[Pm-13097] Rename cryptoservice to keyservice and move it to km ownership (#11358)

* Rename cryptoservice to keyservice * Rename cryptoservice to keyservice * Move key service to key management ownership * Remove accidentally added file * Fix cli build * Fix browser build * Run prettier * Fix builds * Fix cli build * Fix tests * Fix incorrect renames * Rename webauthn-login-crypto-service * Fix build errors due to merge conflicts * Fix linting
2025-12-11 05:43:41 +00:00 · 2024-10-24 19:41:30 +02:00
parent 554171b688
commit b486fcc689
229 changed files with 1385 additions and 1446 deletions
--- a/libs/angular/src/auth/components/base-login-decryption-options.component.ts
+++ b/libs/angular/src/auth/components/base-login-decryption-options.component.ts
@@ -32,7 +32,6 @@ import { PasswordResetEnrollmentServiceAbstraction } from "@bitwarden/common/aut
 import { SsoLoginServiceAbstraction } from "@bitwarden/common/auth/abstractions/sso-login.service.abstraction";
 import { TokenService } from "@bitwarden/common/auth/abstractions/token.service";
 import { KeysRequest } from "@bitwarden/common/models/request/keys.request";
-import { CryptoService } from "@bitwarden/common/platform/abstractions/crypto.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { MessagingService } from "@bitwarden/common/platform/abstractions/messaging.service";
 import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
@@ -40,6 +39,7 @@ import { StateService } from "@bitwarden/common/platform/abstractions/state.serv
 import { ValidationService } from "@bitwarden/common/platform/abstractions/validation.service";
 import { UserId } from "@bitwarden/common/types/guid";
 import { ToastService } from "@bitwarden/components";
+import { KeyService } from "@bitwarden/key-management";

 enum State {
  NewUser,
@@ -94,7 +94,7 @@ export class BaseLoginDecryptionOptionsComponent implements OnInit, OnDestroy {
    protected tokenService: TokenService,
    protected loginEmailService: LoginEmailServiceAbstraction,
    protected organizationApiService: OrganizationApiServiceAbstraction,
-    protected cryptoService: CryptoService,
+    protected keyService: KeyService,
    protected organizationUserApiService: OrganizationUserApiService,
    protected apiService: ApiService,
    protected i18nService: I18nService,
@@ -273,7 +273,7 @@ export class BaseLoginDecryptionOptionsComponent implements OnInit, OnDestroy {
    this.loading = true;
    // errors must be caught in child components to prevent navigation
    try {
-      const { publicKey, privateKey } = await this.cryptoService.initAccount();
+      const { publicKey, privateKey } = await this.keyService.initAccount();
      const keysRequest = new KeysRequest(publicKey, privateKey.encryptedString);
      await this.apiService.postAccountKeys(keysRequest);

--- a/libs/angular/src/auth/components/change-password.component.ts
+++ b/libs/angular/src/auth/components/change-password.component.ts
@@ -7,7 +7,6 @@ import { AccountService } from "@bitwarden/common/auth/abstractions/account.serv
 import { KdfConfigService } from "@bitwarden/common/auth/abstractions/kdf-config.service";
 import { InternalMasterPasswordServiceAbstraction } from "@bitwarden/common/auth/abstractions/master-password.service.abstraction";
 import { KdfConfig } from "@bitwarden/common/auth/models/domain/kdf-config";
-import { CryptoService } from "@bitwarden/common/platform/abstractions/crypto.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { MessagingService } from "@bitwarden/common/platform/abstractions/messaging.service";
 import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
@@ -17,6 +16,7 @@ import { EncString } from "@bitwarden/common/platform/models/domain/enc-string";
 import { UserKey, MasterKey } from "@bitwarden/common/types/key";
 import { DialogService, ToastService } from "@bitwarden/components";
 import { PasswordGenerationServiceAbstraction } from "@bitwarden/generator-legacy";
+import { KeyService } from "@bitwarden/key-management";

 import { PasswordColorText } from "../../tools/password-strength/password-strength.component";

@@ -39,7 +39,7 @@ export class ChangePasswordComponent implements OnInit, OnDestroy {

  constructor(
    protected i18nService: I18nService,
-    protected cryptoService: CryptoService,
+    protected keyService: KeyService,
    protected messagingService: MessagingService,
    protected passwordGenerationService: PasswordGenerationServiceAbstraction,
    protected platformUtilsService: PlatformUtilsService,
@@ -91,22 +91,19 @@ export class ChangePasswordComponent implements OnInit, OnDestroy {
    }

    // Create new master key
-    const newMasterKey = await this.cryptoService.makeMasterKey(
+    const newMasterKey = await this.keyService.makeMasterKey(
      this.masterPassword,
      email.trim().toLowerCase(),
      this.kdfConfig,
    );
-    const newMasterKeyHash = await this.cryptoService.hashMasterKey(
-      this.masterPassword,
-      newMasterKey,
-    );
+    const newMasterKeyHash = await this.keyService.hashMasterKey(this.masterPassword, newMasterKey);

    let newProtectedUserKey: [UserKey, EncString] = null;
-    const userKey = await this.cryptoService.getUserKey();
+    const userKey = await this.keyService.getUserKey();
    if (userKey == null) {
-      newProtectedUserKey = await this.cryptoService.makeUserKey(newMasterKey);
+      newProtectedUserKey = await this.keyService.makeUserKey(newMasterKey);
    } else {
-      newProtectedUserKey = await this.cryptoService.encryptUserKeyWithMasterKey(newMasterKey);
+      newProtectedUserKey = await this.keyService.encryptUserKeyWithMasterKey(newMasterKey);
    }

    await this.performSubmitActions(newMasterKeyHash, newMasterKey, newProtectedUserKey);
--- a/libs/angular/src/auth/components/lock.component.ts
+++ b/libs/angular/src/auth/components/lock.component.ts
@@ -22,7 +22,6 @@ import {
  MasterPasswordVerification,
  MasterPasswordVerificationResponse,
 } from "@bitwarden/common/auth/types/verification";
-import { CryptoService } from "@bitwarden/common/platform/abstractions/crypto.service";
 import { EnvironmentService } from "@bitwarden/common/platform/abstractions/environment.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
@@ -35,7 +34,7 @@ import { UserId } from "@bitwarden/common/types/guid";
 import { UserKey } from "@bitwarden/common/types/key";
 import { SyncService } from "@bitwarden/common/vault/abstractions/sync/sync.service.abstraction";
 import { DialogService, ToastService } from "@bitwarden/components";
-import { BiometricStateService, BiometricsService } from "@bitwarden/key-management";
+import { KeyService, BiometricStateService, BiometricsService } from "@bitwarden/key-management";

