Skip to content

feat(kas): Add nano policy binding to rewrap audit. #2870

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Nov 4, 2025
Merged

feat(kas): Add nano policy binding to rewrap audit. #2870

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
fb0a3b6
feat(kas): Add nano policy binding to rewrap audit.
c-r33d Nov 3, 2025
3059c36
bump sdk version.
c-r33d Nov 4, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion service/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ require (
github.com/opentdf/platform/lib/identifier v0.2.0
github.com/opentdf/platform/lib/ocrypto v0.7.0
github.com/opentdf/platform/protocol/go v0.13.0
github.com/opentdf/platform/sdk v0.10.0
github.com/opentdf/platform/sdk v0.10.1
github.com/pressly/goose/v3 v3.24.3
github.com/spf13/cobra v1.9.1
github.com/spf13/viper v1.20.1
Expand Down
4 changes: 2 additions & 2 deletions service/go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -257,8 +257,8 @@ github.com/opentdf/platform/lib/ocrypto v0.7.0 h1:uBZJXisuXU3V8681aP8FVMJkyWBrwW
github.com/opentdf/platform/lib/ocrypto v0.7.0/go.mod h1:sYhoBL1bQYgQVSSNpxU13RsrE5JAk8BABT1hfr9L3j8=
github.com/opentdf/platform/protocol/go v0.13.0 h1:vrOOHyhYDPzJgNenz/1g0M5nWtkOYKkPggMNHKzeMcs=
github.com/opentdf/platform/protocol/go v0.13.0/go.mod h1:GRycoDGDxaz91sOvGZFWVEKJLluZFg2wM3NJmhucDHo=
github.com/opentdf/platform/sdk v0.10.0 h1:OU0pdAnEkcpvLHKZQsynkJJ4lOnVPIBP13W2+9jR80Y=
github.com/opentdf/platform/sdk v0.10.0/go.mod h1:EIh7cTBrtKfjav+5WXA1PZQYjI+fJtTeSXl6Ibw79Bw=
github.com/opentdf/platform/sdk v0.10.1 h1:kBrTK48xle7mdGc+atlr4kDh94f6kVj+0OB76K8rozI=
github.com/opentdf/platform/sdk v0.10.1/go.mod h1:+yaTi/c/GWHZPPmO27sq2s7Tcb2P/USkK8LuW1krhI8=
github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+1B0VhjKrZUs=
github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc=
github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
Expand Down
33 changes: 21 additions & 12 deletions service/kas/access/rewrap.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,8 +84,9 @@ type kaoResult struct {
EphemeralPublicKey []byte
RequiredObligations []string

// Only populated for Nano auditing, since policy is encrypted
KeyID string
// Only populated for Nano auditing
KeyID string
PolicyBinding string
}

// From policy ID to KAO ID to result
Expand Down Expand Up @@ -901,11 +902,12 @@ func (p *Provider) nanoTDFRewrap(ctx context.Context, requests []*kaspb.Unsigned
}

auditEventParams := audit.RewrapAuditEventParams{
Policy: kasPolicy,
IsSuccess: access,
TDFFormat: "Nano",
Algorithm: req.GetAlgorithm(),
KeyID: kaoInfo.KeyID,
Policy: kasPolicy,
IsSuccess: access,
TDFFormat: "Nano",
Algorithm: req.GetAlgorithm(),
KeyID: kaoInfo.KeyID,
PolicyBinding: kaoInfo.PolicyBinding,
}

if !access {
Expand Down Expand Up @@ -986,9 +988,15 @@ func (p *Provider) verifyNanoRewrapRequests(ctx context.Context, req *kaspb.Unsi
}

// check the policy binding
verify, err := header.VerifyPolicyBinding()
binding, err := header.PolicyBinding()
if err != nil {
failedKAORewrap(results, kao, fmt.Errorf("failed to retrieve policy binding: %w", err))
return nil, results
}

verify, err := binding.Verify()
if err != nil {
failedKAORewrap(results, kao, fmt.Errorf("failed to verify policy binding: %w", err))
failedKAORewrap(results, kao, fmt.Errorf("error verifying policy binding: %w", err))
return nil, results
}

Expand All @@ -997,9 +1005,10 @@ func (p *Provider) verifyNanoRewrapRequests(ctx context.Context, req *kaspb.Unsi
return nil, results
}
results[kao.GetKeyAccessObjectId()] = kaoResult{
ID: kao.GetKeyAccessObjectId(),
DEK: symmetricKey,
KeyID: kid,
ID: kao.GetKeyAccessObjectId(),
DEK: symmetricKey,
KeyID: kid,
PolicyBinding: binding.String(),
}
return policy, results
}
Expand Down
Loading