multi-key 1.0.6

Multikey self-describing cryptographic key data
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100

// SPDX-License-Identifier: Apache-2.0
use crate::{error::KdfError, AttrId, Error, KdfAttrView, KdfView, Multikey, Views};
use multi_codec::Codec;
use multi_util::Varuint;
use zeroize::Zeroizing;

/// constants for Bcrypt
pub const SALT_LENGTH: usize = 32;

pub(crate) struct View<'a> {
    mk: &'a Multikey,
    kdf: Option<&'a Multikey>,
}

impl<'a> View<'a> {
    pub fn new(mk: &'a Multikey, kdf: &'a Multikey) -> Self {
        Self { mk, kdf: Some(kdf) }
    }
}

impl<'a> TryFrom<&'a Multikey> for View<'a> {
    type Error = Error;

    fn try_from(mk: &'a Multikey) -> Result<Self, Self::Error> {
        Ok(Self { mk, kdf: None })
    }
}

impl<'a> KdfView for View<'a> {
    /// this takes the kdf attributes and data from the passed-in Multikey and
    /// generates a new Multikey by copying the viewed Multikey (self) and
    /// storing the derived key and attributes in the new Multikey
    fn derive_key(&self, passphrase: &[u8]) -> Result<Multikey, Error> {
        let kdf = self.kdf.ok_or(KdfError::MissingCodec)?;

        // get the salt data and rounds attribute
        let (salt, rounds) = {
            let kattr = kdf.kdf_attr_view()?;
            (kattr.salt_bytes()?, kattr.rounds()?)
        };

        // get the key length from the viewed Multikey
        let key_length = {
            let cattr = self.mk.cipher_attr_view()?;

            cattr.key_length()?
        };

        // heap allocate a buffer to receive the derived key
        let mut key: Zeroizing<Vec<u8>> = vec![0; key_length].into();

        // derive the key
        bcrypt_pbkdf::bcrypt_pbkdf(passphrase, &salt, rounds as u32, key.as_mut_slice())
            .map_err(KdfError::Bcrypt)?;

        // prepare the attributes
        let kdf_codec: Vec<u8> = kdf.codec.into();
        let rounds: Vec<u8> = Varuint(rounds).into();

        // create a new Multikey from the viewed Multikey (self) and store the
        // kdf parameters along with the derived key
        let mut res = self.mk.clone();
        res.attributes.insert(AttrId::KeyData, key.clone());
        let _ = res.attributes.remove(&AttrId::KeyIsEncrypted);
        res.attributes.insert(AttrId::KdfCodec, kdf_codec.into());
        res.attributes.insert(AttrId::KdfSalt, salt.clone());
        res.attributes.insert(AttrId::KdfRounds, rounds.into());
        Ok(res)
    }
}

impl<'a> KdfAttrView for View<'a> {
    fn kdf_codec(&self) -> Result<Codec, Error> {
        Ok(Codec::BcryptPbkdf)
    }

    fn salt_bytes(&self) -> Result<Zeroizing<Vec<u8>>, Error> {
        // try to look up the salt in the multikey attributes
        let salt = self
            .mk
            .attributes
            .get(&AttrId::KdfSalt)
            .ok_or(KdfError::MissingSalt)?;
        if salt.len() != SALT_LENGTH {
            Err(KdfError::InvalidSaltLen.into())
        } else {
            Ok(salt.clone())
        }
    }

    fn rounds(&self) -> Result<usize, Error> {
        // try to look up the rounds in the multikey attributes
        let rounds = self
            .mk
            .attributes
            .get(&AttrId::KdfRounds)
            .ok_or(KdfError::MissingRounds)?;
        Ok(Varuint::<usize>::try_from(rounds.as_slice())?.to_inner())
    }
}