@Directive()
 export class LockComponent implements OnInit, OnDestroy {
@@ -68,7 +67,7 @@ export class LockComponent implements OnInit, OnDestroy {
    protected i18nService: I18nService,
    protected platformUtilsService: PlatformUtilsService,
    protected messagingService: MessagingService,
-    protected cryptoService: CryptoService,
+    protected keyService: KeyService,
    protected vaultTimeoutService: VaultTimeoutService,
    protected vaultTimeoutSettingsService: VaultTimeoutSettingsService,
    protected environmentService: EnvironmentService,
@@ -136,7 +135,7 @@ export class LockComponent implements OnInit, OnDestroy {
    }

    await this.biometricStateService.setUserPromptCancelled();
-    const userKey = await this.cryptoService.getUserKeyFromStorage(
+    const userKey = await this.keyService.getUserKeyFromStorage(
      KeySuffixOptions.Biometric,
      this.activeUserId,
    );
@@ -277,7 +276,7 @@ export class LockComponent implements OnInit, OnDestroy {
    userId: UserId,
    evaluatePasswordAfterUnlock = false,
  ) {
-    await this.cryptoService.setUserKey(key, userId);
+    await this.keyService.setUserKey(key, userId);

    // Now that we have a decrypted user key in memory, we can check if we
    // need to establish trust on the current device
@@ -339,7 +338,7 @@ export class LockComponent implements OnInit, OnDestroy {
    this.supportsBiometric = await this.biometricsService.supportsBiometric();
    this.biometricLock =
      (await this.vaultTimeoutSettingsService.isBiometricLockSet()) &&
-      ((await this.cryptoService.hasUserKeyStored(KeySuffixOptions.Biometric)) ||
+      ((await this.keyService.hasUserKeyStored(KeySuffixOptions.Biometric)) ||
        !this.platformUtilsService.supportsSecureStorage());
    this.email = await firstValueFrom(
      this.accountService.activeAccount$.pipe(map((a) => a?.email)),
--- a/libs/angular/src/auth/components/login-via-auth-request.component.ts
+++ b/libs/angular/src/auth/components/login-via-auth-request.component.ts
@@ -24,7 +24,6 @@ import { HttpStatusCode } from "@bitwarden/common/enums/http-status-code.enum";
 import { ErrorResponse } from "@bitwarden/common/models/response/error.response";
 import { AppIdService } from "@bitwarden/common/platform/abstractions/app-id.service";
 import { CryptoFunctionService } from "@bitwarden/common/platform/abstractions/crypto-function.service";
-import { CryptoService } from "@bitwarden/common/platform/abstractions/crypto.service";
 import { EnvironmentService } from "@bitwarden/common/platform/abstractions/environment.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
@@ -34,6 +33,7 @@ import { Utils } from "@bitwarden/common/platform/misc/utils";
 import { UserId } from "@bitwarden/common/types/guid";
 import { ToastService } from "@bitwarden/components";
 import { PasswordGenerationServiceAbstraction } from "@bitwarden/generator-legacy";
+import { KeyService } from "@bitwarden/key-management";

 import { CaptchaProtectedComponent } from "./captcha-protected.component";

@@ -72,7 +72,7 @@ export class LoginViaAuthRequestComponent

  constructor(
    protected router: Router,
-    private cryptoService: CryptoService,
+    private keyService: KeyService,
    private cryptoFunctionService: CryptoFunctionService,
    private appIdService: AppIdService,
    private passwordGenerationService: PasswordGenerationServiceAbstraction,
--- a/libs/angular/src/auth/components/register.component.ts
+++ b/libs/angular/src/auth/components/register.component.ts
@@ -10,7 +10,6 @@ import { RegisterResponse } from "@bitwarden/common/auth/models/response/registe
 import { KeysRequest } from "@bitwarden/common/models/request/keys.request";
 import { ReferenceEventRequest } from "@bitwarden/common/models/request/reference-event.request";
 import { RegisterRequest } from "@bitwarden/common/models/request/register.request";
-import { CryptoService } from "@bitwarden/common/platform/abstractions/crypto.service";
 import { EnvironmentService } from "@bitwarden/common/platform/abstractions/environment.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
@@ -19,6 +18,7 @@ import { StateService } from "@bitwarden/common/platform/abstractions/state.serv
 import { Utils } from "@bitwarden/common/platform/misc/utils";
 import { DialogService, ToastService } from "@bitwarden/components";
 import { PasswordGenerationServiceAbstraction } from "@bitwarden/generator-legacy";
+import { KeyService } from "@bitwarden/key-management";

 import {
  AllValidationErrors,
@@ -88,7 +88,7 @@ export class RegisterComponent extends CaptchaProtectedComponent implements OnIn
    protected loginStrategyService: LoginStrategyServiceAbstraction,
    protected router: Router,
    i18nService: I18nService,
-    protected cryptoService: CryptoService,
+    protected keyService: KeyService,
    protected apiService: ApiService,
    protected stateService: StateService,
    platformUtilsService: PlatformUtilsService,
@@ -283,10 +283,10 @@ export class RegisterComponent extends CaptchaProtectedComponent implements OnIn
  ): Promise<RegisterRequest> {
    const hint = this.formGroup.value.hint;
    const kdfConfig = DEFAULT_KDF_CONFIG;
-    const key = await this.cryptoService.makeMasterKey(masterPassword, email, kdfConfig);
-    const newUserKey = await this.cryptoService.makeUserKey(key);
-    const masterKeyHash = await this.cryptoService.hashMasterKey(masterPassword, key);
-    const keys = await this.cryptoService.makeKeyPair(newUserKey[0]);
+    const key = await this.keyService.makeMasterKey(masterPassword, email, kdfConfig);
+    const newUserKey = await this.keyService.makeUserKey(key);
+    const masterKeyHash = await this.keyService.hashMasterKey(masterPassword, key);
+    const keys = await this.keyService.makeKeyPair(newUserKey[0]);
    const request = new RegisterRequest(
      email,
      name,
--- a/libs/angular/src/auth/components/set-password.component.ts
+++ b/libs/angular/src/auth/components/set-password.component.ts
@@ -22,7 +22,6 @@ import { ForceSetPasswordReason } from "@bitwarden/common/auth/models/domain/for
 import { DEFAULT_KDF_CONFIG } from "@bitwarden/common/auth/models/domain/kdf-config";
 import { SetPasswordRequest } from "@bitwarden/common/auth/models/request/set-password.request";
 import { KeysRequest } from "@bitwarden/common/models/request/keys.request";
-import { CryptoService } from "@bitwarden/common/platform/abstractions/crypto.service";
 import { EncryptService } from "@bitwarden/common/platform/abstractions/encrypt.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { MessagingService } from "@bitwarden/common/platform/abstractions/messaging.service";
@@ -36,6 +35,7 @@ import { MasterKey, UserKey } from "@bitwarden/common/types/key";
 import { SyncService } from "@bitwarden/common/vault/abstractions/sync/sync.service.abstraction";
 import { DialogService, ToastService } from "@bitwarden/components";
 import { PasswordGenerationServiceAbstraction } from "@bitwarden/generator-legacy";
+import { KeyService } from "@bitwarden/key-management";

 import { ChangePasswordComponent as BaseChangePasswordComponent } from "./change-password.component";

