cosmian_kms_crypto 5.24.0

use base64::{Engine, engine::general_purpose};
use cosmian_kmip::{
    kmip_0::kmip_types::{BlockCipherMode, CryptographicUsageMask, PaddingMethod},
    kmip_2_1::{
        kmip_data_structures::{KeyBlock, KeyMaterial, KeyValue, KeyWrappingData},
        kmip_objects::Object,
        kmip_types::{CryptographicAlgorithm, EncodingOption, KeyFormatType},
    },
};
use openssl::pkey::{Id, PKey, Private};
use x509_parser::nom::AsBytes;
use zeroize::Zeroizing;

use super::WRAPPING_SECRET_LENGTH;
#[cfg(feature = "non-fips")]
use crate::crypto::elliptic_curves::ecies::ecies_decrypt;
#[cfg(feature = "non-fips")]
use crate::crypto::rsa::ckm_rsa_pkcs::ckm_rsa_pkcs_key_unwrap;
use crate::{
    crypto::{
        FIPS_MIN_SALT_SIZE,
        password_derivation::derive_key_from_password,
        rsa::{
            ckm_rsa_aes_key_wrap::ckm_rsa_aes_key_unwrap,
            ckm_rsa_pkcs_oaep::ckm_rsa_pkcs_oaep_key_unwrap,
        },
        symmetric::{
            rfc3394::rfc3394_unwrap,
            rfc5649::rfc5649_unwrap,
            symmetric_ciphers::{SymCipher, decrypt},
        },
        wrap::common::rsa_parameters,
    },
    crypto_bail,
    error::{CryptoError, result::CryptoResultHelper},
    openssl::kmip_private_key_to_openssl,
};

const NONCE_LENGTH: usize = 12;
const TAG_LENGTH: usize = 16;

/// Decrypt a Google CSE-wrapped key blob using AES-GCM.
///
/// The wrapped blob layout is: nonce (12 bytes) | ciphertext | tag (16 bytes), all base64-encoded.
/// The function decodes base64, splits the components, selects AES-GCM based on the KEK length
/// (supports 16 or 32 bytes), and returns the decrypted plaintext.
///
/// Arguments
/// - `wrapped_key_b64`: base64-encoded wrapped key bytes
/// - `unwrap_secret`: the AES-GCM key bytes (KEK); typically 16 or 32 bytes
///
/// Errors
/// - Returns `CryptoError` if decoding, slicing, or decryption fails
pub fn aes_gcm_decrypt(
    wrapped_key_b64: &str,
    unwrap_secret: &[u8],
) -> Result<Zeroizing<Vec<u8>>, CryptoError> {
    let wrapped_key = general_purpose::STANDARD
        .decode(wrapped_key_b64)
        .map_err(|e| CryptoError::Default(format!("Invalid base64 wrapped key: {e}")))?;
    let len = wrapped_key.len();
    if len < TAG_LENGTH + NONCE_LENGTH {
        crypto_bail!("Invalid wrapped key - insufficient length.");
    }
    let nonce = wrapped_key
        .get(..NONCE_LENGTH)
        .ok_or_else(|| CryptoError::IndexingSlicing("cse_wrapped_key_decrypt: nonce".to_owned()))?;
    let ciphertext = wrapped_key
        .get(NONCE_LENGTH..len - TAG_LENGTH)
        .ok_or_else(|| {
            CryptoError::IndexingSlicing("cse_wrapped_key_decrypt: ciphertext".to_owned())
        })?;
    let tag = wrapped_key
        .get(len - TAG_LENGTH..)
        .ok_or_else(|| CryptoError::IndexingSlicing("cse_wrapped_key_decrypt: tag".to_owned()))?;

    // Choose AES-GCM variant based on key size
    let sym = SymCipher::from_algorithm_and_key_size(
        CryptographicAlgorithm::AES,
        Some(BlockCipherMode::GCM),
        unwrap_secret.len(),
    )?;

    decrypt(sym, unwrap_secret, nonce, &[], ciphertext, tag, None)
}

/// Unwrap a key using a password
pub fn unwrap_key_bytes(
    salt: &[u8; FIPS_MIN_SALT_SIZE],
    key: &[u8],
    wrapping_password: &str,
) -> Result<Zeroizing<Vec<u8>>, CryptoError> {
    let wrapping_secret =
        derive_key_from_password::<WRAPPING_SECRET_LENGTH>(salt, wrapping_password.as_bytes())?;
    rfc5649_unwrap(key, wrapping_secret.as_ref()).map_err(|e| CryptoError::Default(e.to_string()))
}

