feat(kas): support HSM and standard crypto

.github/scripts/hsm-init-temporary-keys.sh

@@ -4,15 +4,15 @@
 
 set -ex
 
-: "${OPENTDF_SERVER_HSM_PIN:=12345}"
-: "${OPENTDF_SERVER_HSM_KEYS_EC_LABEL:=development-ec-kas}"
-: "${OPENTDF_SERVER_HSM_KEYS_RSA_LABEL:=development-rsa-kas}"
+: "${OPENTDF_SERVER_CRYPTOPROVIDER_HSM_PIN:=12345}"
+: "${OPENTDF_SERVER_CRYPTOPROVIDER_HSM_KEYS_EC_LABEL:=development-ec-kas}"
+: "${OPENTDF_SERVER_CRYPTOPROVIDER_HSM_KEYS_RSA_LABEL:=development-rsa-kas}"
 
-if [ -z "${OPENTDF_SERVER_HSM_MODULEPATH}" ]; then
+if [ -z "${OPENTDF_SERVER_CRYPTOPROVIDER_HSM_MODULEPATH}" ]; then
   if which brew; then
-    OPENTDF_SERVER_HSM_MODULEPATH=$(brew --prefix)/lib/softhsm/libsofthsm2.so
+    OPENTDF_SERVER_CRYPTOPROVIDER_HSM_MODULEPATH=$(brew --prefix)/lib/softhsm/libsofthsm2.so
   else
-    OPENTDF_SERVER_HSM_MODULEPATH=/lib/softhsm/libsofthsm2.so
+    OPENTDF_SERVER_CRYPTOPROVIDER_HSM_MODULEPATH=/lib/softhsm/libsofthsm2.so
   fi
 fi
 
@@ -21,13 +21,13 @@ if softhsm2-util --show-slots | grep dev-token; then
   exit 0
 fi
 
-softhsm2-util --init-token --free --label "dev-token" --pin "${OPENTDF_SERVER_HSM_PIN}" --so-pin "${OPENTDF_SERVER_HSM_PIN}"
-pkcs11-tool --module "${OPENTDF_SERVER_HSM_MODULEPATH}" --login --show-info --list-objects --pin "${OPENTDF_SERVER_HSM_PIN}"
+softhsm2-util --init-token --free --label "dev-token" --pin "${OPENTDF_SERVER_CRYPTOPROVIDER_HSM_PIN}" --so-pin "${OPENTDF_SERVER_CRYPTOPROVIDER_HSM_PIN}"
+pkcs11-tool --module "${OPENTDF_SERVER_CRYPTOPROVIDER_HSM_MODULEPATH}" --login --show-info --list-objects --pin "${OPENTDF_SERVER_CRYPTOPROVIDER_HSM_PIN}"
 openssl req -x509 -nodes -newkey RSA:2048 -subj "/CN=kas" -keyout kas-private.pem -out kas-cert.pem -days 365
 openssl ecparam -name prime256v1 >ecparams.tmp
 openssl req -x509 -nodes -newkey ec:ecparams.tmp -subj "/CN=kas" -keyout kas-ec-private.pem -out kas-ec-cert.pem -days 365
-pkcs11-tool --module "${OPENTDF_SERVER_HSM_MODULEPATH}" --login --pin "${OPENTDF_SERVER_HSM_PIN}" --write-object kas-private.pem --type privkey --label "${OPENTDF_SERVER_HSM_KEYS_RSA_LABEL}"
-pkcs11-tool --module "${OPENTDF_SERVER_HSM_MODULEPATH}" --login --pin "${OPENTDF_SERVER_HSM_PIN}" --write-object kas-cert.pem --type cert --label "${OPENTDF_SERVER_HSM_KEYS_RSA_LABEL}"
+pkcs11-tool --module "${OPENTDF_SERVER_CRYPTOPROVIDER_HSM_MODULEPATH}" --login --pin "${OPENTDF_SERVER_CRYPTOPROVIDER_HSM_PIN}" --write-object kas-private.pem --type privkey --label "${OPENTDF_SERVER_CRYPTOPROVIDER_HSM_KEYS_RSA_LABEL}"
+pkcs11-tool --module "${OPENTDF_SERVER_CRYPTOPROVIDER_HSM_MODULEPATH}" --login --pin "${OPENTDF_SERVER_CRYPTOPROVIDER_HSM_PIN}" --write-object kas-cert.pem --type cert --label "${OPENTDF_SERVER_CRYPTOPROVIDER_HSM_KEYS_RSA_LABEL}"
 # https://manpages.ubuntu.com/manpages/jammy/man1/pkcs11-tool.1.html --usage-derive
-pkcs11-tool --module "${OPENTDF_SERVER_HSM_MODULEPATH}" --login --pin "${OPENTDF_SERVER_HSM_PIN}" --write-object kas-ec-private.pem --type privkey --label "${OPENTDF_SERVER_HSM_KEYS_EC_LABEL}" --usage-derive
-pkcs11-tool --module "${OPENTDF_SERVER_HSM_MODULEPATH}" --login --pin "${OPENTDF_SERVER_HSM_PIN}" --write-object kas-ec-cert.pem --type cert --label "${OPENTDF_SERVER_HSM_KEYS_EC_LABEL}"
+pkcs11-tool --module "${OPENTDF_SERVER_CRYPTOPROVIDER_HSM_MODULEPATH}" --login --pin "${OPENTDF_SERVER_CRYPTOPROVIDER_HSM_PIN}" --write-object kas-ec-private.pem --type privkey --label "${OPENTDF_SERVER_CRYPTOPROVIDER_HSM_KEYS_EC_LABEL}" --usage-derive
+pkcs11-tool --module "${OPENTDF_SERVER_CRYPTOPROVIDER_HSM_MODULEPATH}" --login --pin "${OPENTDF_SERVER_CRYPTOPROVIDER_HSM_PIN}" --write-object kas-ec-cert.pem --type cert --label "${OPENTDF_SERVER_CRYPTOPROVIDER_HSM_KEYS_EC_LABEL}"

