Merge pull request #122 from RobertDrazkowskiGL/psa-cipher-op

Add PsaCipherEncrypt and PsaCipherDecrypt operations

Author: ionut-arm

src/operations/mod.rs

@@ -23,6 +23,8 @@ pub mod psa_asymmetric_encrypt;
 pub mod psa_asymmetric_decrypt;
 pub mod psa_aead_encrypt;
 pub mod psa_aead_decrypt;
+pub mod psa_cipher_encrypt;
+pub mod psa_cipher_decrypt;
 pub mod psa_sign_message;
 pub mod psa_verify_message;
 pub mod list_opcodes;
@@ -83,6 +85,10 @@ pub enum NativeOperation {
     PsaAeadEncrypt(psa_aead_encrypt::Operation),
     /// PsaAeadDecrypt operation
     PsaAeadDecrypt(psa_aead_decrypt::Operation),
+    /// PsaCipherEncrypt operation
+    PsaCipherEncrypt(psa_cipher_encrypt::Operation),
+    /// PsaCipherDecrypt operation
+    PsaCipherDecrypt(psa_cipher_decrypt::Operation),
     /// PsaGenerateRandom operation
     PsaGenerateRandom(psa_generate_random::Operation),
     /// PsaRawKeyAgreement operation
@@ -117,6 +123,8 @@ impl NativeOperation {
             NativeOperation::PsaAsymmetricDecrypt(_) => Opcode::PsaAsymmetricDecrypt,
             NativeOperation::PsaAeadEncrypt(_) => Opcode::PsaAeadEncrypt,
             NativeOperation::PsaAeadDecrypt(_) => Opcode::PsaAeadDecrypt,
+            NativeOperation::PsaCipherEncrypt(_) => Opcode::PsaCipherEncrypt,
+            NativeOperation::PsaCipherDecrypt(_) => Opcode::PsaCipherDecrypt,
             NativeOperation::PsaGenerateRandom(_) => Opcode::PsaGenerateRandom,
             NativeOperation::PsaRawKeyAgreement(_) => Opcode::PsaRawKeyAgreement,
             NativeOperation::PsaSignMessage(_) => Opcode::PsaSignMessage,
@@ -169,6 +177,10 @@ pub enum NativeResult {
     PsaAeadEncrypt(psa_aead_encrypt::Result),
     /// PsaAeadDecrypt result
     PsaAeadDecrypt(psa_aead_decrypt::Result),
+    /// PsaCipherEncrypt result
+    PsaCipherEncrypt(psa_cipher_encrypt::Result),
+    /// PsaCipherDecrypt result
+    PsaCipherDecrypt(psa_cipher_decrypt::Result),
     /// PsaGenerateRandom result
     PsaGenerateRandom(psa_generate_random::Result),
     /// PsaRawKeyAgreement result
@@ -203,6 +215,8 @@ impl NativeResult {
             NativeResult::PsaAsymmetricDecrypt(_) => Opcode::PsaAsymmetricDecrypt,
             NativeResult::PsaAeadEncrypt(_) => Opcode::PsaAeadEncrypt,
             NativeResult::PsaAeadDecrypt(_) => Opcode::PsaAeadDecrypt,
+            NativeResult::PsaCipherEncrypt(_) => Opcode::PsaCipherEncrypt,
+            NativeResult::PsaCipherDecrypt(_) => Opcode::PsaCipherDecrypt,
             NativeResult::PsaGenerateRandom(_) => Opcode::PsaGenerateRandom,
             NativeResult::PsaRawKeyAgreement(_) => Opcode::PsaRawKeyAgreement,
             NativeResult::PsaSignMessage(_) => Opcode::PsaSignMessage,
@@ -350,6 +364,18 @@ impl From<psa_aead_decrypt::Operation> for NativeOperation {
     }
 }
 
+impl From<psa_cipher_encrypt::Operation> for NativeOperation {
+    fn from(op: psa_cipher_encrypt::Operation) -> Self {
+        NativeOperation::PsaCipherEncrypt(op)
+    }
+}
+
+impl From<psa_cipher_decrypt::Operation> for NativeOperation {
+    fn from(op: psa_cipher_decrypt::Operation) -> Self {
+        NativeOperation::PsaCipherDecrypt(op)
+    }
+}
+
 impl From<psa_generate_random::Operation> for NativeOperation {
     fn from(op: psa_generate_random::Operation) -> Self {
         NativeOperation::PsaGenerateRandom(op)
@@ -503,6 +529,18 @@ impl From<psa_aead_decrypt::Result> for NativeResult {
     }
 }
 
