass.size()),
+                                   (PUCHAR)salt.data(),
+                                   ULONG(salt.size()),
+                                   iterationCount,
+                                   (PUCHAR)ret.data(),
+                                   ULONG(ret.size()),
+                                   0);
+
+    // Release resources
+    BCryptCloseAlgorithmProvider(hAlg, 0);
+
+    if (status < 0) {
+        throw std::runtime_error("digest: BCryptDeriveKeyPBKDF2 return: " + std::to_string(status));
+    }
+
+    return ret;
+}
+
+static std::string
+PBKDF2_HMAC_SHA1(const std::string& pass, std::string_view salt, unsigned int iterationCount)
+{
+    return PBKDF2(pass, salt, iterationCount, BCRYPT_SHA1_ALGORITHM);
+}
+
+static std::string
+PBKDF2_HMAC_SHA256(const std::string& pass, std::string_view salt, unsigned int iterationCount)
+{
+    return PBKDF2(pass, salt, iterationCount, BCRYPT_SHA256_ALGORITHM);
+}
+
+static std::string
+PBKDF2_HMAC_SHA512(const std::string& pass, std::string_view salt, unsigned int iterationCount)
+{
+    return PBKDF2(pass, salt, iterationCount, BCRYPT_SHA512_ALGORITHM);
+}
+
+static std::string
+digest_sha1(std::string_view data)
+{
+    return hash({}, data, BCRYPT_SHA1_ALGORITHM, 0);
+}
+
+static std::string
+digest_sha256(std::string_view data)
+{
+    return hash({}, data, BCRYPT_SHA256_ALGORITHM, 0);
+}
+
+static std::string
+digest_sha512(std::string_view data)
+{
+    return hash({}, data, BCRYPT_SHA512_ALGORITHM, 0);
+}
+
+std::string
+AES_256_cbc(bool encrypt, std::string_view key, std::string_view iv, std::string_view data)
+{
+    BCRYPT_ALG_HANDLE hAlg;
+    NTSTATUS status = BCryptOpenAlgorithmProvider(&hAlg, BCRYPT_AES_ALGORITHM, nullptr, 0);
+
+    if (status < 0) {
+        throw std::runtime_error("encrypt: BCryptOpenAlgorithmProvider() return: " + std::to_string(status));
+    }
+
+    DWORD cbData = 0;
+    DWORD cbKeyObject = 0;
+
+    // Calculate the size of the buffer to hold the KeyObject.
+    status = BCryptGetProperty(hAlg, BCRYPT_OBJECT_LENGTH, (PBYTE)&cbKeyObject, sizeof(DWORD), &cbData, 0);
+    if (status < 0) {
+        BCryptCloseAlgorithmProvider(hAlg, 0);
+        throw std::runtime_error("encrypt: BCryptGetProperty() return: " + std::to_string(status));
+    }
+
+    // Allocate the key object on the heap.
+    uniqueHeapPtr pbKeyObject((PBYTE)HeapAlloc(GetProcessHeap(), 0, cbKeyObject));
+    if (!pbKeyObject) {
+        BCryptCloseAlgorithmProvider(hAlg, 0);
+        throw std::bad_alloc();
+    }
+
+    status = BCryptSetProperty(hAlg, BCRYPT_CHAINING_MODE, (PBYTE)BCRYPT_CHAIN_MODE_CBC, sizeof(BCRYPT_CHAIN_MODE_CBC), 0);
+    if (status < 0) {
+        BCryptCloseAlgorithmProvider(hAlg, 0);
+        throw std::runtime_error("encrypt: BCryptSetProperty() return: " + std::to_string(status));
+    }
+
+    // Generate the key from supplied input key bytes.
