Skip to content

Commit 29f21a0

Browse files
strantalisstrantalis
committed
rebase on main and update ocrypto
1 parent 7bfa8d5 commit 29f21a0

File tree

7 files changed

+52
-19
lines changed

7 files changed

+52
-19
lines changed

‎service/internal/security/basic_manager.go‎

Lines changed: 31 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,6 @@ import (
1212
"log/slog"
1313

1414
"github.com/opentdf/platform/lib/ocrypto"
15-
"github.com/opentdf/platform/protocol/go/policy"
1615
"github.com/opentdf/platform/service/logger"
1716
"github.com/opentdf/platform/service/pkg/cache"
1817
"github.com/opentdf/platform/service/trust"
@@ -50,7 +49,7 @@ func (b *BasicManager) Name() string {
5049
return BasicManagerName
5150
}
5251

53-
func (b *BasicManager) Decrypt(ctx context.Context, keyDetails trust.KeyDetails, ciphertext []byte, ephemeralPublicKey []byte) (trust.ProtectedKey, error) {
52+
func (b *BasicManager) Decrypt(ctx context.Context, keyDetails trust.KeyDetails, ciphertext []byte, ephemeralPublicKey []byte) (ocrypto.ProtectedKey, error) {
5453
// Implementation of Decrypt method
5554

5655
// Get Private Key
@@ -75,8 +74,12 @@ func (b *BasicManager) Decrypt(ctx context.Context, keyDetails trust.KeyDetails,
7574
if err != nil {
7675
return nil, fmt.Errorf("failed to decrypt with RSA: %w", err)
7776
}
78-
return ocrypto.NewAESProtectedKey(plaintext), nil
79-
case policy.Algorithm_ALGORITHM_EC_P256.String(), policy.Algorithm_ALGORITHM_EC_P384.String(), policy.Algorithm_ALGORITHM_EC_P521.String():
77+
protectedKey, err := ocrypto.NewAESProtectedKey(plaintext)
78+
if err != nil {
79+
return nil, fmt.Errorf("failed to create protected key: %w", err)
80+
}
81+
return protectedKey, nil
82+
case ocrypto.EC256Key, ocrypto.EC384Key, ocrypto.EC521Key:
8083
ecPrivKey, err := ocrypto.ECPrivateKeyFromPem(privKey)
8184
if err != nil {
8285
return nil, fmt.Errorf("failed to create EC private key from PEM: %w", err)
@@ -89,13 +92,17 @@ func (b *BasicManager) Decrypt(ctx context.Context, keyDetails trust.KeyDetails,
8992
if err != nil {
9093
return nil, fmt.Errorf("failed to decrypt with ephemeral key: %w", err)
9194
}
92-
return ocrypto.NewAESProtectedKey(plaintext), nil
95+
protectedKey, err := ocrypto.NewAESProtectedKey(plaintext)
96+
if err != nil {
97+
return nil, fmt.Errorf("failed to create protected key: %w", err)
98+
}
99+
return protectedKey, nil
93100
}
94101

95102
return nil, fmt.Errorf("unsupported algorithm: %s", keyDetails.Algorithm())
96103
}
97104

98-
func (b *BasicManager) DeriveKey(ctx context.Context, keyDetails trust.KeyDetails, ephemeralPublicKeyBytes []byte, curve elliptic.Curve) (trust.ProtectedKey, error) {
105+
func (b *BasicManager) DeriveKey(ctx context.Context, keyDetails trust.KeyDetails, ephemeralPublicKeyBytes []byte, curve elliptic.Curve) (ocrypto.ProtectedKey, error) {
99106
// Implementation of DeriveKey method
100107
privateKeyCtx, err := keyDetails.ExportPrivateKey(ctx)
101108
if err != nil {
@@ -131,22 +138,35 @@ func (b *BasicManager) DeriveKey(ctx context.Context, keyDetails trust.KeyDetail
131138
if err != nil {
132139
return nil, fmt.Errorf("failed to calculate HKDF: %w", err)
133140
}
134-
return ocrypto.NewAESProtectedKey(key), nil
141+
protectedKey, err := ocrypto.NewAESProtectedKey(key)
142+
if err != nil {
143+
return nil, fmt.Errorf("failed to create protected key: %w", err)
144+
}
145+
return protectedKey, nil
135146
}
136147

137148
type OCEncapsulator struct {
138149
ocrypto.PublicKeyEncryptor
139150
}
140151

141-
func (e *OCEncapsulator) Encapsulate(dek trust.ProtectedKey) ([]byte, error) {
142-
ipk, ok := dek.(*InProcessAESKey)
152+
func (e *OCEncapsulator) Encapsulate(dek ocrypto.ProtectedKey) ([]byte, error) {
153+
ipk, ok := dek.(*ocrypto.AESProtectedKey)
143154
if !ok {
144155
return nil, errors.New("invalid DEK type for encapsulation")
145156
}
146-
return e.Encrypt(ipk.rawKey)
157+
// Export the raw key without encryption
158+
rawKey, err := ipk.Export(nil)
159+
if err != nil {
160+
return nil, fmt.Errorf("failed to export raw key: %w", err)
161+
}
162+
return e.Encrypt(rawKey)
163+
}
164+
165+
func (e *OCEncapsulator) PublicKeyAsPEM() (string, error) {
166+
return e.PublicKeyEncryptor.PublicKeyInPemFormat()
147167
}
148168