@@ -58,7 +58,7 @@ export class SetPasswordComponent extends BaseChangePasswordComponent implements
    accountService: AccountService,
    masterPasswordService: InternalMasterPasswordServiceAbstraction,
    i18nService: I18nService,
-    cryptoService: CryptoService,
+    keyService: KeyService,
    messagingService: MessagingService,
    passwordGenerationService: PasswordGenerationServiceAbstraction,
    platformUtilsService: PlatformUtilsService,
@@ -80,7 +80,7 @@ export class SetPasswordComponent extends BaseChangePasswordComponent implements
  ) {
    super(
      i18nService,
-      cryptoService,
+      keyService,
      messagingService,
      passwordGenerationService,
      platformUtilsService,
@@ -173,10 +173,10 @@ export class SetPasswordComponent extends BaseChangePasswordComponent implements

      // in case we have a local private key, and are not sure whether it has been posted to the server, we post the local private key instead of generating a new one
      const existingUserPrivateKey = (await firstValueFrom(
-        this.cryptoService.userPrivateKey$(this.userId),
+        this.keyService.userPrivateKey$(this.userId),
      )) as Uint8Array;
      const existingUserPublicKey = await firstValueFrom(
-        this.cryptoService.userPublicKey$(this.userId),
+        this.keyService.userPublicKey$(this.userId),
      );
      if (existingUserPrivateKey != null && existingUserPublicKey != null) {
        const existingUserPublicKeyB64 = Utils.fromBufferToB64(existingUserPublicKey);
@@ -185,7 +185,7 @@ export class SetPasswordComponent extends BaseChangePasswordComponent implements
          await this.encryptService.encrypt(existingUserPrivateKey, userKey[0]),
        ];
      } else {
-        newKeyPair = await this.cryptoService.makeKeyPair(userKey[0]);
+        newKeyPair = await this.keyService.makeKeyPair(userKey[0]);
      }
      keysRequest = new KeysRequest(newKeyPair[0], newKeyPair[1].encryptedString);
    }
@@ -214,7 +214,7 @@ export class SetPasswordComponent extends BaseChangePasswordComponent implements
            const publicKey = Utils.fromB64ToArray(response.publicKey);

            // RSA Encrypt user key with organization public key
-            const userKey = await this.cryptoService.getUserKey();
+            const userKey = await this.keyService.getUserKey();
            const encryptedUserKey = await this.encryptService.rsaEncrypt(userKey.key, publicKey);

            const resetRequest = new OrganizationUserResetPasswordEnrollmentRequest();
@@ -277,7 +277,7 @@ export class SetPasswordComponent extends BaseChangePasswordComponent implements
    await this.userDecryptionOptionsService.setUserDecryptionOptions(userDecryptionOpts);
    await this.kdfConfigService.setKdfConfig(this.userId, this.kdfConfig);
    await this.masterPasswordService.setMasterKey(masterKey, this.userId);
-    await this.cryptoService.setUserKey(userKey[0], this.userId);
+    await this.keyService.setUserKey(userKey[0], this.userId);

    // Set private key only for new JIT provisioned users in MP encryption orgs
    // Existing TDE users will have private key set on sync or on login
@@ -286,10 +286,10 @@ export class SetPasswordComponent extends BaseChangePasswordComponent implements
      this.forceSetPasswordReason !=
        ForceSetPasswordReason.TdeUserWithoutPasswordHasPasswordResetPermission
    ) {
-      await this.cryptoService.setPrivateKey(keyPair[1].encryptedString, this.userId);
+      await this.keyService.setPrivateKey(keyPair[1].encryptedString, this.userId);
    }

-    const localMasterKeyHash = await this.cryptoService.hashMasterKey(
+    const localMasterKeyHash = await this.keyService.hashMasterKey(
      this.masterPassword,
      masterKey,
      HashPurpose.LocalAuthorization,
--- a/libs/angular/src/auth/components/set-pin.component.ts
+++ b/libs/angular/src/auth/components/set-pin.component.ts
@@ -6,8 +6,8 @@ import { firstValueFrom } from "rxjs";
 import { PinServiceAbstraction } from "@bitwarden/auth/common";
 import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
 import { UserVerificationService } from "@bitwarden/common/auth/abstractions/user-verification/user-verification.service.abstraction";
-import { CryptoService } from "@bitwarden/common/platform/abstractions/crypto.service";
 import { Utils } from "@bitwarden/common/platform/misc/utils";
+import { KeyService } from "@bitwarden/key-management";

@Directive()
 export class SetPinComponent implements OnInit {
@@ -20,7 +20,7 @@ export class SetPinComponent implements OnInit {

  constructor(
    private accountService: AccountService,
-    private cryptoService: CryptoService,
+    private keyService: KeyService,
    private dialogRef: DialogRef,
    private formBuilder: FormBuilder,
    private pinService: PinServiceAbstraction,
@@ -46,7 +46,7 @@ export class SetPinComponent implements OnInit {
    }

    const userId = (await firstValueFrom(this.accountService.activeAccount$))?.id;
-    const userKey = await this.cryptoService.getUserKey();
+    const userKey = await this.keyService.getUserKey();

    const userKeyEncryptedPin = await this.pinService.createUserKeyEncryptedPin(pin, userKey);
    await this.pinService.setUserKeyEncryptedPin(userKeyEncryptedPin, userId);
--- a/libs/angular/src/auth/components/update-password.component.ts
+++ b/libs/angular/src/auth/components/update-password.component.ts
@@ -11,7 +11,6 @@ import { UserVerificationService } from "@bitwarden/common/auth/abstractions/use
 import { VerificationType } from "@bitwarden/common/auth/enums/verification-type";
 import { PasswordRequest } from "@bitwarden/common/auth/models/request/password.request";
 import { Verification } from "@bitwarden/common/auth/types/verification";
-import { CryptoService } from "@bitwarden/common/platform/abstractions/crypto.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
 import { MessagingService } from "@bitwarden/common/platform/abstractions/messaging.service";
@@ -21,6 +20,7 @@ import { EncString } from "@bitwarden/common/platform/models/domain/enc-string";
 import { MasterKey, UserKey } from "@bitwarden/common/types/key";
 import { DialogService, ToastService } from "@bitwarden/components";
 import { PasswordGenerationServiceAbstraction } from "@bitwarden/generator-legacy";
+import { KeyService } from "@bitwarden/key-management";

 import { ChangePasswordComponent as BaseChangePasswordComponent } from "./change-password.component";

