|
| 1 | +use serde::{Deserialize, Serialize}; |
| 2 | + |
1 | 3 | use crate::{ |
2 | | - CoseKeyBytes, CoseSerializable, CryptoError, EncString, KeyEncryptable, KeyIds, |
3 | | - KeyStoreContext, SignedPublicKey, SignedPublicKeyMessage, SpkiPublicKeyBytes, |
4 | | - SymmetricCryptoKey, |
| 4 | + AsymmetricCryptoKey, AsymmetricPublicCryptoKey, CoseKeyBytes, CoseSerializable, CryptoError, |
| 5 | + EncString, KeyDecryptable, KeyEncryptable, KeyIds, KeyStoreContext, Pkcs8PrivateKeyBytes, |
| 6 | + SignedPublicKey, SignedPublicKeyMessage, SpkiPublicKeyBytes, SymmetricCryptoKey, |
| 7 | + UnsignedSharedKey, |
5 | 8 | }; |
6 | 9 |
|
7 | 10 | /// Rotated set of account keys |
@@ -45,6 +48,123 @@ pub fn dangerous_get_v2_rotated_account_keys<Ids: KeyIds>( |
45 | 48 | }) |
46 | 49 | } |
47 | 50 |
|
| 51 | +/// A set of keys where a given `EncryptionKey` is protected by an encrypted public/private |
| 52 | +/// key-pair. The `EncryptionKey` is used to encrypt/decrypt data, while the public/private key-pair |
| 53 | +/// is used to rotate the `EncryptionKey`. |
| 54 | +/// |
| 55 | +/// The `PrivateKey` is protected by an `ExternalKey`, such as a `DeviceKey`, or `PrfKey`, |
| 56 | +/// and the `PublicKey` is protected by the `EncryptionKey`. This setup allows: |
| 57 | +/// |
| 58 | +/// - Access to `EncryptionKey` by knowing the `ExternalKey` |
| 59 | +/// - Rotation to a `NewEncryptionKey` by knowing the current `EncryptionKey`, without needing access to |
| 60 | +/// the `ExternalKey` |
| 61 | +#[derive(Serialize, Deserialize, Debug)] |
| 62 | +#[serde(rename_all = "camelCase", deny_unknown_fields)] |
| 63 | +#[cfg_attr(feature = "uniffi", derive(uniffi::Record))] |
| 64 | +#[cfg_attr( |
| 65 | + feature = "wasm", |
| 66 | + derive(tsify::Tsify), |
| 67 | + tsify(into_wasm_abi, from_wasm_abi) |
| 68 | +)] |
| 69 | +pub struct RotateableKeySet { |
| 70 | + /// `EncryptionKey` protected by encapsulation key |
| 71 | + encapsulated_encryption_key: UnsignedSharedKey, |
| 72 | + /// Encapsulation key protected by `EncryptionKey` |
| 73 | + encrypted_encapsulation_key: EncString, |
| 74 | + /// Decapsulation key protected by `ExternalKey` |
| 75 | + wrapped_decapsulation_key: EncString, |
| 76 | +} |
| 77 | + |
| 78 | +impl RotateableKeySet { |
| 79 | + /// Create a set of keys to allow access to the user key via the provided |
| 80 | + /// symmetric wrapping key while allowing the user key to be rotated. |
| 81 | + pub fn new<Ids: KeyIds>( |
| 82 | + ctx: &KeyStoreContext<Ids>, |
| 83 | + wrapping_key: &SymmetricCryptoKey, |
| 84 | + key_to_wrap: Ids::Symmetric, |
| 85 | + ) -> Result<Self, CryptoError> { |
| 86 | + let key_pair = AsymmetricCryptoKey::make(crate::PublicKeyEncryptionAlgorithm::RsaOaepSha1); |
| 87 | + |
| 88 | + // This uses this deprecated method and other methods directly on the other keys |
| 89 | + // rather than the key store context because we don't want the keys to |
| 90 | + // wind up being stored in the borrowed context. |
| 91 | + #[allow(deprecated)] |
| 92 | + let key_to_wrap_instance = ctx.dangerous_get_symmetric_key(key_to_wrap)?; |
| 93 | + // encapsulate encryption key |
| 94 | + let encapsulated_encryption_key = UnsignedSharedKey::encapsulate_key_unsigned( |
| 95 | + key_to_wrap_instance, |
| 96 | + &key_pair.to_public_key(), |
| 97 | + )?; |