/// Unwrap a key block with a wrapping key
///
/// # Arguments
/// * `object_key_block` - the key block of the object to unwrap
/// * `unwrapping_key` - the unwrapping key
/// # Returns
/// * `KResult<()>` - the result of the operation
pub fn unwrap_key_block(
    object_key_block: &mut KeyBlock,
    unwrapping_key: &Object,
) -> Result<(), CryptoError> {
    // check that the key wrapping data is present
    let key_wrapping_data = object_key_block
        .key_wrapping_data
        .as_ref()
        .context("unable to unwrap key: key wrapping data is missing")?;

    let Some(KeyValue::ByteString(wrapped_key)) = object_key_block.key_value.as_ref() else {
        crypto_bail!("unable to unwrap key: key value is not a byte string")
    };

    let key_value = unwrap(
        unwrapping_key,
        key_wrapping_data,
        wrapped_key,
        object_key_block.key_format_type,
    )?;

    // update the key block with the unwrapped key
    object_key_block.key_value = Some(key_value);
    object_key_block.key_wrapping_data = None;

    Ok(())
}

/// Unwrap a key using a wrapping key
///
/// # Arguments
/// * `unwrapping_key` - the unwrapping key
/// * `key_wrapping_data` - the key wrapping data
/// * `wrapped_key` - the wrapped key
/// * `key_format_type` - the unwrapped key expected key format type
///
/// # Returns
/// * `KResult<KeyValue>` - the unwrapped key
pub(super) fn unwrap(
    unwrapping_key: &Object,
    key_wrapping_data: &KeyWrappingData,
    wrapped_key: &[u8],
    key_format_type: KeyFormatType,
) -> Result<KeyValue, CryptoError> {
    // Make sure that the key used to unwrap can be used to unwrap.
    // The KMIP object may not expose attributes (e.g. when stored as a ByteString or when
    // the KeyValue structure has no attributes). In that case, treat the absence of
    // attributes as not-authorized and return a clear CryptoError instead of propagating
    // a KMIP attribute error.
    let unwrapping_authorized = unwrapping_key.attributes().is_ok_and(|attrs| {
        attrs
            .is_usage_authorized_for(CryptographicUsageMask::UnwrapKey)
            .unwrap_or(false)
    });
    if !unwrapping_authorized {
        return Err(CryptoError::Kmip(
            "CryptographicUsageMask not authorized for UnwrapKey".to_owned(),
        ));
    }

    let unwrapping_key_block = unwrapping_key
        .key_block()
        .context("Unable to unwrap: the key encryption key is not a key")?;
    if unwrapping_key_block.key_wrapping_data.is_some() {
        crypto_bail!(
            "unable to unwrap: the key encryption key is wrapped, and that is not supported"
        )
    }

    let plaintext = match unwrapping_key_block.key_format_type {
        // The default format for a symmetric key is Raw
        //  according to sec. 4.26 Key Format Type of the KMIP 2.1 specs:
        //  see https://docs.oasis-open.org/kmip/kmip-spec/v2.1/os/kmip-spec-v2.1-os.html#_Toc57115585
        KeyFormatType::TransparentSymmetricKey | KeyFormatType::Raw => {
            unwrap_with_symmetric_key(key_wrapping_data, wrapped_key, unwrapping_key_block)
        }
        KeyFormatType::TransparentECPrivateKey | KeyFormatType::TransparentRSAPrivateKey => {
            // convert to an OpenSSL private key
            let p_key = kmip_private_key_to_openssl(unwrapping_key)?;
            unwrap_with_private_key(&p_key, key_wrapping_data, wrapped_key)
        }
        KeyFormatType::PKCS8 => {
            let p_key = PKey::private_key_from_der(&unwrapping_key_block.pkcs_der_bytes()?)?;
            unwrap_with_private_key(&p_key, key_wrapping_data, wrapped_key)
        }
        x => {
            crypto_bail!("Unable to unwrap: the key encryption key format is not supported: {x:?}")
        }
    }?;

    decode_unwrapped_key(key_wrapping_data.get_encoding(), key_format_type, plaintext)
}

