@@ -132,8 +132,8 @@ impl<Ids: KeyIds> KeyStoreContext<'_, Ids> {
132
132
///
133
133
/// # Arguments
134
134
///
135
- /// * `wrapping_key` - The key id used to decrypt the `wrapped_key`. It must already exist
136
- /// in the context
135
+ /// * `wrapping_key` - The key id used to decrypt the `wrapped_key`. It must already exist in
136
+ /// the context
137
137
/// * `new_key_id` - The key id where the decrypted key will be stored. If it already exists, it
138
138
/// will be overwritten
139
139
/// * `wrapped_key` - The key to decrypt
@@ -147,30 +147,39 @@ impl<Ids: KeyIds> KeyStoreContext<'_, Ids> {
147
147
148
148
let key = match ( wrapped_key, wrapping_key) {
149
149
( EncString :: Aes256Cbc_B64 { iv, data } , SymmetricCryptoKey :: Aes256CbcKey ( key) ) => {
150
- SymmetricCryptoKey :: try_from ( crate :: aes:: decrypt_aes256 ( iv, data. clone ( ) , & key. enc_key ) ?) ?
150
+ SymmetricCryptoKey :: try_from ( crate :: aes:: decrypt_aes256 (
151
+ iv,
152
+ data. clone ( ) ,
153
+ & key. enc_key ,
154
+ ) ?) ?
151
155
}
152
156
(
153
157
EncString :: Aes256Cbc_HmacSha256_B64 { iv, mac, data } ,
154
158
SymmetricCryptoKey :: Aes256CbcHmacKey ( key) ,
159
+ ) => SymmetricCryptoKey :: try_from ( crate :: aes:: decrypt_aes256_hmac (
160
+ iv,
161
+ mac,
162
+ data. clone ( ) ,
163
+ & key. mac_key ,
164
+ & key. enc_key ,
165
+ ) ?) ?,
166
+ (
167
+ EncString :: Cose_Encrypt0_B64 { data } ,
168
+ SymmetricCryptoKey :: XChaCha20Poly1305Key ( key) ,
155
169
) => {
156
- SymmetricCryptoKey :: try_from ( crate :: aes:: decrypt_aes256_hmac ( iv, mac, data. clone ( ) , & key. mac_key , & key. enc_key ) ?) ?
157
- }
158
- ( EncString :: Cose_Encrypt0_B64 { data } , SymmetricCryptoKey :: XChaCha20Poly1305Key ( key) ) => {
159
- let ( content_bytes, content_format) = crate :: cose:: decrypt_xchacha20_poly1305 ( data, key) ?;
170
+ let ( content_bytes, content_format) =
171
+ crate :: cose:: decrypt_xchacha20_poly1305 ( data, key) ?;
160
172
match content_format {
161
173
ContentFormat :: OctetStream => SymmetricCryptoKey :: try_from ( content_bytes) ?,
162
174
ContentFormat :: CoseKey => SymmetricCryptoKey :: try_from_cose ( & content_bytes) ?,
163
- _ => return Err ( CryptoError :: InvalidKey )
175
+ _ => return Err ( CryptoError :: InvalidKey ) ,
164
176
}
165
177
}
166
178
_ => return Err ( CryptoError :: InvalidKey ) ,
167
179
} ;
168
180
169
181
#[ allow( deprecated) ]
170
- self . set_symmetric_key (
171
- new_key_id,
172
- key,
173
- ) ?;
182
+ self . set_symmetric_key ( new_key_id, key) ?;
174
183
175
184
// Returning the new key identifier for convenience
176
185
Ok ( new_key_id)
@@ -199,12 +208,14 @@ impl<Ids: KeyIds> KeyStoreContext<'_, Ids> {
199
208
// or `Aes256CbcKey`, or by specifying the content format to be CoseKey, in case the
200
209
// wrapped key is a `XChaCha20Poly1305Key`.
201
210
match ( wrapping_key_instance, key_to_wrap_instance) {
202
- ( Aes256CbcHmacKey ( _) , Aes256CbcHmacKey ( _) | Aes256CbcKey ( _) | XChaCha20Poly1305Key ( _) ) => self
203
- . encrypt_data_with_symmetric_key (
204
- wrapping_key,
205
- key_to_wrap_instance. to_encoded ( ) . as_slice ( ) ,
206
- ContentFormat :: OctetStream ,
207
- ) ,
211
+ (
212
+ Aes256CbcHmacKey ( _) ,
213
+ Aes256CbcHmacKey ( _) | Aes256CbcKey ( _) | XChaCha20Poly1305Key ( _) ,
214
+ ) => self . encrypt_data_with_symmetric_key (
215
+ wrapping_key,
216
+ key_to_wrap_instance. to_encoded ( ) . as_slice ( ) ,
217
+ ContentFormat :: OctetStream ,
218
+ ) ,
208
219
( XChaCha20Poly1305Key ( _) , Aes256CbcHmacKey ( _) | Aes256CbcKey ( _) ) => self
209
220
. encrypt_data_with_symmetric_key (
210
221
wrapping_key,
@@ -388,7 +399,10 @@ impl<Ids: KeyIds> KeyStoreContext<'_, Ids> {
388
399
EncString :: Aes256Cbc_HmacSha256_B64 { iv, mac, data } ,
389
400
SymmetricCryptoKey :: Aes256CbcHmacKey ( key) ,
390
401
