Skip to content

fix(core): Updates ec-wrapped to newer salt #1961

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Mar 7, 2025
Merged

fix(core): Updates ec-wrapped to newer salt #1961

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
80652cb
fix(core): Updates ec-wrapped to newer salt
dmihalcik-virtru Mar 4, 2025
27c1d87
Update tdf.go
dmihalcik-virtru Mar 4, 2025
89f2520
fix 500s and other nonspecific errors in bulk
dmihalcik-virtru Mar 5, 2025
fd97c96
Merge branch 'main' into feature/feelin-salty
strantalis Mar 6, 2025
a0c39ab
Merge branch 'main' into feature/feelin-salty
dmihalcik-virtru Mar 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 5 additions & 2 deletions lib/ocrypto/asym_decryption.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,8 +107,11 @@ type ECDecryptor struct {
}

func NewECDecryptor(sk *ecdh.PrivateKey) (ECDecryptor, error) {
// TK Make these reasonable? IIRC salt should be longer, info maybe a parameters?
salt := []byte("salt")
// TK Move salt and info out of library, into API option functions
digest := sha256.New()
digest.Write([]byte("TDF"))
salt := digest.Sum(nil)

return ECDecryptor{sk, salt, nil}, nil
}

Expand Down
6 changes: 4 additions & 2 deletions lib/ocrypto/asym_encryption.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,8 +81,10 @@ func FromPublicPEM(publicKeyInPem string) (PublicKeyEncryptor, error) {

func newECIES(pub *ecdh.PublicKey) (ECEncryptor, error) {
ek, err := pub.Curve().GenerateKey(rand.Reader)
// TK Make these reasonable? IIRC salt should be longer, info maybe a parameters?
salt := []byte("salt")
// TK Move salt and info out of library, into API option functions
digest := sha256.New()
digest.Write([]byte("TDF"))
salt := digest.Sum(nil)
return ECEncryptor{pub, ek, salt, nil}, err
}

Expand Down
7 changes: 6 additions & 1 deletion sdk/kas_client.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ package sdk

import (
"context"
"crypto/sha256"
"errors"
"fmt"
"net"
Expand Down Expand Up @@ -194,7 +195,11 @@ func (k *KASClient) handleECKeyResponse(response *kas.RewrapResponse) (map[strin
if err != nil {
return nil, fmt.Errorf("ocrypto.ComputeECDHKey failed: %w", err)
}
sessionKey, err := ocrypto.CalculateHKDF([]byte("salt"), ecdhKey)

digest := sha256.New()
digest.Write([]byte("TDF"))
salt := digest.Sum(nil)
sessionKey, err := ocrypto.CalculateHKDF(salt, ecdhKey)
if err != nil {
return nil, fmt.Errorf("ocrypto.CalculateHKDF failed: %w", err)
}
Expand Down
6 changes: 5 additions & 1 deletion sdk/tdf.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ package sdk
import (
"bytes"
"context"
"crypto/sha256"
"encoding/hex"
"encoding/json"
"errors"
Expand Down Expand Up @@ -579,7 +580,10 @@ func generateWrapKeyWithEC(mode ocrypto.ECCMode, kasPublicKey string, symKey []b
return ecKeyWrappedKeyInfo{}, fmt.Errorf("ocrypto.ComputeECDHKey failed:%w", err)
}

sessionKey, err := ocrypto.CalculateHKDF([]byte("salt"), ecdhKey)
digest := sha256.New()
digest.Write([]byte("TDF"))
salt := digest.Sum(nil)
sessionKey, err := ocrypto.CalculateHKDF(salt, ecdhKey)
if err != nil {
return ecKeyWrappedKeyInfo{}, fmt.Errorf("ocrypto.CalculateHKDF failed:%w", err)
}
Expand Down
Loading