fix: have export call encrypt instead of encapsulate

[strantalis]

Proposed Changes

Checklist

• I have added or updated unit tests
• I have added or updated integration tests (if appropriate)
• I have added or updated documentation

Testing Instructions

[gemini-code-assist]

Summary of Changes

Hello @strantalis, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses a functional correction in the key export mechanism, ensuring that the appropriate encryption method is utilized. It also introduces a safeguard to protect the integrity of sensitive key data during export operations, thereby enhancing the overall security and reliability of the key management process.

Highlights

• Corrected Encryption Method Call: The Export method within AESProtectedKey now correctly invokes the Encrypt method on the Encapsulator interface instead of Encapsulate, aligning with the intended encryption process for key data.
• Enhanced Key Data Safety: A defensive copy of the raw key data (k.rawKey) is now created before being passed to the Encrypt method. This prevents potential unintended modifications to the original key material during the export process.
• Test Suite Alignment: The mockEncapsulator in the test suite has been updated to reflect the change in method invocation, switching from encapsulateFunc to encryptFunc, ensuring the tests accurately validate the new behavior.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

---

Key bytes now secured,Encrypt's call, a safer path,Data flows with grace.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request refactors AESProtectedKey.Export to use encapsulator.Encrypt instead of encapsulator.Encapsulate. This change improves decoupling by passing the raw key data directly, rather than the ProtectedKey object. The implementation correctly creates a defensive copy of the key before encryption. The corresponding unit test is also updated appropriately. The changes are sound and I have no further recommendations.

[dmihalcik-virtru]

I'm guessing this is to enable other Encapsulators (than OCEncapsulator) to work with AESProtectedKey type keys? At first it seemed to me that you should first try down-casting to OCEncapsulator and using its Encapsulate method, then using Encrypt only if that doesn't work, if only to make it clear when the rawKey escapes 'our' code, but that just seems like this with extra steps, so this is fine.