+impl From<psa_cipher_encrypt::Result> for NativeResult {
+    fn from(op: psa_cipher_encrypt::Result) -> Self {
+        NativeResult::PsaCipherEncrypt(op)
+    }
+}
+
+impl From<psa_cipher_decrypt::Result> for NativeResult {
+    fn from(op: psa_cipher_decrypt::Result) -> Self {
+        NativeResult::PsaCipherDecrypt(op)
+    }
+}
+
 impl From<psa_generate_random::Result> for NativeResult {
     fn from(op: psa_generate_random::Result) -> Self {
         NativeResult::PsaGenerateRandom(op)

src/operations/psa_cipher_decrypt.rs

@@ -0,0 +1,129 @@
+// Copyright 2021 Contributors to the Parsec project.
+// SPDX-License-Identifier: Apache-2.0
+//! # PsaCipherDecrypt operation
+//!
+//! Decrypt a short message with a symmetric cipher
+
+use super::psa_key_attributes::Attributes;
+use crate::operations::psa_algorithm::Cipher;
+use crate::requests::ResponseStatus;
+use derivative::Derivative;
+
+/// Native object for cipher decryption operations.
+#[derive(Derivative)]
+#[derivative(Debug)]
+pub struct Operation {
+    /// Defines which key should be used for the decryption operation.
+    pub key_name: String,
+    /// An cipher encryption algorithm to be used for decryption, that is compatible with the type of key.
+    pub alg: Cipher,
+    /// The short encrypted message to be decrypted.
+    #[derivative(Debug = "ignore")]
+    pub ciphertext: zeroize::Zeroizing<Vec<u8>>,
+}
+
+impl Operation {
+    /// Validate the contents of the operation against the attributes of the key it targets
+    ///
+    /// This method checks that:
+    /// * the key policy allows decrypting messages
+    /// * the key policy allows the decryption algorithm requested in the operation
+    /// * the key type is compatible with the requested algorithm
+    /// * the message to decrypt is valid (not length 0)
+    pub fn validate(&self, key_attributes: Attributes) -> crate::requests::Result<()> {
+        key_attributes.can_decrypt_message()?;
+        key_attributes.permits_alg(self.alg.into())?;
+        key_attributes.compatible_with_alg(self.alg.into())?;
+        if self.ciphertext.is_empty() {
+            return Err(ResponseStatus::PsaErrorInvalidArgument);
+        }
+        Ok(())
+    }
+}
+
+/// Native object for cipher decrypt result.
+// Debug derived as NativeResult enum requires it, even though nothing inside this Result is debuggable
+// as `plaintext` is sensitive.
+#[derive(Derivative)]
+#[derivative(Debug)]
+pub struct Result {
+    /// Decrypted message
+    #[derivative(Debug = "ignore")]
+    pub plaintext: zeroize::Zeroizing<Vec<u8>>,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::operations::psa_algorithm::Cipher;
+    use crate::operations::psa_key_attributes::{Lifetime, Policy, Type, UsageFlags};
+
+    fn get_attrs() -> Attributes {
+        let mut usage_flags = UsageFlags::default();
+        let _ = usage_flags.set_decrypt();
+        Attributes {
+            lifetime: Lifetime::Persistent,
+            key_type: Type::Arc4,
+            bits: 256,
+            policy: Policy {
+                usage_flags,
+                permitted_algorithms: Cipher::StreamCipher.into(),
+            },
+        }
+    }
+
+    #[test]
+    fn validate_success() {
+        (Operation {
+            key_name: String::from("some key"),
+            alg: Cipher::StreamCipher,
+            ciphertext: vec![0xff, 32].into(),
+        })
+        .validate(get_attrs())
+        .unwrap();
+    }
+
+    #[test]
+    fn cannot_decrypt() {
+        let mut attrs = get_attrs();
+        attrs.policy.usage_flags = UsageFlags::default();
+        assert_eq!(
+            (Operation {
+                key_name: String::from("some key"),
+                alg: Cipher::StreamCipher,
+                ciphertext: vec![0xff, 32].into(),
+            })
+            .validate(attrs)
+            .unwrap_err(),
+            ResponseStatus::PsaErrorNotPermitted
+        );
+    }
+
+    #[test]
+    fn wrong_algorithm() {
+        assert_eq!(
+            (Operation {
+                key_name: String::from("some key"),
+                alg: Cipher::Cfb,
+                ciphertext: vec![0xff, 32].into(),
+            })
+            .validate(get_attrs())
+            .unwrap_err(),
+            ResponseStatus::PsaErrorNotPermitted
+        );
+    }
+
+    #[test]
+    fn invalid_ciphertext() {
+        assert_eq!(
+            (Operation {
+                key_name: String::from("some key"),
+                alg: Cipher::StreamCipher,
+                ciphertext: vec![].into(),
+            })
+            .validate(get_attrs())
+            .unwrap_err(),
+            ResponseStatus::PsaErrorInvalidArgument
+        );
+    }
+}

