Skip to content

Commit 36b1914

Browse files
netfnetf
committed
WIP
1 parent 162b7bb commit 36b1914

File tree

6 files changed

+79
-102
lines changed

6 files changed

+79
-102
lines changed

‎pkg/delegatedkeys/delegated_keys.go

Lines changed: 29 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,13 @@ import (
44
"bytes"
55
"fmt"
66
"strings"
7+
"sync"
78

89
"github.com/tink-crypto/tink-go-awskms/integration/awskms"
910
"github.com/tink-crypto/tink-go/v2/aead"
1011
"github.com/tink-crypto/tink-go/v2/keyset"
1112
"github.com/tink-crypto/tink-go/v2/signature"
13+
"github.com/tink-crypto/tink-go/v2/tink"
1214
)
1315

1416
// DelegatedKey is an interface for keys that support encryption, decryption, signing,
@@ -29,16 +31,17 @@ type DelegatedKey interface {
2931
// Sign signs the given data using the algorithm specified by the key.
3032
Sign(data []byte) (signature []byte, err error)
3133

32-
// Verify verifies the given signature for the data using the algorithm specified by the key.
33-
Verify(signature []byte, data []byte) (valid bool, err error)
34-
3534
// WrapKeyset wraps the keyset using the algorithm specified by the key.
3635
WrapKeyset() (wrappedKeyset []byte, err error)
3736
}
3837

3938
type TinkDelegatedKey struct {
40-
keysetHandle *keyset.Handle
41-
kekUri string
39+
keysetHandle *keyset.Handle
40+
kekUri string
41+
aeadPrimitive tink.AEAD
42+
signerPrimitive tink.Signer
43+
aeadOnce sync.Once
44+
signerOnce sync.Once
4245
}
4346

4447
func NewTinkDelegatedKey(kh *keyset.Handle, kekUri string) *TinkDelegatedKey {
@@ -55,22 +58,38 @@ func (dk *TinkDelegatedKey) Algorithm() string {
5558
return "Unknown"
5659
}
5760

61+
// getAEADPrimitive lazily initializes the AEAD primitive.
62+
func (dk *TinkDelegatedKey) getAEADPrimitive() (tink.AEAD, error) {
63+
var err error
64+
dk.aeadOnce.Do(func() {
65+
dk.aeadPrimitive, err = aead.New(dk.keysetHandle)
66+
})
67+
return dk.aeadPrimitive, err
68+
}
69+
70+
// getSignerPrimitive lazily initializes the Signer primitive.
71+
func (dk *TinkDelegatedKey) getSignerPrimitive() (tink.Signer, error) {
72+
var err error
73+
dk.signerOnce.Do(func() {
74+
dk.signerPrimitive, err = signature.NewSigner(dk.keysetHandle)
75+
})
76+
return dk.signerPrimitive, err
77+
}
78+
5879
func (dk *TinkDelegatedKey) AllowedForRawMaterials() bool {
5980
return true
6081
}
6182

6283
func (dk *TinkDelegatedKey) Encrypt(plaintext []byte, associatedData []byte) ([]byte, error) {
63-
// TODO: Support AEAD and DAEAD primitives
64-
a, err := aead.New(dk.keysetHandle)
84+
a, err := dk.getAEADPrimitive()
6585
if err != nil {
6686
return nil, fmt.Errorf("failed to get AEAD primitive: %v", err)
6787
}
6888
return a.Encrypt(plaintext, associatedData)
6989
}
7090

7191
func (dk *TinkDelegatedKey) Decrypt(ciphertext []byte, associatedData []byte) ([]byte, error) {
72-
// TODO: Support AEAD and DAEAD primitives
73-
a, err := aead.New(dk.keysetHandle)
92+
a, err := dk.getAEADPrimitive()
7493
if err != nil {
7594
return nil, fmt.Errorf("failed to get AEAD primitive: %v", err)
7695
}
@@ -79,7 +98,7 @@ func (dk *TinkDelegatedKey) Decrypt(ciphertext []byte, associatedData []byte) ([
7998