+    BCRYPT_KEY_HANDLE hKey;
+    status = BCryptGenerateSymmetricKey(hAlg, &hKey, pbKeyObject.get(), cbKeyObject, (PBYTE)key.data(), ULONG(key.size()), 0);
+    if (status < 0) {
+        BCryptCloseAlgorithmProvider(hAlg, 0);
+        throw std::runtime_error("encrypt: BCryptGenerateSymmetricKey() return: " + std::to_string(status));
+    }
+
+    // For some reason the API will modify the input vector.. just create a
+    // copy.. it's small anyway
+    std::string civ;
+    std::copy(iv.begin(), iv.end(), std::back_inserter(civ));
+
+    std::string ret;
+    ret.resize(data.size() + iv.size());
+    if (encrypt) {
+        status = BCryptEncrypt(hKey,
+                               (PUCHAR)data.data(),
+                               ULONG(data.size()),
+                               nullptr,
+                               (PBYTE)civ.data(),
+                               ULONG(civ.size()),
+                               reinterpret_cast<uint8_t*>(ret.data()),
+                               ULONG(ret.size()),
+                               &cbData,
+                               BCRYPT_BLOCK_PADDING);
+    } else {
+        status = BCryptDecrypt(hKey,
+                               (PUCHAR)data.data(),
+                               ULONG(data.size()),
+                               nullptr,
+                               (PBYTE)civ.data(),
+                               ULONG(civ.size()),
+                               reinterpret_cast<uint8_t*>(ret.data()),
+                               ULONG(ret.size()),
+                               &cbData,
+                               BCRYPT_BLOCK_PADDING);
+    }
+
+    BCryptCloseAlgorithmProvider(hAlg, 0);
+    BCryptDestroyKey(hKey);
+
+    if (status < 0) {
+        throw std::runtime_error("encrypt: BCryptEncrypt() return: " + std::to_string(status));
+    }
+
+    ret.resize(cbData);
+
+    return ret;
+}
+
+std::string
+encrypt(const couchbase::crypto::Cipher cipher, std::string_view key, std::string_view iv, std::string_view data)
+{
+    return AES_256_cbc(true, key, iv, data);
+}
+
+std::string
+decrypt(const couchbase::crypto::Cipher cipher, std::string_view key, std::string_view iv, std::string_view data)
+{
+    return AES_256_cbc(false, key, iv, data);
+}
+
+#elif defined(__APPLE__)
+
+#include <CommonCrypto/CommonCryptor.h>
+#include <CommonCrypto/CommonDigest.h>
+#include <CommonCrypto/CommonHMAC.h>
+#include <CommonCrypto/CommonKeyDerivation.h>
+
+static std::string
+HMAC_SHA1(std::string_view key, std::string_view data)
+{
+    std::string ret;
+    ret.resize(couchbase::crypto::SHA1_DIGEST_SIZE);
+    CCHmac(kCCHmacAlgSHA1, key.data(), key.size(), data.data(), data.size(), reinterpret_cast<uint8_t*>(ret.data()));
+    return ret;
+}
+
+static std::string
+HMAC_SHA256(std::string_view key, std::string_view data)
+{
+    std::string ret;
+    ret.resize(couchbase::crypto::SHA256_DIGEST_SIZE);
+    CCHmac(kCCHmacAlgSHA256, key.data(), key.size(), data.data(), data.size(), reinterpret_cast<uint8_t*>(ret.data()));
+    return ret;
+}
+
+static std::string
+HMAC_SHA512(std::string_view key, std::string_view data)
+{
+    std::string ret;
+    ret.resize(couchbase::crypto::SHA512_DIGEST_SIZE);
+    CCHmac(kCCHmacAlgSHA512, key.data(), key.size(), data.data(), data.size(), reinterpret_cast<uint8_t*>(ret.data()));
+    return ret;
+}
+
+static std::string
+PBKDF2_HMAC_SHA1(const std::string& pass, std::string_view salt, unsigned int iterationCount)
+{
+    std::string ret;
+    ret.resize(couchbase::crypto::SHA1_DIGEST_SIZE);
+    auto err = CCKeyDerivationPBKDF(kCCPBKDF2,
+                                    pass.data(),
+                                    pass.size(),
+                                    reinterpret_cast<const uint8_t*>(salt.data()),
+                                    salt.size(),
+                                    kCCPRFHmacAlgSHA1,
+                                    iterationCount,
+                                    reinterpret_cast<uint8_t*>(ret.data()),
+                                    ret.size());
+
+    if (err != 0) {
+        throw std::runtime_error("couchbase::crypto::PBKDF2_HMAC(SHA1): CCKeyDerivationPBKDF failed: " + std::to_string(err));
+    }
+    return ret;
+}
+
+static std::string
+PBKDF2_HMAC_SHA256(const std::string& pass, std::string_view salt, unsigned int iterationCount)
+{
+    std::string ret;
+    ret.resize(couchbase::crypto::SHA256_DIGEST_SIZE);
+    auto err = CCKeyDerivationPBKDF(kCCPBKDF2,
+                                    pass.data(),
+                                    pass.size(),
+                                    reinterpret_cast<const uint8_t*>(salt.data()),
+                                    salt.size(),
+                                    kCCPRFHmacAlgSHA256,
+                                    iterationCount,
+                                    reinterpret_cast<uint8_t*>(ret.data()),
+                                    ret.size());
+    if (err != 0) {
+        throw std::runtime_error("couchbase::crypto::PBKDF2_HMAC(SHA256): CCKeyDerivationPBKDF "
+                                 "failed: " +
+                                 std::to_string(err));
+    }
+    return ret;
+}
+
+static std::string
+PBKDF2_HMAC_SHA512(const std::string& pass, std::string_view salt, unsigned int iterationCount)
+{
+    std::string ret;
+    ret.resize(couchbase::crypto::SHA512_DIGEST_SIZE);
+    auto err = CCKeyDerivationPBKDF(kCCPBKDF2,
+                                    pass.data(),
+                                    pass.size(),
+                                    reinterpret_cast<const uint8_t*>(salt.data()),
+                                    salt.size(),
+                                    kCCPRFHmacAlgSHA512,
+                                    iterationCount,
+                                    reinterpret_cast<uint8_t*>(ret.data()),
+                                    ret.size());
+    if (err != 0) {
+        throw std::runtime_error("couchbase::crypto::PBKDF2_HMAC(SHA512): CCKeyDerivationPBKDF "
+                                 "failed: " +
+                                 std::to_string(err));
+    }
+    return ret;
+}
+
+static std::string
+digest_sha1(std::string_view data)
+{
+    std::string ret;
+    ret.resize(couchbase::crypto::SHA1_DIGEST_SIZE);
+    CC_SHA1(data.data(), static_cast<CC_LONG>(data.size()), reinterpret_cast<uint8_t*>(ret.data()));
+    return ret;
+}
+
+static std::string
+digest_sha256(std::string_view data)
+{
+    std::string ret;
+    ret.resize(couchbase::crypto::SHA256_DIGEST_SIZE);
+    CC_SHA256(data.data(), static_cast<CC_LONG>(data.size()), reinterpret_cast<uint8_t*>(ret.data()));
+    return ret;
+}
+
+static std::string
+digest_sha512(std::string_view data)
+{
+    std::string ret;
+    ret.resize(couchbase::crypto::SHA512_DIGEST_SIZE);
+    CC_SHA512(data.data(), static_cast<CC_LONG>(data.size()), reinterpret_cast<uint8_t*>(ret.data()));
+    return ret;
+}
+
+/**
+ * Validate that the input parameters for the encryption cipher specified
+ * is supported and contains the right buffers.
+ *
+ * Currently only AES_256_cbc is supported
+ */
+static void
+validateEncryptionCipher(const couchbase::crypto::Cipher cipher, std::string_view key, std::string_view iv)
+{
+    switch (cipher) {
+        case couchbase::crypto::Cipher::AES_256_cbc:
+            if (key.size() != kCCKeySizeAES256) {
+                throw std::invalid_argument("couchbase::crypto::validateEncryptionCipher: Cipher requires a "
+                                            "key "
+                                            "length of " +
+                                            std::to_string(kCCKeySizeAES256) + " provided key with length " + std::to_string(key.size()));
+            }
+
+            if (iv.size() != 16) {
+                throw std::invalid_argument("couchbase::crypto::validateEncryptionCipher: Cipher requires a "
+                                            "iv "
+                                            "length of 16 provided iv with length " +
+                                            std::to_string(iv.size()));
+            }
+            return;
+    }
+
+    throw std::invalid_argument("couchbase::crypto::validateEncryptionCipher: Unknown Cipher " + std::to_string(int(cipher)));
+}
+
+std::string
+encrypt(const couchbase::crypto::Cipher cipher, std::string_view key, std::string_view iv, std::string_view data)
+{
+    size_t outputsize = 0;
+    std::string ret;
+    ret.resize(data.size() + kCCBlockSizeAES128);
+
+    validateEncryptionCipher(cipher, key, iv);
+
+    auto status = CCCrypt(kCCEncrypt,
+                          kCCAlgorithmAES128,
+                          kCCOptionPKCS7Padding,
+                          key.data(),
+                          kCCKeySizeAES256,
+                          iv.data(),
+                          data.data(),
+                          data.size(),
+                          reinterpret_cast<uint8_t*>(ret.data()),
+                          ret.size(),
+                          &outputsize);
+
+    if (status != kCCSuccess) {
+        throw std::runtime_error("couchbase::crypto::encrypt: CCCrypt failed: " + std::to_string(status));
+    }
+
+    ret.resize(outputsize);
+    return ret;
+}
+
+std::string
+decrypt(const couchbase::crypto::Cipher cipher, std::string_view key, std::string_view iv, std::string_view data)
+{
+    size_t outputsize = 0;
+    std::string ret;
+    ret.resize(data.size());
+
+    validateEncryptionCipher(cipher, key, iv);
+
+    auto status = CCCrypt(kCCDecrypt,
+                          kCCAlgorithmAES128,
+                          kCCOptionPKCS7Padding,
+                          key.data(),
+                          kCCKeySizeAES256,
+                          iv.data(),
+                          data.data(),
+                          data.size(),
+                          reinterpret_cast<uint8_t*>(ret.data()),
+                          ret.size(),
+                          &outputsize);
+
+    if (status != kCCSuccess) {
+        throw std::runtime_error("couchbase::crypto::decrypt: CCCrypt failed: " + std::to_string(status));
+    }
+
+    ret.resize(outputsize);
+    return ret;
+}
+
+#else
+
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/md5.h>
+#include <openssl/sha.h>
+
+// OpenSSL
+
+static std::string
+HMAC_SHA1(std::string_view key, std::string_view data)
+{
+    std::string ret;
+    ret.resize(couchbase::crypto::SHA1_DIGEST_SIZE);
+    if (HMAC(EVP_sha1(),
+             key.data(),
+             static_cast<int>(key.size()),
+             reinterpret_cast<const uint8_t*>(data.data()),
+             data.size(),
+             reinterpret_cast<uint8_t*>(ret.data()),
+             nullptr) == nullptr) {
+        throw std::runtime_error("couchbase::crypto::HMAC(SHA1): HMAC failed");
+    }
+    return ret;
+}
+
+static std::string
+HMAC_SHA256(std::string_view key, std::string_view data)
+{
+    std::string ret;
+    ret.resize(couchbase::crypto::SHA256_DIGEST_SIZE);
+    if (HMAC(EVP_sha256(),
+             key.data(),
+             static_cast<int>(key.size()),
+             reinterpret_cast<const uint8_t*>(data.data()),
+             data.size(),
+             reinterpret_cast<uint8_t*>(ret.data()),
+             nullptr) == nullptr) {
+        throw std::runtime_error("couchbase::crypto::HMAC(SHA256): HMAC failed");
+    }
+    return ret;
+}
+
+static std::string
+HMAC_SHA512(std::string_view key, std::string_view data)
+{
+    std::string ret;
+    ret.resize(couchbase::crypto::SHA512_DIGEST_SIZE);
+    if (HMAC(EVP_sha512(),
+             key.data(),
+             static_cast<int>(key.size()),
+             reinterpret_cast<const uint8_t*>(data.data()),
+             data.size(),
+             reinterpret_cast<uint8_t*>(ret.data()),
+             nullptr) == nullptr) {
+        throw std::runtime_error("couchbase::crypto::HMAC(SHA512): HMAC failed");
+    }
+    return ret;
+}
+
+static std::string
+PBKDF2_HMAC_SHA1(const std::string& pass, std::string_view salt, unsigned int iterationCount)
+{
+    std::string ret;
+    ret.resize(couchbase::crypto::SHA1_DIGEST_SIZE);
+    auto err = PKCS5_PBKDF2_HMAC(pass.data(),
+                                 int(pass.size()),
+                                 reinterpret_cast<const uint8_t*>(salt.data()),
+                                 int(salt.size()),
+                                 int(iterationCount),
+                                 EVP_sha1(),
+                                 couchbase::crypto::SHA1_DIGEST_SIZE,
+                                 reinterpret_cast<uint8_t*>(ret.data()));
+
+    if (err != 1) {
+        throw std::runtime_error("couchbase::crypto::PBKDF2_HMAC(SHA1): PKCS5_PBKDF2_HMAC_SHA1 "
+                                 "failed: " +
+                                 std::to_string(err));
+    }
+
+    return ret;
+}
+
+static std::string
+PBKDF2_HMAC_SHA256(const std::string& pass, std::string_view salt, unsigned int iterationCount)
+{
+    std::string ret;
+    ret.resize(couchbase::crypto::SHA256_DIGEST_SIZE);
+    auto err = PKCS5_PBKDF2_HMAC(pass.data(),
+                                 int(pass.size()),
+                                 reinterpret_cast<const uint8_t*>(salt.data()),
+                                 int(salt.size()),
+                                 int(iterationCount),
+                                 EVP_sha256(),
+                                 couchbase::crypto::SHA256_DIGEST_SIZE,
+                                 reinterpret_cast<uint8_t*>(ret.data()));
+    if (err != 1) {
+        throw std::runtime_error("couchbase::crypto::PBKDF2_HMAC(SHA256): PKCS5_PBKDF2_HMAC failed" + std::to_string(err));
+    }
+
+    return ret;
+}
+
+static std::string
+PBKDF2_HMAC_SHA512(const std::string& pass, std::string_view salt, unsigned int iterationCount)
+{
+    std::string ret;
+    ret.resize(couchbase::crypto::SHA512_DIGEST_SIZE);
+    auto err = PKCS5_PBKDF2_HMAC(pass.data(),
+                                 int(pass.size()),
+                                 reinterpret_cast<const uint8_t*>(salt.data()),
+                                 int(salt.size()),
+                                 int(iterationCount),
+                                 EVP_sha512(),
+                                 couchbase::crypto::SHA512_DIGEST_SIZE,
+                                 reinterpret_cast<uint8_t*>(ret.data()));
+    if (err != 1) {
+        throw std::runtime_error("couchbase::crypto::PBKDF2_HMAC(SHA512): PKCS5_PBKDF2_HMAC failed" + std::to_string(err));
+    }
+
+    return ret;
+}
+
+static std::string
+digest_sha1(std::string_view data)
+{
+    std::string ret;
+    ret.resize(couchbase::crypto::SHA1_DIGEST_SIZE);
+    SHA1(reinterpret_cast<const uint8_t*>(data.data()), data.size(), reinterpret_cast<uint8_t*>(ret.data()));
+    return ret;
+}
+
+static std::string
+digest_sha256(std::string_view data)
+{
+    std::string ret;
+    ret.resize(couchbase::crypto::SHA256_DIGEST_SIZE);
+    SHA256(reinterpret_cast<const uint8_t*>(data.data()), data.size(), reinterpret_cast<uint8_t*>(ret.data()));
+    return ret;
+}
+
+static std::string
+digest_sha512(std::string_view data)
+{
+    std::string ret;
+    ret.resize(couchbase::crypto::SHA512_DIGEST_SIZE);
+    SHA512(reinterpret_cast<const uint8_t*>(data.data()), data.size(), reinterpret_cast<uint8_t*>(ret.data()));
+    return ret;
+}
+
+struct EVP_CIPHER_CTX_Deleter {
+    void operator()(EVP_CIPHER_CTX* ctx)
+    {
+        if (ctx != nullptr) {
+            EVP_CIPHER_CTX_free(ctx);
+        }
+    }
+};
+
+using unique_EVP_CIPHER_CTX_ptr = std::unique_ptr<EVP_CIPHER_CTX, EVP_CIPHER_CTX_Deleter>;
+
+/**
+ * Get the OpenSSL Cipher to use for the encryption, and validate
+ * the input key and iv sizes
+ */