| 98 | + |
| 99 | + // wrap decapsulation key |
| 100 | + let wrapped_decapsulation_key = key_pair.to_der()?.encrypt_with_key(wrapping_key)?; |
| 101 | + |
| 102 | + // wrap encapsulation key with encryption key |
| 103 | + // Note: Usually, a public key is - by definition - public, so this should not be necessary. |
| 104 | + // The specific use-case for this function is to enable rotateable key sets, where |
| 105 | + // the "public key" is not public, with the intent of preventing the server from being able |
| 106 | + // to overwrite the user key unlocked by the rotateable keyset. |
| 107 | + let encrypted_encapsulation_key = key_pair |
| 108 | + .to_public_key() |
| 109 | + .to_der()? |
| 110 | + .encrypt_with_key(&key_to_wrap_instance)?; |
| 111 | + |
| 112 | + Ok(RotateableKeySet { |
| 113 | + encapsulated_encryption_key, |
| 114 | + encrypted_encapsulation_key, |
| 115 | + wrapped_decapsulation_key, |
| 116 | + }) |
| 117 | + } |
| 118 | + |
| 119 | + // TODO: Eventually, the webauthn-login-strategy service should be migrated |
| 120 | + // to use this method, and we can remove the #[allow(dead_code)] attribute. |
| 121 | + #[allow(dead_code)] |
| 122 | + fn unlock<Ids: KeyIds>( |
| 123 | + &self, |
| 124 | + ctx: &mut KeyStoreContext<Ids>, |
| 125 | + unwrapping_key: &SymmetricCryptoKey, |
| 126 | + key_to_unwrap: Ids::Symmetric, |
| 127 | + ) -> Result<(), CryptoError> { |
| 128 | + let priv_key_bytes: Vec<u8> = self |
| 129 | + .wrapped_decapsulation_key |
| 130 | + .decrypt_with_key(unwrapping_key)?; |
| 131 | + let decapsulation_key = |
| 132 | + AsymmetricCryptoKey::from_der(&Pkcs8PrivateKeyBytes::from(priv_key_bytes))?; |
| 133 | + let encryption_key = self |
| 134 | + .encapsulated_encryption_key |
| 135 | + .decapsulate_key_unsigned(&decapsulation_key)?; |
| 136 | + #[allow(deprecated)] |
| 137 | + ctx.set_symmetric_key(key_to_unwrap, encryption_key)?; |
| 138 | + Ok(()) |
| 139 | + } |
| 140 | +} |
| 141 | + |
| 142 | +fn rotate_key_set<Ids: KeyIds>( |
| 143 | + ctx: &KeyStoreContext<Ids>, |
| 144 | + key_set: RotateableKeySet, |
| 145 | + old_encryption_key_id: Ids::Symmetric, |
| 146 | + new_encryption_key_id: Ids::Symmetric, |
| 147 | +) -> Result<RotateableKeySet, CryptoError> { |
| 148 | + let pub_key_bytes = ctx.decrypt_data_with_symmetric_key( |
| 149 | + old_encryption_key_id, |
| 150 | + &key_set.encrypted_encapsulation_key, |
| 151 | + )?; |
| 152 | + let pub_key = SpkiPublicKeyBytes::from(pub_key_bytes); |
| 153 | + let encapsulation_key = AsymmetricPublicCryptoKey::from_der(&pub_key)?; |
| 154 | + // TODO: There is no method to store only the public key in the store, so we |
| 155 | + // have pull out the encryption key to encapsulate it manually. |
| 156 | + #[allow(deprecated)] |
| 157 | + let new_encryption_key = ctx.dangerous_get_symmetric_key(new_encryption_key_id)?; |
| 158 | + let new_encapsulated_key = |
| 159 | + UnsignedSharedKey::encapsulate_key_unsigned(new_encryption_key, &encapsulation_key)?; |
| 160 | + let new_encrypted_encapsulation_key = pub_key.encrypt_with_key(new_encryption_key)?; |
| 161 | + Ok(RotateableKeySet { |
| 162 | + encapsulated_encryption_key: new_encapsulated_key, |
| 163 | + encrypted_encapsulation_key: new_encrypted_encapsulation_key, |
| 164 | + wrapped_decapsulation_key: key_set.wrapped_decapsulation_key, |