8099
// Sign signs the given data using the keyset's primary key.
81100
func (dk *TinkDelegatedKey) Sign(data []byte) ([]byte, error) {
82-
signer, err := signature.NewSigner(dk.keysetHandle)
101+
signer, err := dk.getSignerPrimitive()
83102
if err != nil {
84103
return nil, fmt.Errorf("failed to create signer: %v", err)
85104
}
@@ -90,19 +109,6 @@ func (dk *TinkDelegatedKey) Sign(data []byte) ([]byte, error) {
90109
return signature, nil
91110
}
92111

93-
// Verify verifies the given signature for the data using the keyset's primary key.
94-
func (dk *TinkDelegatedKey) Verify(sign []byte, data []byte) (bool, error) {
95-
verifier, err := signature.NewVerifier(dk.keysetHandle)
96-
if err != nil {
97-
return false, fmt.Errorf("failed to create verifier: %v", err)
98-
}
99-
err = verifier.Verify(sign, data)
100-
if err != nil {
101-
return false, fmt.Errorf("failed to verify signature: %v", err)
102-
}
103-
return true, nil
104-
}
105-
106112
// WrapKeyset wraps the Tink keyset with the KEK.
107113
func (dk *TinkDelegatedKey) WrapKeyset() ([]byte, error) {
108114
client, err := awskms.NewClientWithOptions(dk.kekUri)

‎pkg/encrypted/action.go

Lines changed: 0 additions & 38 deletions
This file was deleted.

‎pkg/encrypted/client_test.go

Lines changed: 45 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -162,10 +162,12 @@ func TestEncryptedClient_PutItem(t *testing.T) {
162162
nil,
163163
), nil)
164164

165-
attributeActions := NewAttributeActions(AttributeActionDoNothing)
166-
attributeActions.SetAttributeAction("SensitiveAttribute", AttributeActionEncrypt)
165+
clientConfig := NewClientConfig(
166+
WithDefaultEncryption(EncryptNone),
167+
WithEncryption("SensitiveAttribute", EncryptStandard),
168+
)
167169

168-
encryptedClient := NewEncryptedClient(mockDynamoDBClient, mockCMProvider, attributeActions)
170+
encryptedClient := NewEncryptedClient(mockDynamoDBClient, mockCMProvider, clientConfig)
169171

170172
item := map[string]types.AttributeValue{
171173
"PK": &types.AttributeValueMemberS{Value: "123"},
@@ -189,10 +191,12 @@ func TestEncryptedClient_PutItem(t *testing.T) {
189191
func TestEncryptedClient_PutItem_Failure(t *testing.T) {
190192
mockDynamoDBClient := new(MockDynamoDBClient)
191193
mockCMProvider := new(MockCryptographicMaterialsProvider)
192-
attributeActions := NewAttributeActions(AttributeActionDoNothing)
193-
attributeActions.SetAttributeAction("SensitiveAttribute", AttributeActionEncrypt)
194+
clientConfig := NewClientConfig(
195+
WithDefaultEncryption(EncryptNone),
196+
WithEncryption("SensitiveAttribute", EncryptStandard),
197+
)
194198

195-
encryptedClient := NewEncryptedClient(mockDynamoDBClient, mockCMProvider, attributeActions)
199+
encryptedClient := NewEncryptedClient(mockDynamoDBClient, mockCMProvider, clientConfig)
196200

197201
// Mock the DescribeTable call to simulate fetching table primary key schema.
198202
mockDynamoDBClient.On("DescribeTable", mock.Anything, mock.AnythingOfType("*dynamodb.DescribeTableInput"), mock.Anything).Return(&dynamodb.DescribeTableOutput{
@@ -235,10 +239,12 @@ func TestEncryptedClient_PutItem_Failure(t *testing.T) {
235239
func TestEncryptedClient_GetItem_Success(t *testing.T) {
236240
mockDynamoDBClient := new(MockDynamoDBClient)
237241
mockCMProvider := new(MockCryptographicMaterialsProvider)
238-
attributeActions := NewAttributeActions(AttributeActionDoNothing)
239-
attributeActions.SetAttributeAction("SensitiveAttribute", AttributeActionEncrypt)
242+
clientConfig := NewClientConfig(
243+
WithDefaultEncryption(EncryptNone),
244+
WithEncryption("SensitiveAttribute", EncryptStandard),
245+
)
240246

