Skip to content

Commit 2352a1f

Browse files
dmihalcik-virtrudmihalcik-virtru
committed
updates
1 parent c35404a commit 2352a1f

File tree

12 files changed

+45
-117
lines changed

12 files changed

+45
-117
lines changed

‎sdk/tdf.go‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1164,9 +1164,8 @@ func createRewrapRequest(_ context.Context, r *Reader) (map[string]*kas.Unsigned
11641164
Hash: hash,
11651165
Algorithm: alg,
11661166
},
1167-
SplitId: kao.SplitID,
1168-
WrappedKey: key,
1169-
EphemeralPublicKey: kao.EphemeralPublicKey,
1167+
SplitId: kao.SplitID,
1168+
WrappedKey: key,
11701169
},
11711170
}
11721171
if req, ok := kasReqs[kao.KasURL]; ok {

‎sdk/tdf_test.go‎

Lines changed: 1 addition & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,11 @@ import (
44
"archive/zip"
55
"bytes"
66
"context"
7-
"crypto/ecdsa"
87
"crypto/rand"
98
"crypto/rsa"
109
"crypto/sha256"
11-
"crypto/x509"
1210
"encoding/hex"
1311
"encoding/json"
14-
"encoding/pem"
1512
"errors"
1613
"fmt"
1714
"io"
@@ -2320,32 +2317,6 @@ func (f *FakeKas) getRewrapResponse(rewrapRequest string) *kaspb.RewrapResponse
23202317
var entityWrappedKey []byte
23212318
switch kaoReq.GetKeyAccessObject().GetKeyType() {
23222319
case "ec-wrapped":
2323-
// Get the ephemeral public key in PEM format
2324-
ephemeralPubKeyPEM := kaoReq.GetKeyAccessObject().GetEphemeralPublicKey()
2325-
2326-
// Get EC key size and convert to mode
2327-
keySize, err := ocrypto.GetECKeySize([]byte(ephemeralPubKeyPEM))
2328-
f.s.Require().NoError(err, "failed to get EC key size")
2329-
2330-
mode, err := ocrypto.ECSizeToMode(keySize)
2331-
f.s.Require().NoError(err, "failed to convert key size to mode")
2332-
2333-
// Parse the PEM public key
2334-
block, _ := pem.Decode([]byte(ephemeralPubKeyPEM))
2335-
f.s.Require().NoError(err, "failed to decode PEM block")
2336-
2337-
pub, err := x509.ParsePKIXPublicKey(block.Bytes)
2338-
f.s.Require().NoError(err, "failed to parse public key")
2339-
2340-
ecPub, ok := pub.(*ecdsa.PublicKey)
2341-
if !ok {
2342-
f.s.Require().Error(err, "not an EC public key")
2343-
}
2344-
2345-
// Compress the public key
2346-
compressedKey, err := ocrypto.CompressedECPublicKey(mode, *ecPub)
2347-
f.s.Require().NoError(err, "failed to compress public key")
2348-
23492320
kasPrivateKey := strings.ReplaceAll(f.privateKey, "\n\t", "\n")
23502321
if kao.GetKid() != "" && kao.GetKid() != f.KID {
23512322
// old kid
@@ -2360,7 +2331,7 @@ func (f *FakeKas) getRewrapResponse(rewrapRequest string) *kaspb.RewrapResponse
23602331
ed, err := ocrypto.NewSaltedECDecryptor(privateKey, tdfSalt(), nil)
23612332
f.s.Require().NoError(err, "failed to create EC decryptor")
23622333

2363-
symmetricKey, err := ed.DecryptWithEphemeralKey(wrappedKey, compressedKey)
2334+
symmetricKey, err := ed.Decrypt(wrappedKey)
23642335
f.s.Require().NoError(err, "failed to decrypt")
23652336

23662337
asymEncrypt, err := ocrypto.FromPublicPEMWithSalt(bodyData.GetClientPublicKey(), tdfSalt(), nil)

‎service/internal/security/basic_manager.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ func (b *BasicManager) Name() string {
5050
return BasicManagerName
5151
}
5252

