From f1d125fdd56f1cb83c726cf9c512a5ab4ce91bc4 Mon Sep 17 00:00:00 2001 From: Andy Jewell Date: Thu, 17 Apr 2025 09:08:17 -0400 Subject: [PATCH 1/2] chore: bump MPL version --- .../test/perf-encrypt-manifest.json | 168 ++++++++++++------ .../test/thousand-encrypt-manifest.json | 29 ++- .../wrapped/KeyringToMasterKeyProvider.java | 18 +- .../internaldafny/extern/wrapped_esdk.py | 2 - mpl | 2 +- 5 files changed, 155 insertions(+), 64 deletions(-) diff --git a/TestVectors/dafny/TestVectors/test/perf-encrypt-manifest.json b/TestVectors/dafny/TestVectors/test/perf-encrypt-manifest.json index 6bf3f9d56..a9e84d9b7 100644 --- a/TestVectors/dafny/TestVectors/test/perf-encrypt-manifest.json +++ b/TestVectors/dafny/TestVectors/test/perf-encrypt-manifest.json @@ -1,63 +1,117 @@ { - "manifest": { - "type": "awses-encrypt", - "version": 5 + "manifest": { + "type": "awses-encrypt", + "version": 5 + }, + "client": { + "name": "aws-encryption-sdk-dafny", + "version": "4.1.0" + }, + "keys": "file://keys.json", + "plaintexts": { + "large": 1000000, + "giant": 100000000 + }, + "tests": { + "giant-raw-rsa": { + "encryption-scenario": { + "type": "positive-esdk", + "plaintext": "giant", + "description": "Generated RawRSA rsa-4096", + "algorithmSuiteId": "0146", + "frame-size": 512, + "encryptKeyDescription": { + "type": "raw", + "key": "rsa-4096-public", + "provider-id": "aws-raw-vectors-persistent-rsa-4096", + "encryption-algorithm": "rsa", + "padding-algorithm": "oaep-mgf1", + "padding-hash": "sha384" + }, + "decryptKeyDescription": { + "type": "raw", + "key": "rsa-4096-private", + "provider-id": "aws-raw-vectors-persistent-rsa-4096", + "encryption-algorithm": "rsa", + "padding-algorithm": "oaep-mgf1", + "padding-hash": "sha384" + }, + "encryption-context": {}, + "reproduced-encryption-context": {} + } }, - "client": { - "name": "aws-encryption-sdk-dafny", - "version": "4.1.0" + "giant-raw-rsa-tiny-frame": { + "encryption-scenario": { + "type": "positive-esdk", + "plaintext": "large", + "description": "Generated RawRSA rsa-4096", + "algorithmSuiteId": "0146", + "frame-size": 4, + "encryptKeyDescription": { + "type": "raw", + "key": "rsa-4096-public", + "provider-id": "aws-raw-vectors-persistent-rsa-4096", + "encryption-algorithm": "rsa", + "padding-algorithm": "oaep-mgf1", + "padding-hash": "sha384" + }, + "decryptKeyDescription": { + "type": "raw", + "key": "rsa-4096-private", + "provider-id": "aws-raw-vectors-persistent-rsa-4096", + "encryption-algorithm": "rsa", + "padding-algorithm": "oaep-mgf1", + "padding-hash": "sha384" + }, + "encryption-context": {}, + "reproduced-encryption-context": {} + } }, - "keys": "file://keys.json", - "plaintexts": { - "large": 1000000, - "giant": 100000000 + "giant-raw-aes-256": { + "encryption-scenario": { + "type": "positive-esdk", + "plaintext": "giant", + "description": "Generated RawAES aes-256", + "algorithmSuiteId": "0078", + "frame-size": 512, + "encryptKeyDescription": { + "type": "raw", + "key": "aes-256", + "provider-id": "aws-raw-vectors-persistent-aes-256", + "encryption-algorithm": "aes" + }, + "decryptKeyDescription": { + "type": "raw", + "key": "aes-256", + "provider-id": "aws-raw-vectors-persistent-aes-256", + "encryption-algorithm": "aes" + }, + "encryption-context": {}, + "reproduced-encryption-context": {} + } }, - "tests": { - "giant-raw-aes-256": { - "encryption-scenario": { - "type": "positive-esdk", - "plaintext": "giant", - "description": "Generated RawAES aes-256", - "algorithmSuiteId": "0078", - "frame-size": 512, - "encryptKeyDescription": { - "type": "raw", - "key": "aes-256", - "provider-id": "aws-raw-vectors-persistent-aes-256", - "encryption-algorithm": "aes" - }, - "decryptKeyDescription": { - "type": "raw", - "key": "aes-256", - "provider-id": "aws-raw-vectors-persistent-aes-256", - "encryption-algorithm": "aes" - }, - "encryption-context": {}, - "reproduced-encryption-context": {} - } - }, - "giant-raw-aes-256-tiny-frame": { - "encryption-scenario": { - "type": "positive-esdk", - "plaintext": "large", - "description": "Generated