[PM-40158] Use xaes-256-gcm as user key algorithm

for encryption v2 users

Author: eligrubb

crates/bitwarden-core/src/client/internal.rs

@@ -280,10 +280,7 @@ impl InternalClient {
                     .unwrap_v2(user_key_id, &mut ctx)
                     .map_err(|_| EncryptionSettingsError::InvalidUpgradeToken)?
             }
-            (
-                SymmetricCryptoKey::XChaCha20Poly1305Key(_) | SymmetricCryptoKey::XAes256GcmKey(_),
-                Some(_),
-            ) => {
+            (SymmetricCryptoKey::XAes256GcmKey(_), Some(_)) => {
                 debug!("V2 user key already present, ignoring upgrade token");
                 user_key_id
             }

crates/bitwarden-core/src/key_management/account_cryptographic_state.rs

@@ -6,7 +6,7 @@
 //!
 //! V1 users have only a private key protected by an AES256-CBC-HMAC user key.
 //! V2 users have a private key, a signing key, a signed public key and a signed security state,
-//! all protected by a Cose serialized AEAD key, currently XChaCha20-Poly1305.
+//! all protected by a COSE-serialized XAES-256-GCM key.
 
 use std::sync::RwLock;
 
@@ -335,7 +335,7 @@ impl WrappedAccountCryptographicState {
     pub fn make(
         ctx: &mut KeyStoreContext<KeySlotIds>,
     ) -> Result<(SymmetricKeySlotId, Self), AccountCryptographyInitializationError> {
-        let user_key = ctx.make_symmetric_key(SymmetricKeyAlgorithm::XChaCha20Poly1305);
+        let user_key = ctx.make_symmetric_key(SymmetricKeyAlgorithm::XAes256Gcm);
         let private_key = ctx.make_private_key(PublicKeyEncryptionAlgorithm::RsaOaepSha1);
         let signing_key = ctx.make_signing_key(SignatureAlgorithm::MlDsa44);
         let signed_public_key = ctx.make_signed_public_key(private_key, signing_key)?;

crates/bitwarden-core/src/key_management/crypto.rs

@@ -926,7 +926,7 @@ pub(crate) fn make_v2_keys_for_v1_user(
     let private_key = ctx.dangerous_get_private_key(private_key_id)?.clone();
 
     // New user key
-    let user_key = SymmetricCryptoKey::make(SymmetricKeyAlgorithm::XChaCha20Poly1305);
+    let user_key = SymmetricCryptoKey::make(SymmetricKeyAlgorithm::XAes256Gcm);
 
     // New signing key
     let signing_key = SigningKey::make(SignatureAlgorithm::Ed25519);
@@ -1239,8 +1239,8 @@ pub(crate) fn make_user_password_registration(
     master_password: String,
     salt: String,
 ) -> Result<MakeUserMasterPasswordRegistrationResponse, MakeKeysError> {
-    // make_user_v2_crypto_state() - Creates user key (xchacha20-poly1305), RSA keypair, ed25519
-    // signature keypair, and signed security state
+    // make_user_v2_crypto_state() - Creates user key (XAES-256-GCM), RSA key pair, ML-DSA
+    // signing key pair, and signed security state
     let mut ctx = client.internal.get_key_store().context_mut();
     let (user_key_id, wrapped_state) = WrappedAccountCryptographicState::make(&mut ctx)
         .map_err(MakeKeysError::AccountCryptographyInitialization)?;

crates/bitwarden-core/src/key_management/crypto/reinit_user_crypto.rs

@@ -117,8 +117,11 @@ pub(crate) async fn reinit_user_crypto(
                 debug!("Active user key is already V2, skipping re-initialization.");
                 return Ok(());
             }
-            SymmetricKeyAlgorithm::Aes256Gcm => {
-                error!("Unexpected AES-256-GCM user key during reinit_user_crypto");
+            SymmetricKeyAlgorithm::XChaCha20Poly1305 | SymmetricKeyAlgorithm::Aes256Gcm => {
+                error!(
+                    ?current_algorithm,
+                    "Unexpected user key algorithm during reinit_user_crypto"
+                );
                 return Err(ReinitUserCryptoError::CryptoInitialization);
             }
         };