53-
func (b *BasicManager) Decrypt(ctx context.Context, keyDetails trust.KeyDetails, ciphertext []byte, ephemeralPublicKey []byte) (trust.ProtectedKey, error) {
53+
func (b *BasicManager) Decrypt(ctx context.Context, keyDetails trust.KeyDetails, ciphertext []byte) (trust.ProtectedKey, error) {
5454
// Implementation of Decrypt method
5555

5656
// Get Private Key
@@ -85,7 +85,7 @@ func (b *BasicManager) Decrypt(ctx context.Context, keyDetails trust.KeyDetails,
8585
if err != nil {
8686
return nil, fmt.Errorf("failed to create ECDecryptor: %w", err)
8787
}
88-
plaintext, err := ecDecryptor.DecryptWithEphemeralKey(ciphertext, ephemeralPublicKey)
88+
plaintext, err := ecDecryptor.Decrypt(ciphertext)
8989
if err != nil {
9090
return nil, fmt.Errorf("failed to decrypt with ephemeral key: %w", err)
9191
}

‎service/internal/security/basic_manager_test.go‎

Lines changed: 6 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -294,7 +294,7 @@ func TestBasicManager_Decrypt(t *testing.T) {
294294
ciphertext, err := rsaEncryptor.Encrypt(samplePayload)
295295
require.NoError(t, err)
296296

297-
protectedKey, err := bm.Decrypt(t.Context(), mockDetails, ciphertext, nil)
297+
protectedKey, err := bm.Decrypt(t.Context(), mockDetails, ciphertext)
298298
require.NoError(t, err)
299299
require.NotNil(t, protectedKey)
300300

@@ -318,9 +318,8 @@ func TestBasicManager_Decrypt(t *testing.T) {
318318
require.NoError(t, err)
319319
ciphertext, err := ecEncryptor.Encrypt(samplePayload)
320320
require.NoError(t, err)
321-
ephemeralPublicKey := ecEncryptor.EphemeralKey()
322321

323-
protectedKey, err := bm.Decrypt(t.Context(), mockDetails, ciphertext, ephemeralPublicKey)
322+
protectedKey, err := bm.Decrypt(t.Context(), mockDetails, ciphertext)
324323
require.NoError(t, err)
325324
require.NotNil(t, protectedKey)
326325

@@ -334,7 +333,7 @@ func TestBasicManager_Decrypt(t *testing.T) {
334333
mockDetails.On("ID").Return(trust.KeyIdentifier("fail-export"))
335334
mockDetails.On("ExportPrivateKey").Return(nil, errors.New("export failed"))
336335

337-
_, err := bm.Decrypt(t.Context(), mockDetails, []byte("ct"), nil)
336+
_, err := bm.Decrypt(t.Context(), mockDetails, []byte("ct"))
338337
require.Error(t, err)
339338
assert.Contains(t, err.Error(), "failed to get private key")
340339
})
@@ -351,7 +350,7 @@ func TestBasicManager_Decrypt(t *testing.T) {
351350
mockDetails.On("Algorithm").Return(mockDetails.MAlgorithm)
352351
mockDetails.On("ExportPrivateKey").Return(&trust.PrivateKey{WrappingKeyID: trust.KeyIdentifier(mockDetails.MPrivateKey.GetKeyId()), WrappedKey: mockDetails.MPrivateKey.GetWrappedKey()}, nil)
353352