@@ -40,7 +40,7 @@ export class UpdatePasswordComponent extends BaseChangePasswordComponent {
    platformUtilsService: PlatformUtilsService,
    passwordGenerationService: PasswordGenerationServiceAbstraction,
    policyService: PolicyService,
-    cryptoService: CryptoService,
+    keyService: KeyService,
    messagingService: MessagingService,
    private apiService: ApiService,
    stateService: StateService,
@@ -54,7 +54,7 @@ export class UpdatePasswordComponent extends BaseChangePasswordComponent {
  ) {
    super(
      i18nService,
-      cryptoService,
+      keyService,
      messagingService,
      passwordGenerationService,
      platformUtilsService,
@@ -114,9 +114,9 @@ export class UpdatePasswordComponent extends BaseChangePasswordComponent {
    try {
      // Create Request
      const request = new PasswordRequest();
-      request.masterPasswordHash = await this.cryptoService.hashMasterKey(
+      request.masterPasswordHash = await this.keyService.hashMasterKey(
        this.currentMasterPassword,
-        await this.cryptoService.getOrDeriveMasterKey(this.currentMasterPassword),
+        await this.keyService.getOrDeriveMasterKey(this.currentMasterPassword),
      );
      request.newMasterPasswordHash = newMasterKeyHash;
      request.key = newUserKey[1].encryptedString;
--- a/libs/angular/src/auth/components/update-temp-password.component.ts
+++ b/libs/angular/src/auth/components/update-temp-password.component.ts
@@ -15,7 +15,6 @@ import { PasswordRequest } from "@bitwarden/common/auth/models/request/password.
 import { UpdateTdeOffboardingPasswordRequest } from "@bitwarden/common/auth/models/request/update-tde-offboarding-password.request";
 import { UpdateTempPasswordRequest } from "@bitwarden/common/auth/models/request/update-temp-password.request";
 import { MasterPasswordVerification } from "@bitwarden/common/auth/types/verification";
-import { CryptoService } from "@bitwarden/common/platform/abstractions/crypto.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
 import { MessagingService } from "@bitwarden/common/platform/abstractions/messaging.service";
@@ -26,6 +25,7 @@ import { MasterKey, UserKey } from "@bitwarden/common/types/key";
 import { SyncService } from "@bitwarden/common/vault/abstractions/sync/sync.service.abstraction";
 import { DialogService, ToastService } from "@bitwarden/components";
 import { PasswordGenerationServiceAbstraction } from "@bitwarden/generator-legacy";
+import { KeyService } from "@bitwarden/key-management";

 import { ChangePasswordComponent as BaseChangePasswordComponent } from "./change-password.component";

@@ -52,7 +52,7 @@ export class UpdateTempPasswordComponent extends BaseChangePasswordComponent imp
    platformUtilsService: PlatformUtilsService,
    passwordGenerationService: PasswordGenerationServiceAbstraction,
    policyService: PolicyService,
-    cryptoService: CryptoService,
+    keyService: KeyService,
    messagingService: MessagingService,
    private apiService: ApiService,
    stateService: StateService,
@@ -68,7 +68,7 @@ export class UpdateTempPasswordComponent extends BaseChangePasswordComponent imp
  ) {
    super(
      i18nService,
-      cryptoService,
+      keyService,
      messagingService,
      passwordGenerationService,
      platformUtilsService,
@@ -134,21 +134,21 @@ export class UpdateTempPasswordComponent extends BaseChangePasswordComponent imp

    try {
      // Create new key and hash new password
-      const newMasterKey = await this.cryptoService.makeMasterKey(
+      const newMasterKey = await this.keyService.makeMasterKey(
        this.masterPassword,
        this.email.trim().toLowerCase(),
        this.kdfConfig,
      );
-      const newPasswordHash = await this.cryptoService.hashMasterKey(
+      const newPasswordHash = await this.keyService.hashMasterKey(
        this.masterPassword,
        newMasterKey,
      );

      // Grab user key
-      const userKey = await this.cryptoService.getUserKey();
+      const userKey = await this.keyService.getUserKey();

      // Encrypt user key with new master key
-      const newProtectedUserKey = await this.cryptoService.encryptUserKeyWithMasterKey(
+      const newProtectedUserKey = await this.keyService.encryptUserKeyWithMasterKey(
        newMasterKey,
        userKey,
      );
--- a/libs/angular/src/auth/components/user-verification.component.ts
+++ b/libs/angular/src/auth/components/user-verification.component.ts
@@ -5,9 +5,9 @@ import { Subject, takeUntil } from "rxjs";
 import { UserVerificationService } from "@bitwarden/common/auth/abstractions/user-verification/user-verification.service.abstraction";
 import { VerificationType } from "@bitwarden/common/auth/enums/verification-type";
 import { Verification } from "@bitwarden/common/auth/types/verification";
-import { CryptoService } from "@bitwarden/common/platform/abstractions/crypto.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { Utils } from "@bitwarden/common/platform/misc/utils";
+import { KeyService } from "@bitwarden/key-management";

 /**
 * Used for general-purpose user verification throughout the app.
@@ -66,7 +66,7 @@ export class UserVerificationComponent implements ControlValueAccessor, OnInit,
  private destroy$ = new Subject<void>();

  constructor(
-    private cryptoService: CryptoService,
+    private keyService: KeyService,
    private userVerificationService: UserVerificationService,
    private i18nService: I18nService,
  ) {}
--- a/libs/angular/src/auth/guards/lock.guard.spec.ts
+++ b/libs/angular/src/auth/guards/lock.guard.spec.ts
@@ -12,10 +12,10 @@ import { DeviceTrustServiceAbstraction } from "@bitwarden/common/auth/abstractio
 import { UserVerificationService } from "@bitwarden/common/auth/abstractions/user-verification/user-verification.service.abstraction";
 import { AuthenticationStatus } from "@bitwarden/common/auth/enums/authentication-status";
 import { ClientType } from "@bitwarden/common/enums";
-import { CryptoService } from "@bitwarden/common/platform/abstractions/crypto.service";
 import { MessagingService } from "@bitwarden/common/platform/abstractions/messaging.service";
 import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
 import { UserId } from "@bitwarden/common/types/guid";
+import { KeyService } from "@bitwarden/key-management";

 import { lockGuard } from "./lock.guard";

@@ -38,9 +38,9 @@ describe("lockGuard", () => {
      mock<VaultTimeoutSettingsService>();
    vaultTimeoutSettingsService.canLock.mockResolvedValue(setupParams.canLock);

-    const cryptoService: MockProxy<CryptoService> = mock<CryptoService>();
-    cryptoService.isLegacyUser.mockResolvedValue(setupParams.isLegacyUser);
-    cryptoService.everHadUserKey$ = of(setupParams.everHadUserKey);
+    const keyService: MockProxy<KeyService> = mock<KeyService>();
+    keyService.isLegacyUser.mockResolvedValue(setupParams.isLegacyUser);
+    keyService.everHadUserKey$ = of(setupParams.everHadUserKey);

    const platformUtilService: MockProxy<PlatformUtilsService> = mock<PlatformUtilsService>();
    platformUtilService.getClientType.mockReturnValue(setupParams.clientType);
@@ -83,7 +83,7 @@ describe("lockGuard", () => {
        { provide: MessagingService, useValue: messagingService },
        { provide: AccountService, useValue: accountService },
        { provide: VaultTimeoutSettingsService, useValue: vaultTimeoutSettingsService },
-        { provide: CryptoService, useValue: cryptoService },
+        { provide: KeyService, useValue: keyService },
        { provide: PlatformUtilsService, useValue: platformUtilService },
        { provide: DeviceTrustServiceAbstraction, useValue: deviceTrustService },
        { provide: UserVerificationService, useValue: userVerificationService },
--- a/libs/angular/src/auth/guards/lock.guard.ts
+++ b/libs/angular/src/auth/guards/lock.guard.ts
@@ -14,9 +14,9 @@ import { DeviceTrustServiceAbstraction } from "@bitwarden/common/auth/abstractio
 import { UserVerificationService } from "@bitwarden/common/auth/abstractions/user-verification/user-verification.service.abstraction";
 import { AuthenticationStatus } from "@bitwarden/common/auth/enums/authentication-status";
 import { ClientType } from "@bitwarden/common/enums";
-import { CryptoService } from "@bitwarden/common/platform/abstractions/crypto.service";
 import { MessagingService } from "@bitwarden/common/platform/abstractions/messaging.service";
 import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
+import { KeyService } from "@bitwarden/key-management";