| 165 | + }) |
| 166 | +} |
| 167 | + |
48 | 168 | #[cfg(test)] |
49 | 169 | mod tests { |
50 | 170 | use super::*; |
@@ -137,4 +257,79 @@ mod tests { |
137 | 257 | .unwrap() |
138 | 258 | ); |
139 | 259 | } |
| 260 | + |
| 261 | + #[test] |
| 262 | + fn test_rotateable_key_set_can_unlock() { |
| 263 | + // generate initial keys |
| 264 | + let external_key = SymmetricCryptoKey::make_aes256_cbc_hmac_key(); |
| 265 | + // set up store |
| 266 | + let store: KeyStore<TestIds> = KeyStore::default(); |
| 267 | + let mut ctx = store.context_mut(); |
| 268 | + let original_encryption_key_id = TestSymmKey::A(0); |
| 269 | + ctx.generate_symmetric_key(original_encryption_key_id) |
| 270 | + .unwrap(); |
| 271 | + |
| 272 | + // create key set |
| 273 | + let key_set = |
| 274 | + RotateableKeySet::new(&ctx, &external_key, original_encryption_key_id).unwrap(); |
| 275 | + |
| 276 | + // unlock key set |
| 277 | + let unwrapped_encryption_key_id = TestSymmKey::A(1); |
| 278 | + key_set |
| 279 | + .unlock(&mut ctx, &external_key, unwrapped_encryption_key_id) |
| 280 | + .unwrap(); |
| 281 | + |
| 282 | + #[allow(deprecated)] |
| 283 | + let original_key = ctx |
| 284 | + .dangerous_get_symmetric_key(original_encryption_key_id) |
| 285 | + .unwrap(); |
| 286 | + #[allow(deprecated)] |
| 287 | + let unwrapped_key = ctx |
| 288 | + .dangerous_get_symmetric_key(unwrapped_encryption_key_id) |
| 289 | + .unwrap(); |
| 290 | + assert_eq!(original_key, unwrapped_key); |
| 291 | + } |
| 292 | + |
| 293 | + #[test] |
| 294 | + fn test_rotateable_key_set_rotation() { |
| 295 | + // generate initial keys |
| 296 | + let external_key = SymmetricCryptoKey::make_aes256_cbc_hmac_key(); |
| 297 | + // set up store |
| 298 | + let store: KeyStore<TestIds> = KeyStore::default(); |
| 299 | + let mut ctx = store.context_mut(); |
| 300 | + let original_encryption_key_id = TestSymmKey::A(1); |
| 301 | + ctx.generate_symmetric_key(original_encryption_key_id) |
| 302 | + .unwrap(); |
| 303 | + |
| 304 | + // create key set |
| 305 | + let key_set = |
| 306 | + RotateableKeySet::new(&ctx, &external_key, original_encryption_key_id).unwrap(); |
| 307 | + |
| 308 | + // rotate |
| 309 | + let new_encryption_key_id = TestSymmKey::A(2_1); |
| 310 | + ctx.generate_symmetric_key(new_encryption_key_id).unwrap(); |
| 311 | + let new_key_set = rotate_key_set( |
| 312 | + &ctx, |
| 313 | + key_set, |
| 314 | + original_encryption_key_id, |
| 315 | + new_encryption_key_id, |
| 316 | + ) |
| 317 | + .unwrap(); |
| 318 | + |
| 319 | + // After rotation, the new key set should be unlocked by the same |
| 320 | + // external key and return the new encryption key. |
| 321 | + let unwrapped_encryption_key_id = TestSymmKey::A(2_2); |
| 322 | + new_key_set |
| 323 | + .unlock(&mut ctx, &external_key, unwrapped_encryption_key_id) |
| 324 | + .unwrap(); |
| 325 | + #[allow(deprecated)] |
| 326 | + let new_encryption_key = ctx |
| 327 | + .dangerous_get_symmetric_key(new_encryption_key_id) |
| 328 | + .unwrap(); |
| 329 | + #[allow(deprecated)] |
| 330 | + let unwrapped_encryption_key = ctx |
| 331 | + .dangerous_get_symmetric_key(unwrapped_encryption_key_id) |
| 332 | + .unwrap(); |
| 333 | + assert_eq!(new_encryption_key, unwrapped_encryption_key); |
| 334 | + } |
140 | 335 | } |
0 commit comments