241-
encryptedClient := NewEncryptedClient(mockDynamoDBClient, mockCMProvider, attributeActions)
247+
encryptedClient := NewEncryptedClient(mockDynamoDBClient, mockCMProvider, clientConfig)
242248

243249
// Mock DescribeTable call to simulate fetching table primary key schema.
244250
mockDynamoDBClient.On("DescribeTable", mock.Anything, mock.AnythingOfType("*dynamodb.DescribeTableInput"), mock.Anything).Return(&dynamodb.DescribeTableOutput{
@@ -264,7 +270,6 @@ func TestEncryptedClient_GetItem_Success(t *testing.T) {
264270
mockCMProvider.On("DecryptionMaterials", mock.Anything, mock.Anything, mock.Anything).Return(materials.NewDecryptionMaterials(
265271
map[string]string{"mock": "data"},
266272
&MockDelegatedKey{},
267-
nil,
268273
), nil)
269274

270275
// Test GetItem
@@ -286,9 +291,12 @@ func TestEncryptedClient_GetItem_Success(t *testing.T) {
286291
func TestEncryptedClient_Query(t *testing.T) {
287292
mockDynamoDBClient := new(MockDynamoDBClient)
288293
mockCMProvider := new(MockCryptographicMaterialsProvider)
289-
attributeActions := NewAttributeActions(AttributeActionDoNothing)
290-
attributeActions.SetAttributeAction("SensitiveAttribute", AttributeActionEncrypt)
291-
encryptedClient := NewEncryptedClient(mockDynamoDBClient, mockCMProvider, attributeActions)
294+
clientConfig := NewClientConfig(
295+
WithDefaultEncryption(EncryptNone),
296+
WithEncryption("SensitiveAttribute", EncryptStandard),
297+
)
298+
299+
encryptedClient := NewEncryptedClient(mockDynamoDBClient, mockCMProvider, clientConfig)
292300

293301
// Mock DescribeTable call to simulate fetching table primary key schema.
294302
mockDynamoDBClient.On("DescribeTable", mock.Anything, mock.AnythingOfType("*dynamodb.DescribeTableInput"), mock.Anything).Return(&dynamodb.DescribeTableOutput{
@@ -320,7 +328,6 @@ func TestEncryptedClient_Query(t *testing.T) {
320328
mockCMProvider.On("DecryptionMaterials", mock.Anything, mock.Anything, mock.Anything).Return(materials.NewDecryptionMaterials(
321329
map[string]string{"mock": "data"},
322330
&MockDelegatedKey{},
323-
nil,
324331
), nil)
325332

326333
// Test Query
@@ -342,9 +349,12 @@ func TestEncryptedClient_Query(t *testing.T) {
342349
func TestEncryptedClient_Scan(t *testing.T) {
343350
mockDynamoDBClient := new(MockDynamoDBClient)
344351
mockCMProvider := new(MockCryptographicMaterialsProvider)
345-
attributeActions := NewAttributeActions(AttributeActionDoNothing)
346-
attributeActions.SetAttributeAction("SensitiveAttribute", AttributeActionEncrypt)
347-
encryptedClient := NewEncryptedClient(mockDynamoDBClient, mockCMProvider, attributeActions)
352+
clientConfig := NewClientConfig(
353+
WithDefaultEncryption(EncryptNone),
354+
WithEncryption("SensitiveAttribute", EncryptStandard),
355+
)
356+
357+
encryptedClient := NewEncryptedClient(mockDynamoDBClient, mockCMProvider, clientConfig)
348358

349359
// Mock DescribeTable call to simulate fetching table primary key schema.
350360
mockDynamoDBClient.On("DescribeTable", mock.Anything, mock.AnythingOfType("*dynamodb.DescribeTableInput"), mock.Anything).Return(&dynamodb.DescribeTableOutput{
@@ -376,7 +386,6 @@ func TestEncryptedClient_Scan(t *testing.T) {
376386
mockCMProvider.On("DecryptionMaterials", mock.Anything, mock.Anything, mock.Anything).Return(materials.NewDecryptionMaterials(
377387
map[string]string{"mock": "data"},
378388
&MockDelegatedKey{},
379-
nil,
380389
), nil)
381390