.github/workflows/checks.yaml

@@ -37,7 +37,7 @@ jobs:
           - examples
           - sdk
           - service
-          - lib/crypto
+          - lib/ocrypto
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491
@@ -70,6 +70,8 @@ jobs:
           echo "directories.tokendir = $(pwd)/.tmp/tokens" > softhsm2.conf
           echo "log.level = DEBUG" >> softhsm2.conf
           echo "SOFTHSM2_CONF=$(pwd)/softhsm2.conf" >> "$GITHUB_ENV"
+      - if: matrix.directory == 'service'
+        run: .github/scripts/hsm-init-temporary-keys.sh
       - run: go test ./... -short
         working-directory: ${{ matrix.directory }}
 
@@ -99,7 +101,6 @@ jobs:
           echo "directories.tokendir = $(pwd)/.tmp/tokens" > softhsm2.conf
           echo "log.level = DEBUG" >> softhsm2.conf
           echo "SOFTHSM2_CONF=$(pwd)/softhsm2.conf" >> "$GITHUB_ENV"
-          echo "OPENTDF_SERVER_HSM_PIN=$(openssl rand -hex 4)" >> "$GITHUB_ENV"
       - run: .github/scripts/hsm-init-temporary-keys.sh
       - run: docker compose up -d --wait --wait-timeout 240
       - run: cp opentdf-example.yaml opentdf.yaml

.github/workflows/lint-all.yaml

@@ -14,19 +14,19 @@ jobs:
     strategy:
       matrix:
         directory:
-          - "."
           - sdk
-          - lib/crypto
+          - lib/ocrypto
+          - service
           - examples
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491
         with:
           go-version: "1.21"
           cache-dependency-path: |
-            ./go.sum
             sdk/go.sum
             examples/go.sum
+            service/go.sum
       - run: make go.work
       - name: golangci-lint
         # uses: golangci/golangci-lint-action@3a919529898de77ec3da873e3063ca4b10e7f5cc

Dockerfile

@@ -4,7 +4,7 @@ WORKDIR /app
 # dependencies, add local,dependant package here
 COPY protocol/ protocol/
 COPY sdk/ sdk/
-COPY lib/crypto lib/crypto
+COPY lib/ocrypto lib/ocrypto
 COPY service/ service/
 COPY examples/ examples/
 COPY Makefile ./

Makefile

@@ -3,8 +3,8 @@
 
 .PHONY: all build clean docker-build fix go-lint lint proto-generate proto-lint sdk/sdk test toolcheck
 
-MODS=protocol/go lib/crypto sdk service examples
-HAND_MODS=lib/crypto sdk service examples
+MODS=protocol/go lib/ocrypto sdk service examples
+HAND_MODS=lib/ocrypto sdk service examples
 
