Add nonce to wrap_key and unwrap_key syscalls #148
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Comment on lines
19
to
21
| ) -> ClientResult<'_, reply::WrapKey, Self> { | ||
| self.wrap_key(Mechanism::Aes256Cbc, wrapping_key, key, &[]) | ||
| self.wrap_key(Mechanism::Aes256Cbc, wrapping_key, key, &[], None) | ||
| } |
There was a problem hiding this comment.
Why use None here but add it to client::wrap_key_chacha8poly1305 ?
There was a problem hiding this comment.
Because currently it does not have any effect for Aes256Cbc. I would implement that in a separate PR that then also updates the shortcut functions.
There was a problem hiding this comment.
I would put both in the same PR.
This patch adds a nonce argument to the wrap_key and unwrap_key syscalls to be able to use the Aes256Cbc mechanism with a non-zero IV in the future.
robin-nitrokey
force-pushed
the
wrap-key-nonce
branch
from
e373ba1
to
a5d89fa
Compare
daringer
approved these changes
Mar 1, 2024
robin-nitrokey
force-pushed
the
wrap-key-nonce
branch
from
a5d89fa
to
6a02eeb
Compare
sosthene-nitrokey
approved these changes
Mar 1, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This patch adds a nonce argument to the wrap_key and unwrap_key syscalls to be able to use the Aes256Cbc mechanism with a non-zero IV in the future.
I’m not sure if it really makes sense to add the nonce to
unwrap_keytoo. For Aes256Cbc it would be useful, but it currently does not implementunwrap_keyanyway. For ChaCha8Poly1305, the encryption result including the nonce is serialized so it does not need to be passed manually by the caller.