/// Decode the unwrapped key into a `KeyValue`
///
/// # Arguments
/// * `key_wrapping_data` - the key wrapping data
/// * `key_format_type` - the expected key format type
/// * `plaintext` - the unwrapped key bytes
///
/// # Returns
/// * `KResult<KeyValue>` - the decoded key value
pub fn decode_unwrapped_key(
    encoding: EncodingOption,
    key_format_type: KeyFormatType,
    plaintext: Zeroizing<Vec<u8>>,
) -> Result<KeyValue, CryptoError> {
    match encoding {
        EncodingOption::TTLVEncoding => {
            // For TTLV encoding, convert the plaintext to a KeyValue using TTLV parsing
            KeyValue::from_ttlv_bytes(plaintext.as_bytes(), key_format_type).map_err(Into::into)
        }
        EncodingOption::NoEncoding => {
            match key_format_type {
                KeyFormatType::Raw
                | KeyFormatType::ECPrivateKey
                | KeyFormatType::Opaque
                | KeyFormatType::PKCS1
                | KeyFormatType::PKCS10
                | KeyFormatType::PKCS12
                | KeyFormatType::PKCS7
                | KeyFormatType::PKCS8
                | KeyFormatType::X509
                | KeyFormatType::CoverCryptSecretKey
                | KeyFormatType::CoverCryptPublicKey => {
                    // For no encoding, create a structure with the plaintext as bytes
                    let key_material = KeyMaterial::ByteString(plaintext);
                    Ok(KeyValue::Structure {
                        key_material,
                        attributes: None,
                    })
                }
                #[cfg(feature = "non-fips")]
                KeyFormatType::Pkcs12Legacy => {
                    // For no encoding, create a structure with the plaintext as bytes
                    let key_material = KeyMaterial::ByteString(plaintext);
                    Ok(KeyValue::Structure {
                        key_material,
                        attributes: None,
                    })
                }
                KeyFormatType::TransparentSymmetricKey => {
                    // For no encoding, create a structure with the plaintext as bytes
                    let key_material = KeyMaterial::TransparentSymmetricKey { key: plaintext };
                    Ok(KeyValue::Structure {
                        key_material,
                        attributes: None,
                    })
                }

                f => {
                    crypto_bail!(
                        "Unable to decode the unwrapped key using No Encoding, its format is not \
                         supported: {f:?}"
                    )
                }
            }
        }
    }
}

/// Unwrap a key using a symmetric key
///
/// # Arguments
/// * `key_wrapping_data` - the key wrapping data
/// * `ciphertext` - the ciphertext to unwrap
/// * `aad` - the additional authenticated data
/// * `unwrapping_key_block` - the unwrapping key block
///
/// # Returns
/// * `KResult<Vec<u8>>` - the unwrapped key bytes (which may be TTLV Encoded)
fn unwrap_with_symmetric_key(
    key_wrapping_data: &KeyWrappingData,
    ciphertext: &[u8],
    unwrapping_key_block: &KeyBlock,
) -> Result<Zeroizing<Vec<u8>>, CryptoError> {
    // Extract the block cipher mode from the key wrapping data
    let block_cipher_mode = key_wrapping_data
        .encryption_key_information
        .clone()
        .and_then(|information| information.cryptographic_parameters)
        .and_then(|parameters| parameters.block_cipher_mode);

    // Extract the wrapping key bytes from the unwrapping key block
    let unwrap_secret = unwrapping_key_block
        .key_bytes()
        .context("unwrapping key bytes:")?;

    // If AES GCM, use GCM decryption; if AES Key Wrap RFC 3394 (NISTKeyWrap) is
    // explicitly specified, use rfc3394_unwrap; otherwise default to RFC 5649
    // (AESKeyWrapPadding) for backward compatibility with stored wrapped keys.
    if block_cipher_mode == Some(BlockCipherMode::GCM) {
        aes_gcm_unwrap(ciphertext, &unwrap_secret)
    } else if block_cipher_mode == Some(BlockCipherMode::NISTKeyWrap) {
        rfc3394_unwrap(ciphertext, &unwrap_secret)
    } else {
        rfc5649_unwrap(ciphertext, &unwrap_secret)
    }
}