354-
_, err = bm.Decrypt(t.Context(), mockDetails, []byte("ct"), nil)
353+
_, err = bm.Decrypt(t.Context(), mockDetails, []byte("ct"))
355354
require.Error(t, err)
356355
assert.Contains(t, err.Error(), "failed to unwrap private key")
357356
})
@@ -366,7 +365,7 @@ func TestBasicManager_Decrypt(t *testing.T) {
366365
mockDetails.On("ID").Return(trust.KeyIdentifier(mockDetails.MID))
367366
mockDetails.On("Algorithm").Return(mockDetails.MAlgorithm)
368367
mockDetails.On("ExportPrivateKey").Return(&trust.PrivateKey{WrappingKeyID: trust.KeyIdentifier(mockDetails.MPrivateKey.GetKeyId()), WrappedKey: mockDetails.MPrivateKey.GetWrappedKey()}, nil) // Ensure this mock is correctly set up
369-
_, err = bm.Decrypt(t.Context(), mockDetails, []byte("ct"), nil)
368+
_, err = bm.Decrypt(t.Context(), mockDetails, []byte("ct"))
370369
require.Error(t, err)
371370
assert.Contains(t, err.Error(), "failed to create decryptor from private PEM")
372371
})
@@ -380,7 +379,7 @@ func TestBasicManager_Decrypt(t *testing.T) {
380379
mockDetails.On("ID").Return(trust.KeyIdentifier(mockDetails.MID))
381380
mockDetails.On("Algorithm").Return(mockDetails.MAlgorithm) // Corrected: require.NoError
382381
mockDetails.On("ExportPrivateKey").Return(&trust.PrivateKey{WrappingKeyID: trust.KeyIdentifier(mockDetails.MPrivateKey.GetKeyId()), WrappedKey: mockDetails.MPrivateKey.GetWrappedKey()}, nil) // Ensure this mock is correctly set up
383-
_, err = bm.Decrypt(t.Context(), mockDetails, []byte("ct"), nil)
382+
_, err = bm.Decrypt(t.Context(), mockDetails, []byte("ct"))
384383
require.Error(t, err)
385384
assert.Contains(t, err.Error(), "unsupported algorithm: unknown-algo")
386385
})
@@ -479,9 +478,6 @@ func TestBasicManager_GenerateECSessionKey(t *testing.T) {
479478
require.NoError(t, err)
480479
require.NotNil(t, encapsulator)
481480

482-
ephemKey := encapsulator.EphemeralKey()
483-
assert.NotEmpty(t, ephemKey, "Ephemeral key should be generated")
484-
485481
sampleData := []byte("test data for encapsulation")
486482
encryptedData, err := encapsulator.Encrypt(sampleData)
487483
require.NoError(t, err)

‎service/internal/security/in_process_provider.go‎

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -297,7 +297,7 @@ func (a *InProcessProvider) ListKeys(ctx context.Context) ([]trust.KeyDetails, e
297297
}
298298

299299
// Decrypt implements the unified decryption method for both RSA and EC
300-
func (a *InProcessProvider) Decrypt(ctx context.Context, keyDetails trust.KeyDetails, ciphertext []byte, ephemeralPublicKey []byte) (trust.ProtectedKey, error) {
300+
func (a *InProcessProvider) Decrypt(ctx context.Context, keyDetails trust.KeyDetails, ciphertext []byte) (trust.ProtectedKey, error) {
301301
kid := string(keyDetails.ID())
302302

303303
// Try to determine the key type
@@ -309,16 +309,10 @@ func (a *InProcessProvider) Decrypt(ctx context.Context, keyDetails trust.KeyDet
309309
var rawKey []byte
310310
switch keyType {
311311
case AlgorithmRSA2048:
312-
if len(ephemeralPublicKey) > 0 {
313-
return nil, errors.New("ephemeral public key should not be provided for RSA decryption")
314-
}
315312
rawKey, err = a.cryptoProvider.RSADecrypt(crypto.SHA1, kid, "", ciphertext)
316313

317314
case AlgorithmECP256R1:
318-
if len(ephemeralPublicKey) == 0 {
319-
return nil, errors.New("ephemeral public key is required for EC decryption")
320-
}
321-
rawKey, err = a.cryptoProvider.ECDecrypt(ctx, kid, ephemeralPublicKey, ciphertext)
315+
rawKey, err = a.cryptoProvider.ECDecrypt(ctx, kid, ciphertext)
322316

323317
default:
324318
return nil, errors.New("unsupported key algorithm")

‎service/internal/security/standard_crypto.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -430,7 +430,7 @@ func NanoVersionSalt() []byte {
430430
}
431431

432432
// ECDecrypt uses hybrid ECIES to decrypt the data.
433-
func (s *StandardCrypto) ECDecrypt(keyID string, ciphertext []byte) ([]byte, error) {
433+
func (s *StandardCrypto) ECDecrypt(_ context.Context, keyID string, ciphertext []byte) ([]byte, error) {
434434
ska, ok := s.keysByID[keyID]
435435
if !ok {
436436
return nil, fmt.Errorf("key [%s] not found", keyID)
@@ -452,7 +452,7 @@ func (s *StandardCrypto) ECDecrypt(keyID string, ciphertext []byte) ([]byte, err
452452
if err != nil {
453453
return nil, err
454454
}
455-
return unwrappedKey.Export(nil)
455+
return ed.Decrypt(ciphertext)
456456
}
457457

458458
// Decrypt implements the SecurityProvider Decrypt method

‎service/kas/access/keyaccess.go‎

Lines changed: 10 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,14 @@
11
package access
22

33
type KeyAccess struct {
4-
EncryptedMetadata string `json:"encryptedMetadata,omitempty"`
5-
PolicyBinding interface{} `json:"policyBinding,omitempty"`
6-
Protocol string `json:"protocol"`
7-
Type string `json:"type"`
8-
URL string `json:"url"`
9-
KID string `json:"kid,omitempty"`
10-
SID string `json:"sid,omitempty"`
11-
WrappedKey []byte `json:"wrappedKey,omitempty"`
12-
Header []byte `json:"header,omitempty"`
13-
Algorithm string `json:"algorithm,omitempty"`
14-
EphemeralPublicKey string `json:"ephemeralPublicKey,omitempty"`
4+
EncryptedMetadata string `json:"encryptedMetadata,omitempty"`
5+
PolicyBinding interface{} `json:"policyBinding,omitempty"`
6+
Protocol string `json:"protocol"`
7+
Type string `json:"type"`
8+
URL string `json:"url"`
9+
KID string `json:"kid,omitempty"`
10+
SID string `json:"sid,omitempty"`
11+
WrappedKey []byte `json:"wrappedKey,omitempty"`
12+
Header []byte `json:"header,omitempty"`
13+
Algorithm string `json:"algorithm,omitempty"`
1514
}

‎service/kas/access/publicKey_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -126,7 +126,7 @@ func (m *MockSecurityProvider) ListKeys(_ context.Context) ([]trust.KeyDetails,
126126
return keys, nil
127127
}
128128

129-
func (m *MockSecurityProvider) Decrypt(_ context.Context, _ trust.KeyDetails, _, _ []byte) (trust.ProtectedKey, error) {
129+
func (m *MockSecurityProvider) Decrypt(_ context.Context, _ trust.KeyDetails, _ []byte) (trust.ProtectedKey, error) {
130130
return nil, errors.New("not implemented for tests")
131131
}
132132

‎service/kas/access/rewrap.go‎

Lines changed: 13 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -164,16 +164,15 @@ func extractAndConvertV1SRTBody(body []byte) (kaspb.UnsignedRewrapRequest, error
164164
{
165165
KeyAccessObjectId: "kao-0",
166166
KeyAccessObject: &kaspb.KeyAccess{
167-
EncryptedMetadata: kao.EncryptedMetadata,
168-
PolicyBinding: &kaspb.PolicyBinding{Hash: binding, Algorithm: kao.Algorithm},
169-
Protocol: kao.Protocol,
170-
KeyType: kao.Type,
171-
KasUrl: kao.URL,
172-
Kid: kao.KID,
173-
SplitId: kao.SID,
174-
WrappedKey: kao.WrappedKey,
175-
Header: kao.Header,
176-
EphemeralPublicKey: kao.EphemeralPublicKey,
167+
EncryptedMetadata: kao.EncryptedMetadata,
168+
PolicyBinding: &kaspb.PolicyBinding{Hash: binding, Algorithm: kao.Algorithm},
169+
Protocol: kao.Protocol,
170+
KeyType: kao.Type,
171+
KasUrl: kao.URL,
172+
Kid: kao.KID,
173+
SplitId: kao.SID,
174+
WrappedKey: kao.WrappedKey,
175+
Header: kao.Header,
177176
},
178177
},
179178
},
@@ -490,34 +489,8 @@ func (p *Provider) verifyRewrapRequests(ctx context.Context, req *kaspb.Unsigned
490489
continue
491490
}
492491