+static const EVP_CIPHER*
+getCipher(const couchbase::crypto::Cipher cipher, std::string_view key, std::string_view iv)
+{
+    const EVP_CIPHER* cip = nullptr;
+
+    switch (cipher) {
+        case couchbase::crypto::Cipher::AES_256_cbc:
+            cip = EVP_aes_256_cbc();
+            break;
+    }
+
+    if (cip == nullptr) {
+        throw std::invalid_argument("couchbase::crypto::getCipher: Unknown Cipher " + std::to_string(int(cipher)));
+    }
+
+    if (int(key.size()) != EVP_CIPHER_key_length(cip)) {
+        throw std::invalid_argument("couchbase::crypto::getCipher: Cipher requires a key "
+                                    "length of " +
+                                    std::to_string(EVP_CIPHER_key_length(cip)) + " provided key with length " + std::to_string(key.size()));
+    }
+
+    if (int(iv.size()) != EVP_CIPHER_iv_length(cip)) {
+        throw std::invalid_argument("couchbase::crypto::getCipher: Cipher requires a iv "
+                                    "length of " +
+                                    std::to_string(EVP_CIPHER_iv_length(cip)) + " provided iv with length " + std::to_string(iv.size()));
+    }
+
+    return cip;
+}
+
+std::string
+encrypt(const couchbase::crypto::Cipher cipher, std::string_view key, std::string_view iv, std::string_view data)
+{
+    unique_EVP_CIPHER_CTX_ptr ctx(EVP_CIPHER_CTX_new());
+
+    auto* cip = getCipher(cipher, key, iv);
+    if (EVP_EncryptInit_ex(
+          ctx.get(), cip, nullptr, reinterpret_cast<const uint8_t*>(key.data()), reinterpret_cast<const uint8_t*>(iv.data())) != 1) {
+        throw std::runtime_error("couchbase::crypto::encrypt: EVP_EncryptInit_ex failed");
+    }
+
+    std::string ret;
+    ret.resize(data.size() + static_cast<std::string_view::size_type>(EVP_CIPHER_block_size(cip)));
+    int len1 = int(ret.size());
+
+    if (EVP_EncryptUpdate(
+          ctx.get(), reinterpret_cast<uint8_t*>(ret.data()), &len1, reinterpret_cast<const uint8_t*>(data.data()), int(data.size())) != 1) {
+        throw std::runtime_error("couchbase::crypto::encrypt: EVP_EncryptUpdate failed");
+    }
+
+    int len2 = int(ret.size()) - len1;
+    if (EVP_EncryptFinal_ex(ctx.get(), reinterpret_cast<uint8_t*>(ret.data()) + len1, &len2) != 1) {
+        throw std::runtime_error("couchbase::crypto::encrypt: EVP_EncryptFinal_ex failed");
+    }
+
+    // Resize the destination to the sum of the two length fields
+    ret.resize(size_t(len1) + size_t(len2));
+    return ret;
+}
+
+std::string
+decrypt(const couchbase::crypto::Cipher cipher, std::string_view key, std::string_view iv, std::string_view data)
+{
+    unique_EVP_CIPHER_CTX_ptr ctx(EVP_CIPHER_CTX_new());
+    auto* cip = getCipher(cipher, key, iv);
+
+    if (EVP_DecryptInit_ex(
+          ctx.get(), cip, nullptr, reinterpret_cast<const uint8_t*>(key.data()), reinterpret_cast<const uint8_t*>(iv.data())) != 1) {
+        throw std::runtime_error("couchbase::crypto::decrypt: EVP_DecryptInit_ex failed");
+    }
+
+    std::string ret;
+    ret.resize(data.size());
+    int len1 = int(ret.size());
+
+    if (EVP_DecryptUpdate(
+          ctx.get(), reinterpret_cast<uint8_t*>(ret.data()), &len1, reinterpret_cast<const uint8_t*>(data.data()), int(data.size())) != 1) {
+        throw std::runtime_error("couchbase::crypto::decrypt: EVP_DecryptUpdate failed");
+    }
+
+    int len2 = int(data.size()) - len1;
+    if (EVP_DecryptFinal_ex(ctx.get(), reinterpret_cast<uint8_t*>(ret.data()) + len1, &len2) != 1) {
+        throw std::runtime_error("couchbase::crypto::decrypt: EVP_DecryptFinal_ex failed");
+    }
+
+    // Resize the destination to the sum of the two length fields
+    ret.resize(size_t(len1) + size_t(len2));
+    return ret;
+}
+
+#endif
+
+} // namespace internal
+
+std::string
+couchbase::crypto::HMAC(const Algorithm algorithm, std::string_view key, std::string_view data)
+{
+    switch (algorithm) {
+        case Algorithm::SHA1:
+            return internal::HMAC_SHA1(key, data);
