feat: add AES protected key interface and implementation

[strantalis]

Proposed Changes

Add ProtectedKey and Encapsulator interfaces to lib/ocrypto package, along with AESProtectedKey implementation. This exposes previously internal cryptographic functionality for external consumption.

• Add interfaces.go with ProtectedKey and Encapsulator interfaces
• Add protected_key.go with AESProtectedKey implementation
• Add comprehensive test suite in protected_key_test.go
• Use standard error types without logging dependencies

Checklist

• I have added or updated unit tests
• I have added or updated integration tests (if appropriate)
• I have added or updated documentation

Testing Instructions

[gemini-code-assist]

Summary of Changes

Hello @strantalis, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request aims to expose and standardize key management operations within the lib/ocrypto package by introducing new interfaces and a concrete AES-based implementation. This change modularizes cryptographic functionality, allowing for broader and more consistent consumption of protected keys across the system.

Highlights

• New Interfaces: I've introduced ProtectedKey and Encapsulator interfaces in lib/ocrypto/interfaces.go. These interfaces define standard operations for managing and encapsulating cryptographic keys, making previously internal functionality accessible.
• AESProtectedKey Implementation: A concrete implementation, AESProtectedKey, has been added in lib/ocrypto/protected_key.go. This struct implements the ProtectedKey interface, providing methods for AES-GCM decryption, secure key export (with optional encapsulation), and policy binding verification using HMAC-SHA256.
• Comprehensive Testing: I've included a thorough test suite in lib/ocrypto/protected_key_test.go. These tests cover the AESProtectedKey's core functionalities, various error conditions, and ensure its compliance with the ProtectedKey interface, including the use of a mock encapsulator for isolated testing.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments or fill out our survey to provide feedback.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

---

New crypto flows, Keys protected, safe and sound, Code now open wide.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request introduces a new ProtectedKey interface and its AESProtectedKey implementation for cryptographic operations. The changes are well-structured and include a comprehensive test suite.

My review focuses on improving security and code clarity. Key suggestions include:

• Preventing slice aliasing in the constructor and Export method to enhance security by copying the key data.
• Refactoring generateHMACDigest to remove an unused context parameter and a redundant error check.

[strantalis]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces new interfaces for cryptographic operations and an AESProtectedKey implementation. The code is well-structured and includes a comprehensive test suite. The review focuses on improving performance by suggesting to initialize the AES cipher once in the constructor and to correct the AES key sizes in the tests.

[strantalis]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces new interfaces (Encapsulator, ProtectedKey) and an implementation (AESProtectedKey) for cryptographic operations, exposing them for external use. The changes are well-structured and include a comprehensive test suite.

My review focuses on improving API clarity, consistency, and addressing potential security risks. Key points include:

• Refining the new interfaces for better naming and documentation, following Go conventions.
• Highlighting two significant security considerations in AESProtectedKey: the storage of raw keys in memory and the ability to export them unencrypted. These create potential "footgun" scenarios that could lead to accidental key exposure.
• Suggesting improvements to the test suite for better maintainability and to test against the public API rather than internal state.

Overall, the PR is a good addition, but the security implications should be carefully considered and addressed.