1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122

use crate::{Vault, VaultError};
use aes_gcm::aead::{generic_array::GenericArray, Aead, NewAead, Payload};
use aes_gcm::{Aes128Gcm, Aes256Gcm};
use ockam_core::vault::{
    Buffer, KeyId, SecretType, SymmetricVault, AES128_SECRET_LENGTH_U32,
    AES128_SECRET_LENGTH_USIZE, AES256_SECRET_LENGTH_U32, AES256_SECRET_LENGTH_USIZE,
};
use ockam_core::{async_trait, compat::boxed::Box, Result};

#[async_trait]
impl SymmetricVault for Vault {
    async fn aead_aes_gcm_encrypt(
        &self,
        key_id: &KeyId,
        plaintext: &[u8],
        nonce: &[u8],
        aad: &[u8],
    ) -> Result<Buffer<u8>> {
        self.preload_from_storage(key_id).await;

        let entries = self.data.entries.read().await;
        let entry = entries
            .get(key_id)
            .ok_or(VaultError::EntryNotFound(format!("{key_id:?}")))?;

        if entry.key_attributes().stype() != SecretType::Aes {
            return Err(VaultError::AeadAesGcmEncrypt.into());
        }

        let nonce = GenericArray::from_slice(nonce);
        let payload = Payload {
            aad,
            msg: plaintext,
        };

        match entry.key_attributes().length() {
            AES128_SECRET_LENGTH_U32 => {
                let key = entry.secret().try_as_key()?.as_ref();
                if key.len() != AES128_SECRET_LENGTH_USIZE {
                    return Err(VaultError::AeadAesGcmEncrypt.into());
                }

                let key = GenericArray::from_slice(key);
                Aes128Gcm::new(key)
                    .encrypt(nonce, payload)
                    .map_err(|_| VaultError::AeadAesGcmEncrypt.into())
            }
            AES256_SECRET_LENGTH_U32 => {
                let key = entry.secret().try_as_key()?.as_ref();
                if key.len() != AES256_SECRET_LENGTH_USIZE {
                    return Err(VaultError::AeadAesGcmEncrypt.into());
                }

                let key = GenericArray::from_slice(key);
                Aes256Gcm::new(key)
                    .encrypt(nonce, payload)
                    .map_err(|_| VaultError::AeadAesGcmEncrypt.into())
            }
            _ => Err(VaultError::AeadAesGcmEncrypt.into()),
        }
    }

    async fn aead_aes_gcm_decrypt(
        &self,
        key_id: &KeyId,
        cipher_text: &[u8],
        nonce: &[u8],
        aad: &[u8],
    ) -> Result<Buffer<u8>> {
        self.preload_from_storage(key_id).await;

        let entries = self.data.entries.read().await;
        let entry = entries
            .get(key_id)
            .ok_or(VaultError::EntryNotFound(format!("aes key {key_id:?}")))?;

        if entry.key_attributes().stype() != SecretType::Aes {
            return Err(VaultError::AeadAesGcmEncrypt.into());
        }

        let nonce = GenericArray::from_slice(nonce);
        let payload = Payload {
            aad,
            msg: cipher_text,
        };

        match entry.key_attributes().length() {
            AES128_SECRET_LENGTH_U32 => {
                let key = entry.secret().try_as_key()?.as_ref();
                if key.len() != AES128_SECRET_LENGTH_USIZE {
                    return Err(VaultError::AeadAesGcmEncrypt.into());
                }
                let key = GenericArray::from_slice(key);
                Aes128Gcm::new(key)
                    .decrypt(nonce, payload)
                    .map_err(|_| VaultError::AeadAesGcmEncrypt.into())
            }
            AES256_SECRET_LENGTH_U32 => {
                let key = entry.secret().try_as_key()?.as_ref();
                if key.len() != AES256_SECRET_LENGTH_USIZE {
                    return Err(VaultError::AeadAesGcmEncrypt.into());
                }
                let key = GenericArray::from_slice(key);
                Aes256Gcm::new(key)
                    .decrypt(nonce, payload)
                    .map_err(|_| VaultError::AeadAesGcmEncrypt.into())
            }
            _ => Err(VaultError::AeadAesGcmEncrypt.into()),
        }
    }
}

#[cfg(test)]
mod tests {
    use crate::Vault;
    fn new_vault() -> Vault {
        Vault::default()
    }

    #[ockam_macros::vault_test]
    fn encryption() {}
}