RawAES aes-256", - "algorithmSuiteId": "0078", - "frame-size": 4, - "encryptKeyDescription": { - "type": "raw", - "key": "aes-256", - "provider-id": "aws-raw-vectors-persistent-aes-256", - "encryption-algorithm": "aes" - }, - "decryptKeyDescription": { - "type": "raw", - "key": "aes-256", - "provider-id": "aws-raw-vectors-persistent-aes-256", - "encryption-algorithm": "aes" - }, - "encryption-context": {}, - "reproduced-encryption-context": {} - } - } + "giant-raw-aes-256-tiny-frame": { + "encryption-scenario": { + "type": "positive-esdk", + "plaintext": "large", + "description": "Generated RawAES aes-256", + "algorithmSuiteId": "0078", + "frame-size": 4, + "encryptKeyDescription": { + "type": "raw", + "key": "aes-256", + "provider-id": "aws-raw-vectors-persistent-aes-256", + "encryption-algorithm": "aes" + }, + "decryptKeyDescription": { + "type": "raw", + "key": "aes-256", + "provider-id": "aws-raw-vectors-persistent-aes-256", + "encryption-algorithm": "aes" + }, + "encryption-context": {}, + "reproduced-encryption-context": {} + } } + } } \ No newline at end of file diff --git a/TestVectors/dafny/TestVectors/test/thousand-encrypt-manifest.json b/TestVectors/dafny/TestVectors/test/thousand-encrypt-manifest.json index a88738ab0..d1446c9d0 100644 --- a/TestVectors/dafny/TestVectors/test/thousand-encrypt-manifest.json +++ b/TestVectors/dafny/TestVectors/test/thousand-encrypt-manifest.json @@ -35,6 +35,33 @@ "reproduced-encryption-context": {} } }, + "small-rsa-4096": { + "encryption-scenario": { + "type": "positive-esdk", + "plaintext": "small", + "description": "Generated RawRSA rsa-4096", + "algorithmSuiteId": "0146", + "frame-size": 512, + "encryptKeyDescription": { + "type": "raw", + "key": "rsa-4096-public", + "provider-id": "aws-raw-vectors-persistent-rsa-4096", + "encryption-algorithm": "rsa", + "padding-algorithm": "oaep-mgf1", + "padding-hash": "sha512" + }, + "decryptKeyDescription": { + "type": "raw", + "key": "rsa-4096-private", + "provider-id": "aws-raw-vectors-persistent-rsa-4096", + "encryption-algorithm": "rsa", + "padding-algorithm": "oaep-mgf1", + "padding-hash": "sha512" + }, + "encryption-context": {}, + "reproduced-encryption-context": {} + } + }, "small-aws-kms-hierarchy": { "encryption-scenario": { "type": "positive-esdk", @@ -84,4 +111,4 @@ } } } -} +} \ No newline at end of file diff --git a/TestVectors/runtimes/java/src/main/smithy-generated/software/amazon/cryptography/encryptionsdk/wrapped/KeyringToMasterKeyProvider.java b/TestVectors/runtimes/java/src/main/smithy-generated/software/amazon/cryptography/encryptionsdk/wrapped/KeyringToMasterKeyProvider.java index 3d3c63f73..2075ebdaa 100644 --- a/TestVectors/runtimes/java/src/main/smithy-generated/software/amazon/cryptography/encryptionsdk/wrapped/KeyringToMasterKeyProvider.java +++ b/TestVectors/runtimes/java/src/main/smithy-generated/software/amazon/cryptography/encryptionsdk/wrapped/KeyringToMasterKeyProvider.java @@ -137,10 +137,12 @@ public static MasterKeyProvider createMasterKeyProvider(IKeyring keyring) { wrappingKey = getPublicKeyFromPEM(ByteBuffer(rsaKeyring.publicKey().dtor_value())); } - if (rsaKeyring.privateKey().is_Some()) { + if (rsaKeyring.privateKeyMaterial().is_Some()) { unwrappingKey = - getPrivateKeyFromPEM( - ByteBuffer(rsaKeyring.privateKey().dtor_value()) + getPrivateKeyFromBytes( + ByteBuffer( + rsaKeyring.privateKeyMaterial().dtor_value().privateKey() + ) ); } String rsaWrappingAlg = getRsaWrappingAlg(rsaKeyring.paddingScheme()); @@ -247,6 +249,16 @@ public static PrivateKey getPrivateKeyFromPEM(ByteBuffer pemBuffer) { } } + public static PrivateKey getPrivateKeyFromBytes(ByteBuffer pkcs8Key) { + try { + KeyFactory keyFactory = KeyFactory.getInstance("RSA"); // or