382391
// Test Scan
@@ -394,9 +403,12 @@ func TestEncryptedClient_Scan(t *testing.T) {
394403
func TestEncryptedClient_BatchGetItem(t *testing.T) {
395404
mockDynamoDBClient := new(MockDynamoDBClient)
396405
mockCMProvider := new(MockCryptographicMaterialsProvider)
397-
attributeActions := NewAttributeActions(AttributeActionDoNothing)
398-
attributeActions.SetAttributeAction("SensitiveAttribute", AttributeActionEncrypt)
399-
encryptedClient := NewEncryptedClient(mockDynamoDBClient, mockCMProvider, attributeActions)
406+
clientConfig := NewClientConfig(
407+
WithDefaultEncryption(EncryptNone),
408+
WithEncryption("SensitiveAttribute", EncryptStandard),
409+
)
410+
411+
encryptedClient := NewEncryptedClient(mockDynamoDBClient, mockCMProvider, clientConfig)
400412

401413
// Mock DescribeTable call to simulate fetching table primary key schema.
402414
mockDynamoDBClient.On("DescribeTable", mock.Anything, mock.AnythingOfType("*dynamodb.DescribeTableInput"), mock.Anything).Return(&dynamodb.DescribeTableOutput{
@@ -430,7 +442,6 @@ func TestEncryptedClient_BatchGetItem(t *testing.T) {
430442
mockCMProvider.On("DecryptionMaterials", mock.Anything, mock.Anything, mock.Anything).Return(materials.NewDecryptionMaterials(
431443
map[string]string{"mock": "data"},
432444
&MockDelegatedKey{},
433-
nil,
434445
), nil)
435446

436447
// Test BatchGetItem
@@ -461,9 +472,12 @@ func TestEncryptedClient_BatchGetItem(t *testing.T) {
461472
func TestEncryptedClient_BatchWriteItem(t *testing.T) {
462473
mockDynamoDBClient := new(MockDynamoDBClient)
463474
mockCMProvider := new(MockCryptographicMaterialsProvider)
464-
attributeActions := NewAttributeActions(AttributeActionDoNothing)
465-
attributeActions.SetAttributeAction("SensitiveAttribute", AttributeActionEncrypt)
466-
encryptedClient := NewEncryptedClient(mockDynamoDBClient, mockCMProvider, attributeActions)
475+
clientConfig := NewClientConfig(
476+
WithDefaultEncryption(EncryptNone),
477+
WithEncryption("SensitiveAttribute", EncryptStandard),
478+
)
479+
480+
encryptedClient := NewEncryptedClient(mockDynamoDBClient, mockCMProvider, clientConfig)
467481

468482
// Mock DescribeTable call to simulate fetching table primary key schema.
469483
mockDynamoDBClient.On("DescribeTable", mock.Anything, mock.AnythingOfType("*dynamodb.DescribeTableInput"), mock.Anything).Return(&dynamodb.DescribeTableOutput{
@@ -520,9 +534,12 @@ func TestEncryptedClient_BatchWriteItem(t *testing.T) {
520534
func TestEncryptedClient_DeleteItem(t *testing.T) {
521535
mockDynamoDBClient := new(MockDynamoDBClient)
522536
mockCMProvider := new(MockCryptographicMaterialsProvider)
523-
attributeActions := NewAttributeActions(AttributeActionDoNothing)
524-
attributeActions.SetAttributeAction("SensitiveAttribute", AttributeActionEncrypt)
525-
encryptedClient := NewEncryptedClient(mockDynamoDBClient, mockCMProvider, attributeActions)
537+
clientConfig := NewClientConfig(
538+
WithDefaultEncryption(EncryptNone),
539+
WithEncryption("SensitiveAttribute", EncryptStandard),
540+
)
541+
542+
encryptedClient := NewEncryptedClient(mockDynamoDBClient, mockCMProvider, clientConfig)
526543