 /**
 * Only allow access to this route if the vault is locked.
@@ -31,7 +31,7 @@ export function lockGuard(): CanActivateFn {
    routerStateSnapshot: RouterStateSnapshot,
  ) => {
    const authService = inject(AuthService);
-    const cryptoService = inject(CryptoService);
+    const keyService = inject(KeyService);
    const deviceTrustService = inject(DeviceTrustServiceAbstraction);
    const platformUtilService = inject(PlatformUtilsService);
    const messagingService = inject(MessagingService);
@@ -54,7 +54,7 @@ export function lockGuard(): CanActivateFn {
    }

    // If legacy user on web, redirect to migration page
-    if (await cryptoService.isLegacyUser()) {
+    if (await keyService.isLegacyUser()) {
      if (platformUtilService.getClientType() === ClientType.Web) {
        return router.createUrlTree(["migrate-legacy-encryption"]);
      }
@@ -78,7 +78,7 @@ export function lockGuard(): CanActivateFn {
    }

    // If authN user with TDE directly navigates to lock, reject that navigation
-    const everHadUserKey = await firstValueFrom(cryptoService.everHadUserKey$);
+    const everHadUserKey = await firstValueFrom(keyService.everHadUserKey$);
    if (tdeEnabled && !everHadUserKey) {
      return false;
    }
--- a/libs/angular/src/auth/guards/redirect.guard.ts
+++ b/libs/angular/src/auth/guards/redirect.guard.ts
@@ -5,8 +5,8 @@ import { firstValueFrom } from "rxjs";
 import { AuthService } from "@bitwarden/common/auth/abstractions/auth.service";
 import { DeviceTrustServiceAbstraction } from "@bitwarden/common/auth/abstractions/device-trust.service.abstraction";
 import { AuthenticationStatus } from "@bitwarden/common/auth/enums/authentication-status";
-import { CryptoService } from "@bitwarden/common/platform/abstractions/crypto.service";
 import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
+import { KeyService } from "@bitwarden/key-management";

 export interface RedirectRoutes {
  loggedIn: string;
@@ -31,7 +31,7 @@ export function redirectGuard(overrides: Partial<RedirectRoutes> = {}): CanActiv
  const routes = { ...defaultRoutes, ...overrides };
  return async (route) => {
    const authService = inject(AuthService);
-    const cryptoService = inject(CryptoService);
+    const keyService = inject(KeyService);
    const deviceTrustService = inject(DeviceTrustServiceAbstraction);
    const logService = inject(LogService);
    const router = inject(Router);
@@ -49,7 +49,7 @@ export function redirectGuard(overrides: Partial<RedirectRoutes> = {}): CanActiv
    // If locked, TDE is enabled, and the user hasn't decrypted yet, then redirect to the
    // login decryption options component.
    const tdeEnabled = await firstValueFrom(deviceTrustService.supportsDeviceTrust$);
-    const everHadUserKey = await firstValueFrom(cryptoService.everHadUserKey$);
+    const everHadUserKey = await firstValueFrom(keyService.everHadUserKey$);
    if (authStatus === AuthenticationStatus.Locked && tdeEnabled && !everHadUserKey) {
      logService.info(
        "Sending user to TDE decryption options. AuthStatus is %s. TDE support is %s. Ever had user key is %s.",
--- a/libs/angular/src/auth/guards/tde-decryption-required.guard.ts
+++ b/libs/angular/src/auth/guards/tde-decryption-required.guard.ts
@@ -10,8 +10,8 @@ import { firstValueFrom } from "rxjs";
 import { AuthService } from "@bitwarden/common/auth/abstractions/auth.service";
 import { DeviceTrustServiceAbstraction } from "@bitwarden/common/auth/abstractions/device-trust.service.abstraction";
 import { AuthenticationStatus } from "@bitwarden/common/auth/enums/authentication-status";
-import { CryptoService } from "@bitwarden/common/platform/abstractions/crypto.service";
 import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
+import { KeyService } from "@bitwarden/key-management";

 /**
 * Only allow access to this route if the vault is locked and has never been decrypted.
@@ -22,14 +22,14 @@ import { LogService } from "@bitwarden/common/platform/abstractions/log.service"
 export function tdeDecryptionRequiredGuard(): CanActivateFn {
  return async (_: ActivatedRouteSnapshot, state: RouterStateSnapshot) => {
    const authService = inject(AuthService);
-    const cryptoService = inject(CryptoService);
+    const keyService = inject(KeyService);
    const deviceTrustService = inject(DeviceTrustServiceAbstraction);
    const logService = inject(LogService);
    const router = inject(Router);

    const authStatus = await authService.getAuthStatus();
    const tdeEnabled = await firstValueFrom(deviceTrustService.supportsDeviceTrust$);
-    const everHadUserKey = await firstValueFrom(cryptoService.everHadUserKey$);
+    const everHadUserKey = await firstValueFrom(keyService.everHadUserKey$);

    // We need to determine if we should bypass the decryption options and send the user to the vault.
    // The ONLY time that we want to send a user to the decryption options is when:
--- a/libs/angular/src/platform/pipes/fingerprint.pipe.ts
+++ b/libs/angular/src/platform/pipes/fingerprint.pipe.ts
@@ -1,13 +1,13 @@
 import { Pipe } from "@angular/core";

-import { CryptoService } from "@bitwarden/common/platform/abstractions/crypto.service";
 import { Utils } from "@bitwarden/common/platform/misc/utils";
+import { KeyService } from "@bitwarden/key-management";

@Pipe({
  name: "fingerprint",
 })
 export class FingerprintPipe {
-  constructor(private cryptoService: CryptoService) {}
+  constructor(private keyService: KeyService) {}

  async transform(publicKey: string | Uint8Array, fingerprintMaterial: string): Promise<string> {
    try {
@@ -15,7 +15,7 @@ export class FingerprintPipe {
        publicKey = Utils.fromB64ToArray(publicKey);
      }

-      const fingerprint = await this.cryptoService.getFingerprint(fingerprintMaterial, publicKey);
+      const fingerprint = await this.keyService.getFingerprint(fingerprintMaterial, publicKey);

      if (fingerprint != null) {
        return fingerprint.join("-");
--- a/libs/angular/src/services/jslib-services.module.ts
+++ b/libs/angular/src/services/jslib-services.module.ts
@@ -89,7 +89,7 @@ import { TwoFactorService as TwoFactorServiceAbstraction } from "@bitwarden/comm
 import { UserVerificationApiServiceAbstraction } from "@bitwarden/common/auth/abstractions/user-verification/user-verification-api.service.abstraction";
 import { UserVerificationService as UserVerificationServiceAbstraction } from "@bitwarden/common/auth/abstractions/user-verification/user-verification.service.abstraction";
 import { WebAuthnLoginApiServiceAbstraction } from "@bitwarden/common/auth/abstractions/webauthn/webauthn-login-api.service.abstraction";
-import { WebAuthnLoginPrfCryptoServiceAbstraction } from "@bitwarden/common/auth/abstractions/webauthn/webauthn-login-prf-crypto.service.abstraction";
+import { WebAuthnLoginPrfKeyServiceAbstraction } from "@bitwarden/common/auth/abstractions/webauthn/webauthn-login-prf-key.service.abstraction";
 import { WebAuthnLoginServiceAbstraction } from "@bitwarden/common/auth/abstractions/webauthn/webauthn-login.service.abstraction";
 import { AccountApiServiceImplementation } from "@bitwarden/common/auth/services/account-api.service";
 import { AccountServiceImplementation } from "@bitwarden/common/auth/services/account.service";
@@ -109,7 +109,7 @@ import { TwoFactorService } from "@bitwarden/common/auth/services/two-factor.ser
 import { UserVerificationApiService } from "@bitwarden/common/auth/services/user-verification/user-verification-api.service";
 import { UserVerificationService } from "@bitwarden/common/auth/services/user-verification/user-verification.service";
 import { WebAuthnLoginApiService } from "@bitwarden/common/auth/services/webauthn-login/webauthn-login-api.service";
-import { WebAuthnLoginPrfCryptoService } from "@bitwarden/common/auth/services/webauthn-login/webauthn-login-prf-crypto.service";
+import { WebAuthnLoginPrfKeyService } from "@bitwarden/common/auth/services/webauthn-login/webauthn-login-prf-key.service";
 import { WebAuthnLoginService } from "@bitwarden/common/auth/services/webauthn-login/webauthn-login.service";
 import {
  AutofillSettingsServiceAbstraction,
@@ -141,7 +141,6 @@ import { BulkEncryptService } from "@bitwarden/common/platform/abstractions/bulk
 import { ConfigApiServiceAbstraction } from "@bitwarden/common/platform/abstractions/config/config-api.service.abstraction";
 import { ConfigService } from "@bitwarden/common/platform/abstractions/config/config.service";
 import { CryptoFunctionService as CryptoFunctionServiceAbstraction } from "@bitwarden/common/platform/abstractions/crypto-function.service";
-import { CryptoService as CryptoServiceAbstraction } from "@bitwarden/common/platform/abstractions/crypto.service";
 import { EncryptService } from "@bitwarden/common/platform/abstractions/encrypt.service";
 import {
  EnvironmentService,
@@ -173,7 +172,6 @@ import { AppIdService } from "@bitwarden/common/platform/services/app-id.service
 import { ConfigApiService } from "@bitwarden/common/platform/services/config/config-api.service";
 import { DefaultConfigService } from "@bitwarden/common/platform/services/config/default-config.service";
 import { ConsoleLogService } from "@bitwarden/common/platform/services/console-log.service";
-import { CryptoService } from "@bitwarden/common/platform/services/crypto.service";
 import { BulkEncryptServiceImplementation } from "@bitwarden/common/platform/services/cryptography/bulk-encrypt.service.implementation";
 import { MultithreadEncryptServiceImplementation } from "@bitwarden/common/platform/services/cryptography/multithread-encrypt.service.implementation";
 import { DefaultBroadcasterService } from "@bitwarden/common/platform/services/default-broadcaster.service";
@@ -269,7 +267,12 @@ import {
  ImportService,
  ImportServiceAbstraction,
 } from "@bitwarden/importer/core";
-import { BiometricStateService, DefaultBiometricStateService } from "@bitwarden/key-management";
+import {
+  KeyService as KeyServiceAbstraction,
+  DefaultKeyService as KeyService,
+  BiometricStateService,
+  DefaultBiometricStateService,
+} from "@bitwarden/key-management";
 import { PasswordRepromptService } from "@bitwarden/vault";
 import {
  VaultExportService,
@@ -395,7 +398,7 @@ const safeProviders: SafeProvider[] = [
    deps: [
      AccountServiceAbstraction,
      MessagingServiceAbstraction,
-      CryptoServiceAbstraction,
+      KeyServiceAbstraction,
      ApiServiceAbstraction,
      StateServiceAbstraction,
      TokenServiceAbstraction,
@@ -407,7 +410,7 @@ const safeProviders: SafeProvider[] = [
    deps: [
      AccountServiceAbstraction,
      InternalMasterPasswordServiceAbstraction,
-      CryptoServiceAbstraction,
+      KeyServiceAbstraction,
      ApiServiceAbstraction,
      TokenServiceAbstraction,
      AppIdServiceAbstraction,
@@ -445,7 +448,7 @@ const safeProviders: SafeProvider[] = [
  safeProvider({
    provide: CipherServiceAbstraction,
    useFactory: (
-      cryptoService: CryptoServiceAbstraction,
+      keyService: KeyServiceAbstraction,
      domainSettingsService: DomainSettingsService,
      apiService: ApiServiceAbstraction,
      i18nService: I18nServiceAbstraction,
@@ -460,7 +463,7 @@ const safeProviders: SafeProvider[] = [
      accountService: AccountServiceAbstraction,
    ) =>
      new CipherService(
-        cryptoService,
+        keyService,
        domainSettingsService,
        apiService,
        i18nService,
@@ -475,7 +478,7 @@ const safeProviders: SafeProvider[] = [
        accountService,
      ),
    deps: [
-      CryptoServiceAbstraction,
+      KeyServiceAbstraction,
      DomainSettingsService,
      ApiServiceAbstraction,
      I18nServiceAbstraction,
@@ -494,7 +497,7 @@ const safeProviders: SafeProvider[] = [
    provide: InternalFolderService,
    useClass: FolderService,
    deps: [
-      CryptoServiceAbstraction,
+      KeyServiceAbstraction,
      EncryptService,
      I18nServiceAbstraction,
      CipherServiceAbstraction,
@@ -539,7 +542,7 @@ const safeProviders: SafeProvider[] = [
  safeProvider({
    provide: CollectionService,
    useClass: DefaultCollectionService,
-    deps: [CryptoServiceAbstraction, EncryptService, I18nServiceAbstraction, StateProvider],
+    deps: [KeyServiceAbstraction, EncryptService, I18nServiceAbstraction, StateProvider],
  }),
  safeProvider({
    provide: ENV_ADDITIONAL_REGIONS,
@@ -584,8 +587,8 @@ const safeProviders: SafeProvider[] = [
    deps: [CryptoFunctionServiceAbstraction],
  }),
  safeProvider({
-    provide: CryptoServiceAbstraction,
-    useClass: CryptoService,
+    provide: KeyServiceAbstraction,
+    useClass: KeyService,
    deps: [
      PinServiceAbstraction,
      InternalMasterPasswordServiceAbstraction,
@@ -610,7 +613,7 @@ const safeProviders: SafeProvider[] = [
    useFactory: legacyPasswordGenerationServiceFactory,
    deps: [
      EncryptService,
-      CryptoServiceAbstraction,
+      KeyServiceAbstraction,
      PolicyServiceAbstraction,
      AccountServiceAbstraction,
      StateProvider,
@@ -619,7 +622,7 @@ const safeProviders: SafeProvider[] = [
