[RFC] Implement data envelope

[quexten]

🎟️ Tracking

📔 Objective

Consumers want to protect complex structs such as:

• Vault exports
• Ciphers (vault items)
• Organization reports

Currently, they serialize these themselves (organization reports are serialized as json), and encrypt fields individually. This is slow to handle during encrypt/decrypt, and complex to maintain. The server now has to know the same representation as clients. At the same time, this can be abused by the server omitting certain fields, or swapping encrypted fields encrypted under the same key.

This PR implements a "DataEnvelope". The dataenvelope solves the problem of encrypting entire structs. The caller just provides a struct that is Serializable/Deserializable, and gets back an encrypted blob. The caller does not decide serialization.

Further, we force the creation of a "content encryption key" by the interface. This ensures that teams do not create a coupling to keys. When implementing key-rotation we do not want to re-upload data, but only re-upload re-encrypted keys, and the content-encryption-key enforces this key being present.

An example is provided to show usage.

⏰ Reminders before review

• Contributor guidelines followed
• All formatters and local linters executed and passed
• Written new unit and / or integration tests where applicable
• Protected functional changes with optionality (feature flags)
• Used internationalization (i18n) for all UI strings
• CI builds passed
• Communicated to DevOps any deployment requirements
• Updated any necessary documentation (Confluence, contributing docs) or informed the documentation
  team

🦮 Reviewer guidelines

• 👍 (:+1:) or similar for great changes
• 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
• ❓ (:question:) for questions
• 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed
  issue and could potentially benefit from discussion
• 🎨 (:art:) for suggestions / improvements
• ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
• 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
• ⛏ (:pick:) for minor or nitpick changes

[github-actions]

Checkmarx One – Scan Summary & Details – b2bcf7be-9608-4ac5-80e8-ed3ab1adf302

Great job, no security vulnerabilities found in this Pull Request

[codecov]

Codecov Report

Attention: Patch coverage is 55.93220% with 52 lines in your changes missing coverage. Please review.

Project coverage is 71.80%. Comparing base (f2bc708) to head (0c60bcc).

Files with missing lines	Patch %	Lines
crates/bitwarden-crypto/src/safe/data_envelope.rs	50.60%	41 Missing ⚠️
crates/bitwarden-crypto/src/content_format.rs	0.00%	6 Missing ⚠️
crates/bitwarden-crypto/src/store/context.rs	50.00%	4 Missing ⚠️
crates/bitwarden-crypto/src/cose.rs	91.66%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #336      +/-   ##
==========================================
- Coverage   71.89%   71.80%   -0.10%     
==========================================
  Files         240      241       +1     
  Lines       19622    19726     +104     
==========================================
+ Hits        14108    14164      +56     
- Misses       5514     5562      +48     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud