fix: ECC key loading (deprecated)

[pflynn-virtru]

Proposed Changes

This pull request updates the deprecated key loading logic in the service/internal/security/standard_crypto.go file to ensure the correct cryptographic algorithm is set for ECC keys. The main change is a fix to the algorithm identifier used when loading ECC keys.

Key management fix:

• In the loadDeprecatedKeys function, the Algorithm field for ECC keys is now correctly set to AlgorithmECP256R1 instead of the incorrect AlgorithmRSA2048, ensuring proper identification and handling of ECC keys.

Checklist

• I have added or updated unit tests
• I have added or updated integration tests (if appropriate)
• I have added or updated documentation

Testing Instructions

[gemini-code-assist]

Summary of Changes

Hello @pflynn-virtru, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses a critical issue in the key loading logic by updating a deprecated function to correctly identify Elliptic Curve Cryptography (ECC) keys. The change ensures that the appropriate algorithm identifier is set for ECC keys, which is crucial for their proper functioning and security, thereby preventing potential cryptographic misconfigurations.

Highlights

• ECC Key Loading Fix: Corrected a bug in the loadDeprecatedKeys function where ECC keys were incorrectly assigned the AlgorithmRSA2048 identifier. This has been updated to the proper AlgorithmECP256R1.
• Improved Key Identification: Ensures that Elliptic Curve Cryptography (ECC) keys are now correctly identified and handled, preventing potential misconfigurations or failures related to their cryptographic algorithm.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

---

Wrong algorithm, ECC keys now load right, Security shines bright.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request correctly fixes a critical bug in the deprecated key loading logic where ECC keys were being assigned an incorrect RSA algorithm identifier. The change to use AlgorithmECP256R1 is appropriate. To improve the robustness of the code and prevent future regressions, I've suggested adding a unit test to cover this deprecated key loading path.

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	173.866933ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	100.40197ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	465.148459ms
Throughput	214.99 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	36.71582807s
Average Latency	366.034188ms
Throughput	136.18 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	24.987885969s
Average Latency	248.6091ms
Throughput	200.10 requests/second