crates/bitwarden-core/src/key_management/crypto_client.rs

@@ -321,7 +321,7 @@ impl CryptoClient {
 
         match (algorithm, upgrade_token) {
             // Already V2, return current key
-            (SymmetricKeyAlgorithm::XChaCha20Poly1305 | SymmetricKeyAlgorithm::XAes256Gcm, _) => {
+            (SymmetricKeyAlgorithm::XAes256Gcm, _) => {
                 #[allow(deprecated)]
                 let current_key = ctx
                     .dangerous_get_symmetric_key(SymmetricKeySlotId::User)
@@ -343,7 +343,9 @@ impl CryptoClient {
             (SymmetricKeyAlgorithm::Aes256CbcHmac, None) => {
                 Err(CryptoClientError::UpgradeTokenRequired)
             }
-            (SymmetricKeyAlgorithm::Aes256Gcm, _) => Err(CryptoClientError::InvalidKeyType),
+            (SymmetricKeyAlgorithm::XChaCha20Poly1305 | SymmetricKeyAlgorithm::Aes256Gcm, _) => {
+                Err(CryptoClientError::InvalidKeyType)
+            }
         }
     }
 }

crates/bitwarden-core/src/key_management/v2_upgrade_token.rs

@@ -114,6 +114,14 @@ impl V2UpgradeToken {
             .unwrap_symmetric_key(v1_key_id, &self.wrapped_user_key_2)
             .map_err(|_| V2UpgradeTokenError::DecryptionFailed)?;
 
+        if ctx
+            .get_symmetric_key_algorithm(v2_key_id)
+            .map_err(|_| V2UpgradeTokenError::KeyMissing)?
+            != SymmetricKeyAlgorithm::XAes256Gcm
+        {
+            return Err(V2UpgradeTokenError::WrongKeyType);
+        }
+
         // Validate: unwrapped V2 should be able to decrypt wrapped V1 key
         let _: Vec<u8> = self
             .wrapped_user_key_1

crates/bitwarden-crypto/src/keys/symmetric_crypto_key.rs

@@ -88,7 +88,7 @@ impl TryFrom<wasm_bindgen::JsValue> for SymmetricCryptoKey {
 pub enum SymmetricKeyAlgorithm {
     /// Used for V1 user keys and data encryption
     Aes256CbcHmac,
-    /// Used for V2 user keys and data envelopes
+    /// Used by legacy COSE-based envelopes
     XChaCha20Poly1305,
     /// FIPS-approved AEAD.
     /// Used as content encryption key in:
@@ -97,8 +97,8 @@ pub enum SymmetricKeyAlgorithm {
     ///
     /// May not be used for multi-device scoped keys such as the user-key or organization-key
     Aes256Gcm,
-    /// Extended-nonce AES-256-GCM. Safe for random nonces and usable as a
-    /// general-purpose encryption/wrapping key.
+    /// Extended-nonce AES-256-GCM. Used for V2 user keys and as a general-purpose
+    /// encryption/wrapping key.
     XAes256Gcm,
 }
 

crates/bitwarden-crypto/src/store/key_rotation.rs

@@ -1,7 +1,7 @@
 use crate::{
     CoseKeyBytes, CoseSerializable, CryptoError, EncString, KeyEncryptable, KeySlotIds,
     KeyStoreContext, SignedPublicKey, SignedPublicKeyMessage, SpkiPublicKeyBytes,
-    SymmetricCryptoKey,
+    SymmetricCryptoKey, SymmetricKeyAlgorithm,
 };
 
 /// Rotated set of account keys
@@ -27,7 +27,7 @@ pub fn dangerous_get_v2_rotated_account_keys<Ids: KeySlotIds>(
     current_user_signing_key_id: Ids::Signing,
     ctx: &KeyStoreContext<Ids>,
 ) -> Result<RotatedUserKeys, CryptoError> {
-    let user_key = SymmetricCryptoKey::make_xchacha20_poly1305_key();
+    let user_key = SymmetricCryptoKey::make(SymmetricKeyAlgorithm::XAes256Gcm);
 
     let current_private_key = ctx.get_private_key(current_user_private_key_id)?;
     let current_signing_key = ctx.get_signing_key(current_user_signing_key_id)?;

crates/bitwarden-user-crypto-management/src/key_rotation/rotation_context.rs

@@ -84,8 +84,8 @@ pub(super) fn make_rotation_context(
     );
     let current_user_key_id = SymmetricKeySlotId::User;
 
-    debug!("Generating new xchacha20-poly1305 user key for key rotation");
-    let new_user_key_id = ctx.make_symmetric_key(SymmetricKeyAlgorithm::XChaCha20Poly1305);
+    debug!("Generating new XAES-256-GCM user key for key rotation");
+    let new_user_key_id = ctx.make_symmetric_key(SymmetricKeyAlgorithm::XAes256Gcm);
 
     Ok(RotationContext {
         v1_organization_memberships,