493-
pub, err := x509.ParsePKIXPublicKey(block.Bytes)
494-
if err != nil {
495-
p.Logger.WarnContext(ctx,
496-
"failed to parse public key",
497-
slog.Any("kao", kao),
498-
slog.Any("error", err),
499-
)
500-
failedKAORewrap(results, kao, err400("bad request"))
501-
continue
502-
}
503-
504-
ecPub, ok := pub.(*ecdsa.PublicKey)
505-
if !ok {
506-
p.Logger.WarnContext(ctx, "not an EC public key", slog.Any("error", err))
507-
failedKAORewrap(results, kao, err400("bad request"))
508-
continue
509-
}
510-
511-
// Compress the public key
512-
compressedKey, err := ocrypto.CompressedECPublicKey(mode, *ecPub)
513-
if err != nil {
514-
p.Logger.WarnContext(ctx, "failed to compress public key", slog.Any("error", err))
515-
failedKAORewrap(results, kao, err400("bad request"))
516-
continue
517-
}
518-
519492
kid := trust.KeyIdentifier(kao.GetKeyAccessObject().GetKid())
520-
dek, err = p.KeyDelegator.Decrypt(ctx, kid, kao.GetKeyAccessObject().GetWrappedKey(), compressedKey)
493+
dek, err = p.KeyDelegator.Decrypt(ctx, kid, kao.GetKeyAccessObject().GetWrappedKey())
521494
if err != nil {
522495
p.Logger.WarnContext(ctx, "failed to decrypt EC key", slog.Any("error", err))
523496
failedKAORewrap(results, kao, err400("bad request"))
@@ -537,13 +510,13 @@ func (p *Provider) verifyRewrapRequests(ctx context.Context, req *kaspb.Unsigned
537510
}
538511
}
539512

540-
dek, err = p.KeyDelegator.Decrypt(ctx, kidsToCheck[0], kao.GetKeyAccessObject().GetWrappedKey(), nil)
513+
dek, err = p.KeyDelegator.Decrypt(ctx, kidsToCheck[0], kao.GetKeyAccessObject().GetWrappedKey())
541514
for _, kid := range kidsToCheck[1:] {
542515
p.Logger.WarnContext(ctx, "continue paging through legacy KIDs for kid free kao", slog.Any("error", err))
543516
if err == nil {
544517
break
545518
}
546-
dek, err = p.KeyDelegator.Decrypt(ctx, kid, kao.GetKeyAccessObject().GetWrappedKey(), nil)
519+
dek, err = p.KeyDelegator.Decrypt(ctx, kid, kao.GetKeyAccessObject().GetWrappedKey())
547520
}
548521
}
549522
if err != nil {
@@ -730,7 +703,7 @@ func (p *Provider) tdf3Rewrap(ctx context.Context, requests []*kaspb.UnsignedRew
730703
}
731704

732705
// Use the Export method with the asymEncrypt encryptor
733-
encryptedKey, err := kaoRes.DEK.Export(asymEncrypt)
706+
rewrappedKey, err := kaoRes.DEK.Export(asymEncrypt)
734707
if err != nil {
735708
//nolint:sloglint // reference to camelcase key is intentional
736709
p.Logger.WarnContext(ctx, "rewrap: Export with encryptor failed", slog.String("clientPublicKey", clientPublicKey), slog.Any("error", err))

‎service/trust/delegating_key_service.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@ func (d *DelegatingKeyService) Name() string {
8383
return "DelegatingKeyService"
8484
}
8585

86-
func (d *DelegatingKeyService) Decrypt(ctx context.Context, keyID KeyIdentifier, ciphertext []byte, ephemeralPublicKey []byte) (ProtectedKey, error) {
86+
func (d *DelegatingKeyService) Decrypt(ctx context.Context, keyID KeyIdentifier, ciphertext []byte) (ProtectedKey, error) {
8787
keyDetails, err := d.index.FindKeyByID(ctx, keyID)
8888
if err != nil {
8989
return nil, fmt.Errorf("unable to find key by ID '%s': %w", keyID, err)
@@ -94,7 +94,7 @@ func (d *DelegatingKeyService) Decrypt(ctx context.Context, keyID KeyIdentifier,
9494
return nil, fmt.Errorf("unable to get key manager for system '%s': %w", keyDetails.System(), err)
9595
}
9696

97-
return manager.Decrypt(ctx, keyDetails, ciphertext, ephemeralPublicKey)
97+
return manager.Decrypt(ctx, keyDetails, ciphertext)
9898
}
9999

100100
func (d *DelegatingKeyService) DeriveKey(ctx context.Context, keyID KeyIdentifier, ephemeralPublicKeyBytes []byte, curve elliptic.Curve) (ProtectedKey, error) {

0 commit comments

Comments
 (0)