 EXCLUDE_OPENAPI=./service/authorization/idp_plugin.proto
 

README.md

@@ -86,26 +86,26 @@ For development, we use [the SoftHSM library](https://www.softhsm.org/),
 which presents a `PKCS #11` interface to on CPU cryptography libraries.
 
 ```
-export OPENTDF_SERVER_HSM_PIN=12345
-export OPENTDF_SERVER_HSM_MODULEPATH=/lib/softhsm/libsofthsm2.so
-export OPENTDF_SERVER_HSM_KEYS_EC_LABEL=kas-ec
-export OPENTDF_SERVER_HSM_KEYS_RSA_LABEL=kas-rsa
+export OPENTDF_SERVER_CRYPTOPROVIDER_HSM_PIN=12345
+export OPENTDF_SERVER_CRYPTOPROVIDER_HSM_MODULEPATH=/lib/softhsm/libsofthsm2.so
+export OPENTDF_SERVER_CRYPTOPROVIDER_HSM_KEYS_EC_LABEL=kas-ec
+export OPENTDF_SERVER_CRYPTOPROVIDER_HSM_KEYS_RSA_LABEL=kas-rsa
 
-pkcs11-tool --module $OPENTDF_SERVER_HSM_MODULEPATH \
-            --login --pin ${OPENTDF_SERVER_HSM_PIN} \
+pkcs11-tool --module $OPENTDF_SERVER_CRYPTOPROVIDER_HSM_MODULEPATH \
+            --login --pin ${OPENTDF_SERVER_CRYPTOPROVIDER_HSM_PIN} \
             --write-object kas-private.pem --type privkey \
             --label kas-rsa
-pkcs11-tool --module $OPENTDF_SERVER_HSM_MODULEPATH \
-            --login --pin ${OPENTDF_SERVER_HSM_PIN} \
+pkcs11-tool --module $OPENTDF_SERVER_CRYPTOPROVIDER_HSM_MODULEPATH \
+            --login --pin ${OPENTDF_SERVER_CRYPTOPROVIDER_HSM_PIN} \
             --write-object kas-cert.pem --type cert \
             --label kas-rsa
 
-pkcs11-tool --module $OPENTDF_SERVER_HSM_MODULEPATH \
-            --login --pin ${OPENTDF_SERVER_HSM_PIN} \
+pkcs11-tool --module $OPENTDF_SERVER_CRYPTOPROVIDER_HSM_MODULEPATH \
+            --login --pin ${OPENTDF_SERVER_CRYPTOPROVIDER_HSM_PIN} \
             --write-object ec-private.pem --type privkey \
             --label kas-ec
-pkcs11-tool --module $OPENTDF_SERVER_HSM_MODULEPATH \
-            --login --pin ${OPENTDF_SERVER_HSM_PIN} \
+pkcs11-tool --module $OPENTDF_SERVER_CRYPTOPROVIDER_HSM_MODULEPATH \
+            --login --pin ${OPENTDF_SERVER_CRYPTOPROVIDER_HSM_PIN} \
             --write-object ec-cert.pem --type cert \
             --label kas-ec
 ```

examples/go.mod

@@ -11,7 +11,7 @@ require (
 )
 
 replace (
-	github.com/opentdf/platform/lib/crypto => ../lib/crypto
+	github.com/opentdf/platform/lib/ocrypto => ../lib/ocrypto
 	github.com/opentdf/platform/protocol/go => ../protocol/go
 	github.com/opentdf/platform/sdk => ../sdk
 )
@@ -32,7 +32,7 @@ require (
 	github.com/lestrrat-go/iter v1.0.2 // indirect
 	github.com/lestrrat-go/jwx/v2 v2.0.21 // indirect
 	github.com/lestrrat-go/option v1.0.1 // indirect
-	github.com/opentdf/platform/lib/crypto v0.0.0-00010101000000-000000000000 // indirect
+	github.com/opentdf/platform/lib/ocrypto v0.0.0-00010101000000-000000000000 // indirect
 	github.com/rogpeppe/go-internal v1.12.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/segmentio/asm v1.2.0 // indirect

lib/crypto/aes_gcm.go → lib/ocrypto/aes_gcm.go

@@ -1,4 +1,4 @@
-package crypto
+package ocrypto
 
 import (
 	"crypto/aes"

lib/crypto/aes_gcm_test.go → lib/ocrypto/aes_gcm_test.go

@@ -1,4 +1,4 @@
-package crypto
+package ocrypto
 
 import (
 	"encoding/hex"

lib/crypto/asym_decryption.go → lib/ocrypto/asym_decryption.go

@@ -1,4 +1,4 @@
-package crypto
+package ocrypto
 
 import (
 	"crypto"
@@ -10,7 +10,7 @@ import (
 )
 
 type AsymDecryption struct {
-	privateKey *rsa.PrivateKey
+	PrivateKey *rsa.PrivateKey
 }
 
 // NewAsymDecryption creates and returns a new AsymDecryption.
@@ -37,11 +37,11 @@ func NewAsymDecryption(privateKeyInPem string) (AsymDecryption, error) {
 
 // Decrypt decrypts ciphertext with private key.
 func (asymDecryption AsymDecryption) Decrypt(data []byte) ([]byte, error) {
-	if asymDecryption.privateKey == nil {
+	if asymDecryption.PrivateKey == nil {
 		return nil, errors.New("failed to decrypt, private key is empty")
 	}
 