527544
// Mock DescribeTable call to simulate fetching table primary key schema.
528545
mockDynamoDBClient.On("DescribeTable", mock.Anything, mock.AnythingOfType("*dynamodb.DescribeTableInput"), mock.Anything).Return(&dynamodb.DescribeTableOutput{

‎pkg/encrypted/resource.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,15 +8,15 @@ import (
88
type EncryptedResource struct {
99
Client *EncryptedClient
1010
MaterialsProvider provider.CryptographicMaterialsProvider
11-
AttributeActions *AttributeActions
11+
ClientConfig *ClientConfig
1212
}
1313

1414
// NewEncryptedResource creates a new instance of EncryptedResource.
15-
func NewEncryptedResource(client *EncryptedClient, materialsProvider provider.CryptographicMaterialsProvider, attributeActions *AttributeActions) *EncryptedResource {
15+
func NewEncryptedResource(client *EncryptedClient, materialsProvider provider.CryptographicMaterialsProvider, clientConfig *ClientConfig) *EncryptedResource {
1616
return &EncryptedResource{
1717
Client: client,
1818
MaterialsProvider: materialsProvider,
19-
AttributeActions: attributeActions,
19+
ClientConfig: clientConfig,
2020
}
2121
}
2222

‎pkg/materials/materials.go

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@ type CryptographicMaterials interface {
1010
EncryptionKey() delegatedkeys.DelegatedKey
1111
DecryptionKey() delegatedkeys.DelegatedKey
1212
SigningKey() delegatedkeys.DelegatedKey
13-
VerificationKey() delegatedkeys.DelegatedKey
1413
}
1514

1615
// EncryptionMaterials defines the structure for encryption materials.
@@ -54,14 +53,12 @@ func (em *EncryptionMaterials) VerificationKey() delegatedkeys.DelegatedKey {
5453
type DecryptionMaterials struct {
5554
materialDescription map[string]string
5655
decryptionKey delegatedkeys.DelegatedKey
57-
verificationKey delegatedkeys.DelegatedKey
5856
}
5957

60-
func NewDecryptionMaterials(description map[string]string, decryptionKey, verificationKey delegatedkeys.DelegatedKey) CryptographicMaterials {
58+
func NewDecryptionMaterials(description map[string]string, decryptionKey delegatedkeys.DelegatedKey) CryptographicMaterials {
6159
return &DecryptionMaterials{
6260
materialDescription: description,
6361
decryptionKey: decryptionKey,
64-
verificationKey: verificationKey,
6562
}
6663
}
6764

@@ -82,7 +79,3 @@ func (dm *DecryptionMaterials) DecryptionKey() delegatedkeys.DelegatedKey {
8279
func (dm *DecryptionMaterials) SigningKey() delegatedkeys.DelegatedKey {
8380
panic("Decryption materials do not provide signing keys.")
8481
}
85-
86-
func (dm *DecryptionMaterials) VerificationKey() delegatedkeys.DelegatedKey {
87-
return dm.verificationKey
88-
}

‎pkg/provider/kms.go renamed to ‎pkg/provider/aws.go

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,6 @@ func (p *AwsKmsCryptographicMaterialsProvider) DecryptionMaterials(ctx context.C
9292
return nil, fmt.Errorf("failed to decode signature: %v", err)
9393
}
9494

95-
// Verify the wrapped keyset's signature
9695
valid, err := delegatedkeys.VerifySignature(publicKeyBytes, signatureBytes, encryptedKeyset)
9796
if err != nil || !valid {
9897
return nil, fmt.Errorf("failed to verify the wrapped keyset's signature: %v", err)
@@ -104,7 +103,7 @@ func (p *AwsKmsCryptographicMaterialsProvider) DecryptionMaterials(ctx context.C
104103
}
105104

106105
// Construct DecryptionMaterials with the actual delegatedKey
107-
return materials.NewDecryptionMaterials(materialDescMap, delegatedKey, nil), nil
106+
return materials.NewDecryptionMaterials(materialDescMap, delegatedKey), nil
108107
}
109108

110109
func (p *AwsKmsCryptographicMaterialsProvider) TableName() string {

0 commit comments

Comments
 (0)