) => crate :: aes:: decrypt_aes256_hmac ( iv, mac, data. clone ( ) , & key. mac_key , & key. enc_key ) ,
391
- ( EncString :: Cose_Encrypt0_B64 { data } , SymmetricCryptoKey :: XChaCha20Poly1305Key ( key) ) => {
402
+ (
403
+ EncString :: Cose_Encrypt0_B64 { data } ,
404
+ SymmetricCryptoKey :: XChaCha20Poly1305Key ( key) ,
405
+ ) => {
392
406
let ( data, _) = crate :: cose:: decrypt_xchacha20_poly1305 ( data, key) ?;
393
407
Ok ( data)
394
408
}
@@ -501,30 +515,48 @@ mod tests {
501
515
// Aes256 CBC HMAC keys
502
516
let key_aes_1_id = TestSymmKey :: A ( 1 ) ;
503
517
let key_aes_1 = SymmetricCryptoKey :: make_aes256_cbc_hmac_key ( ) ;
504
- ctx. set_symmetric_key ( key_aes_1_id, key_aes_1. clone ( ) ) . unwrap ( ) ;
518
+ ctx. set_symmetric_key ( key_aes_1_id, key_aes_1. clone ( ) )
519
+ . unwrap ( ) ;
505
520
let key_aes_2_id = TestSymmKey :: A ( 2 ) ;
506
521
let key_aes_2 = SymmetricCryptoKey :: make_aes256_cbc_hmac_key ( ) ;
507
- ctx. set_symmetric_key ( key_aes_2_id, key_aes_2. clone ( ) ) . unwrap ( ) ;
522
+ ctx. set_symmetric_key ( key_aes_2_id, key_aes_2. clone ( ) )
523
+ . unwrap ( ) ;
508
524
509
525
// XChaCha20 Poly1305 keys
510
526
let key_xchacha_3_id = TestSymmKey :: A ( 3 ) ;
511
527
let key_xchacha_3 = SymmetricCryptoKey :: make_xchacha20_poly1305_key ( ) ;
512
- ctx. set_symmetric_key ( key_xchacha_3_id, key_xchacha_3. clone ( ) ) . unwrap ( ) ;
528
+ ctx. set_symmetric_key ( key_xchacha_3_id, key_xchacha_3. clone ( ) )
529
+ . unwrap ( ) ;
513
530
let key_xchacha_4_id = TestSymmKey :: A ( 4 ) ;
514
531
let key_xchacha_4 = SymmetricCryptoKey :: make_xchacha20_poly1305_key ( ) ;
515
- ctx. set_symmetric_key ( key_xchacha_4_id, key_xchacha_4. clone ( ) ) . unwrap ( ) ;
532
+ ctx. set_symmetric_key ( key_xchacha_4_id, key_xchacha_4. clone ( ) )
533
+ . unwrap ( ) ;
516
534
517
535
// Wrap and unwrap the keys
518
536
let wrapped_key_1_2 = ctx. wrap_symmetric_key ( key_aes_1_id, key_aes_2_id) . unwrap ( ) ;
519
- let wrapped_key_1_3 = ctx. wrap_symmetric_key ( key_aes_1_id, key_xchacha_3_id) . unwrap ( ) ;
520
- let wrapped_key_3_1 = ctx. wrap_symmetric_key ( key_xchacha_3_id, key_aes_1_id) . unwrap ( ) ;
521
- let wrapped_key_3_4 = ctx. wrap_symmetric_key ( key_xchacha_3_id, key_xchacha_4_id) . unwrap ( ) ;
537
+ let wrapped_key_1_3 = ctx
538
+ . wrap_symmetric_key ( key_aes_1_id, key_xchacha_3_id)
539
+ . unwrap ( ) ;
540
+ let wrapped_key_3_1 = ctx
541
+ . wrap_symmetric_key ( key_xchacha_3_id, key_aes_1_id)
542
+ . unwrap ( ) ;
543
+ let wrapped_key_3_4 = ctx
544
+ . wrap_symmetric_key ( key_xchacha_3_id, key_xchacha_4_id)
545
+ . unwrap ( ) ;
522
546
523
547
// Unwrap the keys
524
- let unwrapped_key_2 = ctx. unwrap_symmetric_key ( key_aes_1_id, key_aes_2_id, & wrapped_key_1_2) . unwrap ( ) ;
525
- let unwrapped_key_3 = ctx. unwrap_symmetric_key ( key_aes_1_id, key_xchacha_3_id, & wrapped_key_1_3) . unwrap ( ) ;
526
- let unwrapped_key_1 = ctx. unwrap_symmetric_key ( key_xchacha_3_id, key_aes_1_id, & wrapped_key_3_1) . unwrap ( ) ;
527
- let unwrapped_key_4 = ctx. unwrap_symmetric_key ( key_xchacha_3_id, key_xchacha_4_id, & wrapped_key_3_4) . unwrap ( ) ;
548
+ let unwrapped_key_2 = ctx
549
+ . unwrap_symmetric_key ( key_aes_1_id, key_aes_2_id, & wrapped_key_1_2)
550
+ . unwrap ( ) ;
551
+ let unwrapped_key_3 = ctx
552
+ . unwrap_symmetric_key ( key_aes_1_id, key_xchacha_3_id, & wrapped_key_1_3)
553
+ . unwrap ( ) ;
554
+ let unwrapped_key_1 = ctx
555
+ . unwrap_symmetric_key ( key_xchacha_3_id, key_aes_1_id, & wrapped_key_3_1)
556
+ . unwrap ( ) ;
557
+ let unwrapped_key_4 = ctx
558
+ . unwrap_symmetric_key ( key_xchacha_3_id, key_xchacha_4_id, & wrapped_key_3_4)
559
+ . unwrap ( ) ;
528
560
529
561
// Assert that the unwrapped keys are the same as the original keys
530
562
assert_eq ! ( unwrapped_key_2, key_aes_2_id) ;
0 commit comments