-	bytes, err := asymDecryption.privateKey.Decrypt(nil,
+	bytes, err := asymDecryption.PrivateKey.Decrypt(nil,
 		data,
 		&rsa.OAEPOptions{Hash: crypto.SHA1})
 	if err != nil {

lib/crypto/asym_encrypt_decrypt_test.go → lib/ocrypto/asym_encrypt_decrypt_test.go

@@ -1,4 +1,4 @@
-package crypto
+package ocrypto
 
 import (
 	"testing"

lib/crypto/asym_encryption.go → lib/ocrypto/asym_encryption.go

@@ -1,4 +1,4 @@
-package crypto
+package ocrypto
 
 import (
 	"crypto/rand"
@@ -12,7 +12,7 @@ import (
 )
 
 type AsymEncryption struct {
-	publicKey *rsa.PublicKey
+	PublicKey *rsa.PublicKey
 }
 
 // NewAsymEncryption creates and returns a new AsymEncryption.
@@ -53,14 +53,35 @@ func NewAsymEncryption(publicKeyInPem string) (AsymEncryption, error) {
 
 // Encrypt encrypts data with public key.
 func (asymEncryption AsymEncryption) Encrypt(data []byte) ([]byte, error) {
-	if asymEncryption.publicKey == nil {
+	if asymEncryption.PublicKey == nil {
 		return nil, errors.New("failed to encrypt, public key is empty")
 	}
 
-	bytes, err := rsa.EncryptOAEP(sha1.New(), rand.Reader, asymEncryption.publicKey, data, nil) //nolint:gosec // used for padding which is safe
+	bytes, err := rsa.EncryptOAEP(sha1.New(), rand.Reader, asymEncryption.PublicKey, data, nil) //nolint:gosec // used for padding which is safe
 	if err != nil {
 		return nil, fmt.Errorf("rsa.EncryptOAEP failed: %w", err)
 	}
 
 	return bytes, nil
 }
+
+// PublicKeyInPemFormat Returns public key in pem format.
+func (asymEncryption AsymEncryption) PublicKeyInPemFormat() (string, error) {
+	if asymEncryption.PublicKey == nil {
+		return "", errors.New("failed to generate PEM formatted public key")
+	}
+
+	publicKeyBytes, err := x509.MarshalPKIXPublicKey(asymEncryption.PublicKey)
+	if err != nil {
+		return "", fmt.Errorf("x509.MarshalPKIXPublicKey failed: %w", err)
+	}
+
+	publicKeyPem := pem.EncodeToMemory(
+		&pem.Block{
+			Type:  "PUBLIC KEY",
+			Bytes: publicKeyBytes,
+		},
+	)
+
+	return string(publicKeyPem), nil
+}

lib/crypto/crypto_utils.go → lib/ocrypto/crypto_utils.go

@@ -1,4 +1,4 @@
-package crypto
+package ocrypto
 
 import (
 	"crypto/hmac"

lib/crypto/crypto_utils_test.go → lib/ocrypto/crypto_utils_test.go

@@ -1,4 +1,4 @@
-package crypto
+package ocrypto
 
 import (
 	"testing"

lib/ocrypto/go.mod

@@ -0,0 +1,3 @@
+module github.com/opentdf/platform/lib/ocrypto
+
+go 1.21.8

lib/crypto/rsa_key_pair.go → lib/ocrypto/rsa_key_pair.go

@@ -1,4 +1,4 @@
-package crypto
+package ocrypto
 
 import (
 	"crypto/rand"

lib/crypto/rsa_key_pair_test.go → lib/ocrypto/rsa_key_pair_test.go

@@ -1,4 +1,4 @@
-package crypto
+package ocrypto
 
 import (
 	"testing"

opentdf-example.yaml

@@ -67,16 +67,29 @@ server:
 
   grpc:
     reflectionEnabled: true # Default is false
-  hsm:
-    enabled: true
-    # As configured by hsm-init-temporary-keys.sh
-    pin: "12345"
-    slotlabel: "dev-token"
-    keys:
+  cryptoProvider:
+    hsm:
+      enabled: false
+      # As configured by hsm-init-temporary-keys.sh
+      pin: "12345"
+      slotlabel: "dev-token"
+      keys:
+        rsa:
+          label: development-rsa-kas
+        ec:
+          label: development-ec-kas
+    standard:
       rsa:
-        label: development-rsa-kas
+        123:
+          privateKeyPath: kas-private.pem
+          publicKeyPath: kas-cert.pem
+        456:
+          privateKeyPath: kas-private.pem
+          publicKeyPath: kas-cert.pem
       ec:
-        label: development-ec-kas
+        123:
+          privateKeyPath: kas-ec-private.pem
+          publicKeyPath: kas-ec-cert.pem
   port: 8080
 opa:
   embedded: true # Only for local development