/// Unwrap a key using AES GCM
///
/// # Arguments
/// * `ciphertext` - the ciphertext to unwrap
/// * `aad` - the additional authenticated data
/// * `unwrap_secret` - the unwrapping key
///
/// # Returns
/// * `KResult<Vec<u8>>` - the unwrapped key
fn aes_gcm_unwrap(
    ciphertext: &[u8],
    unwrap_secret: &Zeroizing<Vec<u8>>,
) -> Result<Zeroizing<Vec<u8>>, CryptoError> {
    // unwrap using aes Gcm
    let len = ciphertext.len();
    if len < TAG_LENGTH + NONCE_LENGTH {
        crypto_bail!("Invalid wrapped key - insufficient length.");
    }
    let aead = SymCipher::Aes256Gcm;
    let nonce = ciphertext
        .get(..NONCE_LENGTH)
        .ok_or_else(|| CryptoError::IndexingSlicing("unwrap: nonce".to_owned()))?;
    let wrapped_key_bytes = ciphertext
        .get(NONCE_LENGTH..len - TAG_LENGTH)
        .ok_or_else(|| CryptoError::IndexingSlicing("unwrap: wrapped_key_bytes".to_owned()))?;
    let tag = ciphertext
        .get(len - TAG_LENGTH..)
        .ok_or_else(|| CryptoError::IndexingSlicing("unwrap: tag".to_owned()))?;
    decrypt(
        aead,
        unwrap_secret,
        nonce,
        &[],
        wrapped_key_bytes,
        tag,
        None,
    )
}

/// Unwrap a key using a private key
///
/// # Arguments
/// * `private_key` - the private key to use for unwrapping
/// * `key_wrapping_data` - the key wrapping data
/// * `ciphertext` - the ciphertext to unwrap
///
/// # Returns
/// * `KResult<Vec<u8>>` - the unwrapped key
///
/// # Errors
/// * If the private key is not a valid key
/// * If the key wrapping data is not valid
/// * If the ciphertext is not valid
/// * If the unwrapping fails
fn unwrap_with_private_key(
    private_key: &PKey<Private>,
    key_wrapping_data: &KeyWrappingData,
    ciphertext: &[u8],
) -> Result<Zeroizing<Vec<u8>>, CryptoError> {
    match private_key.id() {
        Id::RSA => unwrap_with_rsa(private_key, key_wrapping_data, ciphertext),
        #[cfg(feature = "non-fips")]
        Id::EC | Id::X25519 | Id::ED25519 => ecies_decrypt(private_key, ciphertext),
        other => {
            crypto_bail!(
                "Unable to wrap key: wrapping public key type not supported: {:?}",
                other
            )
        }
    }
}

/// Unwrap a key using RSA OAEP or `PKCS1v15` or RSA AES key wrap
///
/// # Arguments
/// * `private_key` - the private key to use for unwrapping
/// * `key_wrapping_data` - the key wrapping data
/// * `wrapped_key` - the wrapped key to unwrap
/// # Returns
/// * `KResult<Vec<u8>>` - the unwrapped key
///
/// # Errors
/// * If the private key is not a valid key
/// * If the key wrapping data is not valid
/// * If the wrapped key is not valid
/// * If the unwrapping fails
fn unwrap_with_rsa(
    private_key: &PKey<Private>,
    key_wrapping_data: &KeyWrappingData,
    wrapped_key: &[u8],
) -> Result<Zeroizing<Vec<u8>>, CryptoError> {
    let (algorithm, padding, hashing_fn) = rsa_parameters(key_wrapping_data);
    match algorithm {
        CryptographicAlgorithm::RSA => match padding {
            PaddingMethod::None => ckm_rsa_aes_key_unwrap(private_key, hashing_fn, wrapped_key),
            PaddingMethod::OAEP => {
                ckm_rsa_pkcs_oaep_key_unwrap(private_key, hashing_fn, hashing_fn, None, wrapped_key)
            }
            #[cfg(feature = "non-fips")]
            PaddingMethod::PKCS1v15 => ckm_rsa_pkcs_key_unwrap(private_key, wrapped_key),
            _ => crypto_bail!(
                "Unable to unwrap key with RSA: padding method not supported: {padding:?}"
            ),
        },
        x => {
            crypto_bail!(
                "Unable to unwrap key with RSA: algorithm not supported for unwrapping: {:?}",
                x
            )
        }
    }
}