  safeProvider({
    provide: GeneratorHistoryService,
    useClass: LocalGeneratorHistoryService,
-    deps: [EncryptService, CryptoServiceAbstraction, StateProvider],
+    deps: [EncryptService, KeyServiceAbstraction, StateProvider],
  }),
  safeProvider({
    provide: UsernameGenerationServiceAbstraction,
@@ -627,7 +630,7 @@ const safeProviders: SafeProvider[] = [
    deps: [
      ApiServiceAbstraction,
      I18nServiceAbstraction,
-      CryptoServiceAbstraction,
+      KeyServiceAbstraction,
      EncryptService,
      PolicyServiceAbstraction,
      AccountServiceAbstraction,
@@ -667,7 +670,7 @@ const safeProviders: SafeProvider[] = [
    provide: InternalSendService,
    useClass: SendService,
    deps: [
-      CryptoServiceAbstraction,
+      KeyServiceAbstraction,
      I18nServiceAbstraction,
      KeyGenerationServiceAbstraction,
      SendStateProviderAbstraction,
@@ -694,7 +697,7 @@ const safeProviders: SafeProvider[] = [
      DomainSettingsService,
      InternalFolderService,
      CipherServiceAbstraction,
-      CryptoServiceAbstraction,
+      KeyServiceAbstraction,
      CollectionService,
      MessagingServiceAbstraction,
      InternalPolicyService,
@@ -727,7 +730,7 @@ const safeProviders: SafeProvider[] = [
      AccountServiceAbstraction,
      PinServiceAbstraction,
      UserDecryptionOptionsServiceAbstraction,
-      CryptoServiceAbstraction,
+      KeyServiceAbstraction,
      TokenServiceAbstraction,
      PolicyServiceAbstraction,
      BiometricStateService,
@@ -800,7 +803,7 @@ const safeProviders: SafeProvider[] = [
      ImportApiServiceAbstraction,
      I18nServiceAbstraction,
      CollectionService,
-      CryptoServiceAbstraction,
+      KeyServiceAbstraction,
      EncryptService,
      PinServiceAbstraction,
      AccountServiceAbstraction,
@@ -813,7 +816,7 @@ const safeProviders: SafeProvider[] = [
      FolderServiceAbstraction,
      CipherServiceAbstraction,
      PinServiceAbstraction,
-      CryptoServiceAbstraction,
+      KeyServiceAbstraction,
      EncryptService,
      CryptoFunctionServiceAbstraction,
      KdfConfigServiceAbstraction,
@@ -827,7 +830,7 @@ const safeProviders: SafeProvider[] = [
      CipherServiceAbstraction,
      ApiServiceAbstraction,
      PinServiceAbstraction,
-      CryptoServiceAbstraction,
+      KeyServiceAbstraction,
      EncryptService,
      CryptoFunctionServiceAbstraction,
      CollectionService,
@@ -928,7 +931,7 @@ const safeProviders: SafeProvider[] = [
    deps: [
      AccountServiceAbstraction,
      InternalMasterPasswordServiceAbstraction,
-      CryptoServiceAbstraction,
+      KeyServiceAbstraction,
      ApiServiceAbstraction,
      TokenServiceAbstraction,
      LogService,
@@ -942,7 +945,7 @@ const safeProviders: SafeProvider[] = [
    provide: UserVerificationServiceAbstraction,
    useClass: UserVerificationService,
    deps: [
-      CryptoServiceAbstraction,
+      KeyServiceAbstraction,
      AccountServiceAbstraction,
      InternalMasterPasswordServiceAbstraction,
      I18nServiceAbstraction,
@@ -975,7 +978,7 @@ const safeProviders: SafeProvider[] = [
    deps: [
      OrganizationApiServiceAbstraction,
      AccountServiceAbstraction,
-      CryptoServiceAbstraction,
+      KeyServiceAbstraction,
      EncryptService,
      OrganizationUserApiService,
      I18nServiceAbstraction,
@@ -1085,7 +1088,7 @@ const safeProviders: SafeProvider[] = [
    deps: [
      KeyGenerationServiceAbstraction,
      CryptoFunctionServiceAbstraction,
-      CryptoServiceAbstraction,
+      KeyServiceAbstraction,
      EncryptService,
      AppIdServiceAbstraction,
      DevicesApiServiceAbstraction,
@@ -1105,7 +1108,7 @@ const safeProviders: SafeProvider[] = [
      AppIdServiceAbstraction,
      AccountServiceAbstraction,
      InternalMasterPasswordServiceAbstraction,
-      CryptoServiceAbstraction,
+      KeyServiceAbstraction,
      EncryptService,
      ApiServiceAbstraction,
      StateProvider,
@@ -1127,8 +1130,8 @@ const safeProviders: SafeProvider[] = [
    ],
  }),
  safeProvider({
-    provide: WebAuthnLoginPrfCryptoServiceAbstraction,
-    useClass: WebAuthnLoginPrfCryptoService,
+    provide: WebAuthnLoginPrfKeyServiceAbstraction,
+    useClass: WebAuthnLoginPrfKeyService,
    deps: [CryptoFunctionServiceAbstraction],
  }),
  safeProvider({
@@ -1142,7 +1145,7 @@ const safeProviders: SafeProvider[] = [
    deps: [
      WebAuthnLoginApiServiceAbstraction,
      LoginStrategyServiceAbstraction,
-      WebAuthnLoginPrfCryptoServiceAbstraction,
+      WebAuthnLoginPrfKeyServiceAbstraction,
      WINDOW,
      LogService,
    ],
@@ -1197,7 +1200,7 @@ const safeProviders: SafeProvider[] = [
    useClass: OrganizationBillingService,
    deps: [
      ApiServiceAbstraction,
-      CryptoServiceAbstraction,
+      KeyServiceAbstraction,
      EncryptService,
      I18nServiceAbstraction,
      OrganizationApiServiceAbstraction,
@@ -1257,7 +1260,7 @@ const safeProviders: SafeProvider[] = [
  safeProvider({
    provide: UserAutoUnlockKeyService,
    useClass: UserAutoUnlockKeyService,
-    deps: [CryptoServiceAbstraction],
+    deps: [KeyServiceAbstraction],
  }),
  safeProvider({
    provide: ErrorHandler,
@@ -1301,7 +1304,7 @@ const safeProviders: SafeProvider[] = [
    useClass: DefaultSetPasswordJitService,
    deps: [
      ApiServiceAbstraction,
-      CryptoServiceAbstraction,
+      KeyServiceAbstraction,
      EncryptService,
      I18nServiceAbstraction,
      KdfConfigServiceAbstraction,
@@ -1324,7 +1327,7 @@ const safeProviders: SafeProvider[] = [
  safeProvider({
    provide: RegistrationFinishServiceAbstraction,
    useClass: DefaultRegistrationFinishService,
-    deps: [CryptoServiceAbstraction, AccountApiServiceAbstraction],
+    deps: [KeyServiceAbstraction, AccountApiServiceAbstraction],
  }),
  safeProvider({
    provide: ViewCacheService,
@@ -1340,7 +1343,7 @@ const safeProviders: SafeProvider[] = [
      PlatformUtilsServiceAbstraction,
      AccountServiceAbstraction,
      KdfConfigServiceAbstraction,
-      CryptoServiceAbstraction,
+      KeyServiceAbstraction,
      ApiServiceAbstraction,
    ],
  }),
--- a/libs/angular/src/vault/components/attachments.component.ts
+++ b/libs/angular/src/vault/components/attachments.component.ts
@@ -5,7 +5,6 @@ import { ApiService } from "@bitwarden/common/abstractions/api.service";
 import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
 import { BillingAccountProfileStateService } from "@bitwarden/common/billing/abstractions/account/billing-account-profile-state.service";
 import { ErrorResponse } from "@bitwarden/common/models/response/error.response";
-import { CryptoService } from "@bitwarden/common/platform/abstractions/crypto.service";
 import { EncryptService } from "@bitwarden/common/platform/abstractions/encrypt.service";
 import { FileDownloadService } from "@bitwarden/common/platform/abstractions/file-download/file-download.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
@@ -19,6 +18,7 @@ import { Cipher } from "@bitwarden/common/vault/models/domain/cipher";
 import { AttachmentView } from "@bitwarden/common/vault/models/view/attachment.view";
 import { CipherView } from "@bitwarden/common/vault/models/view/cipher.view";
 import { DialogService, ToastService } from "@bitwarden/components";
+import { KeyService } from "@bitwarden/key-management";

@Directive()
 export class AttachmentsComponent implements OnInit {
@@ -40,7 +40,7 @@ export class AttachmentsComponent implements OnInit {
  constructor(
    protected cipherService: CipherService,
    protected i18nService: I18nService,
-    protected cryptoService: CryptoService,
+    protected keyService: KeyService,
    protected encryptService: EncryptService,
    protected platformUtilsService: PlatformUtilsService,
    protected apiService: ApiService,
@@ -179,7 +179,7 @@ export class AttachmentsComponent implements OnInit {
      const key =
        attachment.key != null
          ? attachment.key
-          : await this.cryptoService.getOrgKey(this.cipher.organizationId);
+          : await this.keyService.getOrgKey(this.cipher.organizationId);
      const decBuf = await this.encryptService.decryptToBytes(encBuf, key);
      this.fileDownloadService.download({
        fileName: attachment.fileName,
@@ -250,7 +250,7 @@ export class AttachmentsComponent implements OnInit {
          const key =
            attachment.key != null
              ? attachment.key
-              : await this.cryptoService.getOrgKey(this.cipher.organizationId);
+              : await this.keyService.getOrgKey(this.cipher.organizationId);
          const decBuf = await this.encryptService.decryptToBytes(encBuf, key);
          const activeUserId = await firstValueFrom(
            this.accountService.activeAccount$.pipe(map((a) => a?.id)),
--- a/libs/angular/src/vault/components/folder-add-edit.component.ts
+++ b/libs/angular/src/vault/components/folder-add-edit.component.ts
@@ -3,7 +3,6 @@ import { Validators, FormBuilder } from "@angular/forms";
 import { firstValueFrom } from "rxjs";

 import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
-import { CryptoService } from "@bitwarden/common/platform/abstractions/crypto.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
 import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
@@ -11,6 +10,7 @@ import { FolderApiServiceAbstraction } from "@bitwarden/common/vault/abstraction
 import { FolderService } from "@bitwarden/common/vault/abstractions/folder/folder.service.abstraction";
 import { FolderView } from "@bitwarden/common/vault/models/view/folder.view";
 import { DialogService } from "@bitwarden/components";
+import { KeyService } from "@bitwarden/key-management";

@Directive()
 export class FolderAddEditComponent implements OnInit {
@@ -33,7 +33,7 @@ export class FolderAddEditComponent implements OnInit {
    protected folderService: FolderService,
    protected folderApiService: FolderApiServiceAbstraction,
    protected accountService: AccountService,
-    protected cryptoService: CryptoService,
+    protected keyService: KeyService,
    protected i18nService: I18nService,
    protected platformUtilsService: PlatformUtilsService,
    protected logService: LogService,
@@ -58,7 +58,7 @@ export class FolderAddEditComponent implements OnInit {

    try {
      const activeAccountId = await firstValueFrom(this.accountService.activeAccount$);
-      const userKey = await this.cryptoService.getUserKeyWithLegacySupport(activeAccountId.id);
+      const userKey = await this.keyService.getUserKeyWithLegacySupport(activeAccountId.id);
      const folder = await this.folderService.encrypt(this.folder, userKey);
      this.formPromise = this.folderApiService.save(folder);
      await this.formPromise;
--- a/libs/angular/src/vault/components/view.component.ts
+++ b/libs/angular/src/vault/components/view.component.ts
@@ -20,7 +20,6 @@ import { BillingAccountProfileStateService } from "@bitwarden/common/billing/abs
 import { EventType } from "@bitwarden/common/enums";
 import { ErrorResponse } from "@bitwarden/common/models/response/error.response";
 import { BroadcasterService } from "@bitwarden/common/platform/abstractions/broadcaster.service";
-import { CryptoService } from "@bitwarden/common/platform/abstractions/crypto.service";
 import { EncryptService } from "@bitwarden/common/platform/abstractions/encrypt.service";
 import { FileDownloadService } from "@bitwarden/common/platform/abstractions/file-download/file-download.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
@@ -40,6 +39,7 @@ import { CipherView } from "@bitwarden/common/vault/models/view/cipher.view";
 import { FolderView } from "@bitwarden/common/vault/models/view/folder.view";
 import { CipherAuthorizationService } from "@bitwarden/common/vault/services/cipher-authorization.service";
 import { DialogService } from "@bitwarden/components";
+import { KeyService } from "@bitwarden/key-management";
 import { PasswordRepromptService } from "@bitwarden/vault";

 const BroadcasterSubscriptionId = "ViewComponent";
@@ -91,7 +91,7 @@ export class ViewComponent implements OnDestroy, OnInit {
    protected totpService: TotpService,
    protected tokenService: TokenService,
    protected i18nService: I18nService,
-    protected cryptoService: CryptoService,
+    protected keyService: KeyService,
    protected encryptService: EncryptService,
    protected platformUtilsService: PlatformUtilsService,
    protected auditService: AuditService,
@@ -449,7 +449,7 @@ export class ViewComponent implements OnDestroy, OnInit {
      const key =
        attachment.key != null
          ? attachment.key
-          : await this.cryptoService.getOrgKey(this.cipher.organizationId);
+          : await this.keyService.getOrgKey(this.cipher.organizationId);
      const decBuf = await this.encryptService.decryptToBytes(encBuf, key);
      this.fileDownloadService.download({
        fileName: attachment.fileName,