+        case Algorithm::SHA256:
+            return internal::HMAC_SHA256(key, data);
+        case Algorithm::SHA512:
+            return internal::HMAC_SHA512(key, data);
+    }
+
+    throw std::invalid_argument("couchbase::crypto::HMAC: Unknown Algorithm: " + std::to_string(int(algorithm)));
+}
+
+std::string
+couchbase::crypto::PBKDF2_HMAC(const Algorithm algorithm, const std::string& pass, std::string_view salt, unsigned int iterationCount)
+{
+    switch (algorithm) {
+        case Algorithm::SHA1:
+            return internal::PBKDF2_HMAC_SHA1(pass, salt, iterationCount);
+        case Algorithm::SHA256:
+            return internal::PBKDF2_HMAC_SHA256(pass, salt, iterationCount);
+        case Algorithm::SHA512:
+            return internal::PBKDF2_HMAC_SHA512(pass, salt, iterationCount);
+    }
+
+    throw std::invalid_argument("couchbase::crypto::PBKDF2_HMAC: Unknown Algorithm: " + std::to_string(int(algorithm)));
+}
+
+static inline void
+verifyLegalAlgorithm(const couchbase::crypto::Algorithm al)
+{
+    switch (al) {
+        case couchbase::crypto::Algorithm::SHA1:
+        case couchbase::crypto::Algorithm::SHA256:
+        case couchbase::crypto::Algorithm::SHA512:
+            return;
+    }
+    throw std::invalid_argument("verifyLegalAlgorithm: Unknown Algorithm: " + std::to_string(int(al)));
+}
+
+bool
+couchbase::crypto::isSupported(const Algorithm algorithm)
+{
+    verifyLegalAlgorithm(algorithm);
+
+    return true;
+}
+
+std::string
+couchbase::crypto::digest(const Algorithm algorithm, std::string_view data)
+{
+    switch (algorithm) {
+        case Algorithm::SHA1:
+            return internal::digest_sha1(data);
+        case Algorithm::SHA256:
+            return internal::digest_sha256(data);
+        case Algorithm::SHA512:
+            return internal::digest_sha512(data);
+    }
+
+    throw std::invalid_argument("couchbase::crypto::digest: Unknown Algorithm" + std::to_string(int(algorithm)));
+}
+
+std::string
+couchbase::crypto::encrypt(const Cipher cipher, std::string_view key, std::string_view iv, std::string_view data)
+{
+    // We only support a single encryption scheme right now.
+    // Verify the input parameters (no need of calling the internal library
+    // functions in order to fetch these details)
+    if (cipher != Cipher::AES_256_cbc) {
+        throw std::invalid_argument("couchbase::crypto::encrypt(): Unsupported cipher");
+    }
+
+    if (key.size() != 32) {
+        throw std::invalid_argument("couchbase::crypto::encrypt(): Invalid key size: " + std::to_string(key.size()) + " (expected 32)");
+    }
+
+    if (iv.size() != 16) {
+        throw std::invalid_argument("couchbase::crypto::encrypt(): Invalid iv size: " + std::to_string(iv.size()) + " (expected 16)");
+    }
+
+    return internal::encrypt(cipher, key, iv, data);
+}
+
+std::string
+couchbase::crypto::decrypt(const Cipher cipher, std::string_view key, std::string_view iv, std::string_view data)
+{
+    // We only support a single decryption scheme right now.
+    // Verify the input parameters (no need of calling the internal library
+    // functions in order to fetch these details)
+    if (cipher != Cipher::AES_256_cbc) {
+        throw std::invalid_argument("couchbase::crypto::decrypt(): Unsupported cipher");
+    }
+
+    if (key.size() != 32) {
+        throw std::invalid_argument("couchbase::crypto::decrypt(): Invalid key size: " + std::to_string(key.size()) + " (expected 32)");
+    }
+
+    if (iv.size() != 16) {
+        throw std::invalid_argument("couchbase::crypto::decrypt(): Invalid iv size: " + std::to_string(iv.size()) + " (expected 16)");
+    }
+
+    return internal::decrypt(cipher, key, iv, data);
+}
+
+couchbase::crypto::Cipher
+couchbase::crypto::to_cipher(const std::string& str)
+{
+    if (str == "AES_256_cbc") {
+        return Cipher::AES_256_cbc;
+    }
+
+    throw std::invalid_argument("to_cipher: Unknown cipher: " + str);
+}