appropriate algorithm + PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(pkcs8Key.array()); + return keyFactory.generatePrivate(keySpec); + } catch (NoSuchAlgorithmException | InvalidKeySpecException e) { + throw new RuntimeException("Error generating private key from PEM", e); + } + } + private static byte[] parsePem(String pem) { final String stripped = pem.replaceAll("-+[A-Z ]+-+", ""); return Base64.decode(stripped); diff --git a/TestVectors/runtimes/python/src/aws_encryption_sdk_test_vectors/internaldafny/extern/wrapped_esdk.py b/TestVectors/runtimes/python/src/aws_encryption_sdk_test_vectors/internaldafny/extern/wrapped_esdk.py index d9240b889..5bc54143e 100644 --- a/TestVectors/runtimes/python/src/aws_encryption_sdk_test_vectors/internaldafny/extern/wrapped_esdk.py +++ b/TestVectors/runtimes/python/src/aws_encryption_sdk_test_vectors/internaldafny/extern/wrapped_esdk.py @@ -70,7 +70,6 @@ def Encrypt(self, dafny_encrypt_input): mkp_flag = False if "MASTERKEY" in sys.argv: mkp_flag = True - print("mkp_flag:", mkp_flag) mkp = None if native_encrypt_input.keyring is not None: if mkp_flag: @@ -127,7 +126,6 @@ def Decrypt(self, dafny_decrypt_input): mkp_flag = False if "MASTERKEY" in sys.argv: mkp_flag = True - print("mkp_flag:", mkp_flag) native_esdk_input = {} mkp = None if native_decrypt_input.keyring is not None: diff --git a/mpl b/mpl index 515995e68..f318912eb 160000 --- a/mpl +++ b/mpl @@ -1 +1 @@ -Subproject commit 515995e68400e56fc720412fe355e6965715136e +Subproject commit f318912eb419140c8e1cb4694b9bf69c3e239967 From 639d9d54f7263cea82c12c39634b70a2a016f6ad Mon Sep 17 00:00:00 2001 From: Andy Jewell Date: Thu, 17 Apr 2025 12:30:11 -0400 Subject: [PATCH 2/2] m --- .../wrapped/KeyringToMasterKeyProvider.java | 18 +++--------------- mpl | 2 +- 2 files changed, 4 insertions(+), 16 deletions(-) diff --git a/TestVectors/runtimes/java/src/main/smithy-generated/software/amazon/cryptography/encryptionsdk/wrapped/KeyringToMasterKeyProvider.java b/TestVectors/runtimes/java/src/main/smithy-generated/software/amazon/cryptography/encryptionsdk/wrapped/KeyringToMasterKeyProvider.java index 2075ebdaa..3d3c63f73 100644 --- a/TestVectors/runtimes/java/src/main/smithy-generated/software/amazon/cryptography/encryptionsdk/wrapped/KeyringToMasterKeyProvider.java +++ b/TestVectors/runtimes/java/src/main/smithy-generated/software/amazon/cryptography/encryptionsdk/wrapped/KeyringToMasterKeyProvider.java @@ -137,12 +137,10 @@ public static MasterKeyProvider createMasterKeyProvider(IKeyring keyring) { wrappingKey = getPublicKeyFromPEM(ByteBuffer(rsaKeyring.publicKey().dtor_value())); } - if (rsaKeyring.privateKeyMaterial().is_Some()) { + if (rsaKeyring.privateKey().is_Some()) { unwrappingKey = - getPrivateKeyFromBytes( - ByteBuffer( - rsaKeyring.privateKeyMaterial().dtor_value().privateKey() - ) + getPrivateKeyFromPEM( + ByteBuffer(rsaKeyring.privateKey().dtor_value()) ); } String rsaWrappingAlg = getRsaWrappingAlg(rsaKeyring.paddingScheme()); @@ -249,16 +247,6 @@ public static PrivateKey getPrivateKeyFromPEM(ByteBuffer pemBuffer) { } } - public static PrivateKey getPrivateKeyFromBytes(ByteBuffer pkcs8Key) { - try { - KeyFactory keyFactory = KeyFactory.getInstance("RSA"); // or appropriate algorithm - PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(pkcs8Key.array()); - return keyFactory.generatePrivate(keySpec); - } catch (NoSuchAlgorithmException | InvalidKeySpecException e) { - throw new RuntimeException("Error generating private key from PEM", e); - } - } - private static byte[] parsePem(String pem) { final String stripped = pem.replaceAll("-+[A-Z ]+-+", ""); return Base64.decode(stripped); diff --git a/mpl b/mpl index f318912eb..1c293223e 160000 --- a/mpl +++ b/mpl @@ -1 +1 @@ -Subproject commit f318912eb419140c8e1cb4694b9bf69c3e239967 +Subproject commit 1c293223efb2bc9643a45e482daf37a87eeae197