149-
func (b *BasicManager) GenerateECSessionKey(_ context.Context, ephemeralPublicKey string) (trust.Encapsulator, error) {
169+
func (b *BasicManager) GenerateECSessionKey(_ context.Context, ephemeralPublicKey string) (ocrypto.Encapsulator, error) {
150170
pke, err := ocrypto.FromPublicPEMWithSalt(ephemeralPublicKey, NanoVersionSalt(), nil)
151171
if err != nil {
152172
return nil, fmt.Errorf("failed to create public key encryptor: %w", err)

‎service/internal/security/basic_manager_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -276,7 +276,7 @@ func TestBasicManager_Decrypt(t *testing.T) {
276276
bm, err := NewBasicManager(log, testCache, rootKeyHex)
277277
require.NoError(t, err)
278278

279-
samplePayload := []byte("secret payload")
279+
samplePayload := []byte("secret payload16") // 16 bytes for valid AES key
280280

281281
t.Run("successful RSA decryption", func(t *testing.T) {
282282
mockDetails := new(MockKeyDetails)

‎service/internal/security/in_process_provider.go‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -251,13 +251,24 @@ func (a *InProcessProvider) Decrypt(ctx context.Context, keyDetails trust.KeyDet
251251
return nil, err
252252
}
253253

254-
return ocrypto.NewAESProtectedKey(rawKey), nil
254+
protectedKey, err := ocrypto.NewAESProtectedKey(rawKey)
255+
if err != nil {
256+
return nil, fmt.Errorf("failed to create protected key: %w", err)
257+
}
258+
return protectedKey, nil
255259
}
256260

257261
// DeriveKey generates a symmetric key for NanoTDF
258262
func (a *InProcessProvider) DeriveKey(_ context.Context, keyDetails trust.KeyDetails, ephemeralPublicKeyBytes []byte, curve elliptic.Curve) (trust.ProtectedKey, error) {
259263
k, err := a.cryptoProvider.GenerateNanoTDFSymmetricKey(string(keyDetails.ID()), ephemeralPublicKeyBytes, curve)
260-
return ocrypto.NewAESProtectedKey(k), err
264+
if err != nil {
265+
return nil, err
266+
}
267+
protectedKey, err := ocrypto.NewAESProtectedKey(k)
268+
if err != nil {
269+
return nil, fmt.Errorf("failed to create protected key: %w", err)
270+
}
271+
return protectedKey, nil
261272
}
262273

263274
// GenerateECSessionKey generates a session key for NanoTDF

‎service/internal/security/standard_crypto.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -439,7 +439,7 @@ func (s *StandardCrypto) ECDecrypt(ctx context.Context, keyID string, ephemeralP
439439
}
440440

441441
// Decrypt implements the SecurityProvider Decrypt method
442-
func (s *StandardCrypto) Decrypt(_ context.Context, keyID trust.KeyIdentifier, ciphertext []byte, ephemeralPublicKey []byte) (trust.ProtectedKey, error) {
442+
func (s *StandardCrypto) Decrypt(_ context.Context, keyID trust.KeyIdentifier, ciphertext []byte, ephemeralPublicKey []byte) (ocrypto.ProtectedKey, error) {
443443
kid := string(keyID)
444444
ska, ok := s.keysByID[kid]
445445
if !ok {
@@ -488,5 +488,5 @@ func (s *StandardCrypto) Decrypt(_ context.Context, keyID trust.KeyIdentifier, c
488488
return nil, fmt.Errorf("unsupported key type for key ID [%s]", kid)
489489
}
490490

491-
return ocrypto.NewAESProtectedKey(rawKey), nil
491+
return ocrypto.NewAESProtectedKey(rawKey)
492492
}

‎service/kas/access/rewrap.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -827,7 +827,7 @@ func (p *Provider) nanoTDFRewrap(ctx context.Context, requests []*kaspb.Unsigned
827827
failAllKaos(requests, results, err400("keypair mismatch"))
828828
return "", results
829829
}
830-
sessionKeyPEM, err := sessionKey.PublicKeyInPemFormat()
830+
sessionKeyPEM, err := sessionKey.PublicKeyAsPEM()
831831
if err != nil {
832832
p.Logger.WarnContext(ctx, "failure in PublicKeyToPem", slog.Any("error", err))
833833
failAllKaos(requests, results, err500(""))

‎service/trust/delegating_key_service_test.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -188,7 +188,7 @@ func (m *MockEncapsulator) Encrypt(data []byte) ([]byte, error) {
188188
return nil, args.Error(1)
189189
}
190190

191-
func (m *MockEncapsulator) PublicKeyInPemFormat() (string, error) {
191+
func (m *MockEncapsulator) PublicKeyAsPEM() (string, error) {
192192
args := m.Called()
193193
return args.String(0), args.Error(1)
194194
}
@@ -201,7 +201,7 @@ func (m *MockEncapsulator) EphemeralKey() []byte {
201201
return nil
202202
}
203203

204-
var _ Encapsulator = (*MockEncapsulator)(nil)
204+
var _ ocrypto.Encapsulator = (*MockEncapsulator)(nil)
205205

206206
type DelegatingKeyServiceTestSuite struct {
207207
suite.Suite

‎service/trust/key_manager.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,9 @@ import (
99

1010
// Type aliases for backward compatibility - these interfaces are now defined in lib/ocrypto
1111
type (
12+
// Deprecated: use ocrypto.Encapsulator
1213
Encapsulator = ocrypto.Encapsulator
14+
// Deprecated: use ocrypto.ProtectedKey
1315
ProtectedKey = ocrypto.ProtectedKey
1416
)
1517

0 commit comments

Comments
 (0)