src/operations/psa_cipher_encrypt.rs

@@ -0,0 +1,127 @@
+// Copyright 2021 Contributors to the Parsec project.
+// SPDX-License-Identifier: Apache-2.0
+//! # PsaCipherEncrypt operation
+//!
+//! Encrypt a short message with a symmetric cipher
+
+use super::psa_key_attributes::Attributes;
+use crate::operations::psa_algorithm::Cipher;
+use crate::requests::ResponseStatus;
+use derivative::Derivative;
+
+/// Native object for cipher encryption operations.
+#[derive(Derivative)]
+#[derivative(Debug)]
+pub struct Operation {
+    /// Defines which key should be used for the encryption operation.
+    pub key_name: String,
+    /// An cipher encryption algorithm that is compatible with the key type
+    pub alg: Cipher,
+    /// The short message to be encrypted.
+    #[derivative(Debug = "ignore")]
+    pub plaintext: zeroize::Zeroizing<Vec<u8>>,
+}
+
+impl Operation {
+    /// Validate the contents of the operation against the attributes of the key it targets
+    ///
+    /// This method checks that:
+    /// * the key policy allows encrypting messages
+    /// * the key policy allows the encryption algorithm requested in the operation
+    /// * the key type is compatible with the requested algorithm
+    /// * the message to encrypt is valid (not length 0)
+    pub fn validate(&self, key_attributes: Attributes) -> crate::requests::Result<()> {
+        key_attributes.can_encrypt_message()?;
+        key_attributes.permits_alg(self.alg.into())?;
+        key_attributes.compatible_with_alg(self.alg.into())?;
+        if self.plaintext.is_empty() {
+            return Err(ResponseStatus::PsaErrorInvalidArgument);
+        }
+        Ok(())
+    }
+}
+
+/// Native object for cipher encrypt result.
+#[derive(Derivative)]
+#[derivative(Debug)]
+pub struct Result {
+    /// The `ciphertext` field contains the encrypted short message.
+    #[derivative(Debug = "ignore")]
+    pub ciphertext: zeroize::Zeroizing<Vec<u8>>,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::operations::psa_algorithm::Cipher;
+    use crate::operations::psa_key_attributes::{Lifetime, Policy, Type, UsageFlags};
+
+    fn get_attrs() -> Attributes {
+        let mut usage_flags = UsageFlags::default();
+        let _ = usage_flags.set_encrypt();
+        Attributes {
+            lifetime: Lifetime::Persistent,
+            key_type: Type::Arc4,
+            bits: 256,
+            policy: Policy {
+                usage_flags,
+                permitted_algorithms: Cipher::StreamCipher.into(),
+            },
+        }
+    }
+
+    #[test]
+    fn validate_success() {
+        (Operation {
+            key_name: String::from("some key"),
+            alg: Cipher::StreamCipher,
+            plaintext: vec![0xff, 32].into(),
+        })
+        .validate(get_attrs())
+        .unwrap();
+    }
+
+    #[test]
+    fn cannot_encrypt() {
+        let mut attrs = get_attrs();
+        attrs.policy.usage_flags = UsageFlags::default();
+        assert_eq!(
+            (Operation {
+                key_name: String::from("some key"),
+                alg: Cipher::StreamCipher,
+                plaintext: vec![0xff, 32].into(),
+            })
+            .validate(attrs)
+            .unwrap_err(),
+            ResponseStatus::PsaErrorNotPermitted
+        );
+    }
+
+    #[test]
+    fn wrong_algorithm() {
+        assert_eq!(
+            (Operation {
+                key_name: String::from("some key"),
+                alg: Cipher::Cfb,
+                plaintext: vec![0xff, 32].into(),
+            })
+            .validate(get_attrs())
+            .unwrap_err(),
+            ResponseStatus::PsaErrorNotPermitted
+        );
+    }
+
+    #[test]
+    fn invalid_plaintext() {
+        assert_eq!(
+            (Operation {
+                key_name: String::from("some key"),
+                alg: Cipher::StreamCipher,
+                plaintext: vec![].into(),
+            })
+            .validate(get_attrs())
+            .unwrap_err(),
+            ResponseStatus::PsaErrorInvalidArgument
+        );
+    }
+}

src/operations_protobuf/convert_psa_algorithm.rs

@@ -241,8 +241,14 @@ impl TryFrom<CipherProto> for Cipher {
     }
 }
 
+// Cipher algorithms: from protobuf to native
+pub fn i32_to_cipher(cipher_val: i32) -> Result<Cipher> {
+    let cipher_proto_alg: CipherProto = cipher_val.try_into()?;
+    cipher_proto_alg.try_into()
+}
+
 // Cipher algorithms: from native to protobuf
-fn cipher_to_i32(cipher: Cipher) -> i32 {
+pub fn cipher_to_i32(cipher: Cipher) -> i32 {
     match cipher {
         Cipher::StreamCipher => CipherProto::StreamCipher.into(),
         Cipher::Ctr => CipherProto::Ctr.into(),