feat(policy): Default Platform Keys

[c-r33d]

Proposed Changes

1.) Add a new table to represent default kas keys
2.) Add SetDefaultKey / GetDefaultKeys rpcs
3.) Allow for keys of the same algorithm to be created even if another is active
4.) Fix an issue with rotate where service level code could not get key

Checklist

• I have added or updated unit tests
• I have added or updated integration tests (if appropriate)
• I have added or updated documentation

Testing Instructions

[github-actions]

Benchmark results, click to expand

Benchmark Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	467.243652ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	370.092489ms
Throughput	270.20 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m19.991485197s
Average Latency	798.074818ms
Throughput	62.51 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4946
Failed Requests	54
Concurrent Requests	50
Total Time	1m10.114710038s
Average Latency	695.560958ms
Throughput	70.54 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	54 occurrences

Standard Benchmark Metrics Skipped or Failed

[github-actions]

Benchmark results, click to expand

Benchmark Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	452.380104ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	362.222492ms
Throughput	276.07 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m17.432656578s
Average Latency	771.656401ms
Throughput	64.57 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4945
Failed Requests	55
Concurrent Requests	50
Total Time	1m8.780043948s
Average Latency	683.971668ms
Throughput	71.90 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	55 occurrences

Standard Benchmark Metrics Skipped or Failed

[Copilot]

Pull Request Overview

Adds support for default Key Access Server (KAS) keys, including storage, RPCs, and configuration updates.

• Introduces a new default_kas_keys table with migrations
• Defines SetDefaultKey and GetDefaultKeys RPCs in the proto and implements handlers
• Updates DB layer, service logic, and well-known configuration on default key changes

Reviewed Changes

Copilot reviewed 15 out of 19 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
service/wellknownconfiguration/wellknown_configuration.go	Adds UpdateConfiguration for writing well-known configs
service/policy/kasregistry/key_access_server_registry.proto	Defines TdfType, SetDefaultKey, GetDefaultKeys messages
service/policy/kasregistry/key_access_server_registry.go	Implements service handlers for the new RPCs
service/policy/db/migrations/20250512000000_default_keys_table.md	Adds mermaid ER diagram for default_kas_keys
service/policy/db/schema_erd.md	Updates ERD to include default_kas_keys table
service/policy/db/query.sql.go	Adds queries for default KAS key CRUD
service/policy/db/models.go	Adds DefaultKasKey model
service/policy/db/key_access_server_registry.go	Implements DB client logic for default keys, migrations & config
service/pkg/db/marshalHelpers.go	Adds JSON/proto helpers for default KAS keys

Files not reviewed (4)

• docs/grpc/index.html: Language not supported
• docs/openapi/policy/kasregistry/key_access_server_registry.swagger.json: Language not supported
• service/policy/db/migrations/20250512000000_default_keys_table.sql: Language not supported
• service/policy/db/query.sql: Language not supported

Comments suppressed due to low confidence (3)

service/policy/db/models.go:3

• [nitpick] The sqlc version was downgraded from v1.29.0 to v1.28.0; please confirm this was intentional.

//   sqlc v1.29.0

service/policy/kasregistry/key_access_server_registry.proto:617

• Remove the trailing semicolon after the message block; .proto message definitions should not end with a semicolon.

};

service/policy/kasregistry/key_access_server_registry.go:476

• SetDefaultKeyRequest has no GetId() method. Use the objectID variable (which holds the active key ID) instead of r.Msg.GetId().

return nil, db.StatusifyError(err, db.ErrTextUpdateFailed, slog.String("SetDefaultKey", r.Msg.GetId()))

[github-actions]

Benchmark results, click to expand

Benchmark Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	436.454196ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	353.925887ms
Throughput	282.55 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m17.124436604s
Average Latency	769.491192ms
Throughput	64.83 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4945
Failed Requests	55
Concurrent Requests	50
Total Time	1m7.530558142s
Average Latency	672.472655ms
Throughput	73.23 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	55 occurrences

Standard Benchmark Metrics Skipped or Failed

[github-actions]

Benchmark results, click to expand

Benchmark Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	464.556716ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	367.638227ms
Throughput	272.01 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m18.96296025s
Average Latency	787.412748ms
Throughput	63.32 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4953
Failed Requests	47
Concurrent Requests	50
Total Time	1m10.50798793s
Average Latency	700.986848ms
Throughput	70.25 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	47 occurrences

Standard Benchmark Metrics Skipped or Failed

[gemini-code-assist]

Code Review

This pull request introduces significant new functionality for managing default platform keys, including a new database table, RPCs for setting and getting default keys, and changes to allow multiple active keys of the same algorithm. The changes also include a fix for a key rotation issue. Overall, the implementation looks solid, with good test coverage for the new features. I've identified a few areas for improvement, primarily around documentation clarity and a potential data handling concern in marshalHelpers.go.

Summary of Findings

• Data Handling in UnmarshalSimpleKasKey: There are assumptions in service/pkg/db/marshalHelpers.go UnmarshalSimpleKasKey about how algorithm and PEM data are stored/retrieved from the database versus their protobuf definitions. This could lead to runtime issues if the actual data format differs. (Severity: High)
• Documentation Clarity for Default Key: Several comments and descriptions in generated documentation (gRPC HTML, OpenAPI, .pb.go comments) refer to the default base key as a "list of keys" when it appears to be a single key. This should be clarified for consistency. (Severity: Medium)
• Missing Descriptions in Generated Documentation: Some fields in the auto-generated gRPC HTML and OpenAPI documentation are missing descriptions, which impacts clarity. (Severity: Medium)
• Efficiency of CreateKey DB Interaction: The CreateKey method in service/policy/db/key_access_server_registry.go now involves two database queries instead of potentially one. This might have a minor performance impact if it's a high-frequency operation. (Severity: Medium)
• Minor Typos in Comments/Docs: There are a couple of minor typos (e.g., "tp" instead of "to") in comments and documentation. (Severity: Low - not commented directly due to settings)
• Use of context.TODO(): context.TODO() is used during service initialization in service/policy/kasregistry/key_access_server_registry.go. While often acceptable for init, passing a real context is preferred if feasible. (Severity: Low - not commented directly due to settings)
• SQLC Version Change: Generated sqlc files show a version change from v1.29.0 to v1.28.0 (downgrade). This is likely a tooling/process note rather than a code issue. (Severity: Low - not commented directly due to settings)

Merge Readiness

This pull request introduces valuable functionality for default platform keys and includes important fixes. The integration tests for the new features are comprehensive.

However, there are a few points to address before merging, particularly the high-severity concern regarding data handling in UnmarshalSimpleKasKey and several medium-severity documentation clarity issues. Addressing these will improve the robustness and maintainability of the code.

I am unable to approve pull requests, but I recommend addressing the high and medium severity issues before this PR is merged. Other reviewers should also assess these changes.

[github-actions]

Benchmark results, click to expand

Benchmark Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	450.76132ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	362.219125ms
Throughput	276.08 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m15.042526042s
Average Latency	748.236432ms
Throughput	66.63 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4949
Failed Requests	51
Concurrent Requests	50
Total Time	1m7.372068917s
Average Latency	668.432747ms
Throughput	73.46 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	51 occurrences

Standard Benchmark Metrics Skipped or Failed

[github-actions]

Benchmark results, click to expand

Benchmark Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	430.635877ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	366.511995ms
Throughput	272.84 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m18.371112343s
Average Latency	781.807053ms
Throughput	63.80 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4942
Failed Requests	58
Concurrent Requests	50
Total Time	1m8.37580269s
Average Latency	679.866544ms
Throughput	72.28 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	58 occurrences

Standard Benchmark Metrics Skipped or Failed

[github-actions]

Benchmark results, click to expand

Benchmark Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	443.368584ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	367.875884ms
Throughput	271.83 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m19.305882047s
Average Latency	791.430783ms
Throughput	63.05 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4948
Failed Requests	52
Concurrent Requests	50
Total Time	1m8.940869596s
Average Latency	685.019817ms
Throughput	71.77 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	52 occurrences

Standard Benchmark Metrics Skipped or Failed

[github-actions]

Benchmark results, click to expand

Benchmark Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	430.309756ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	360.360839ms
Throughput	277.50 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m15.656585645s
Average Latency	754.883105ms
Throughput	66.09 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4943
Failed Requests	57
Concurrent Requests	50
Total Time	1m6.30607413s
Average Latency	659.509472ms
Throughput	74.55 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	57 occurrences

Standard Benchmark Metrics Skipped or Failed