bitwarden/browser
1
0
Fork 0
mirror of https://github.com/bitwarden/browser synced 2025-12-17 00:33:44 +00:00
Code Issues Releases Wiki Activity

[PM-17900] Add cose / xchacha20poly1305 migration on userkey rotation (#14539)

Browse Source 
* Add new encrypt service functions

* Undo changes

* Cleanup

* Fix build

* Fix comments

* Switch encrypt service to use SDK functions

* Add cose migration on userkey rotation

* Update sdk

* Set featureflag to default disabled

* Add tests

* Update sdk to build 168

* Make changes according to feedback
This commit is contained in:
Bernd Schoolmann
2025-05-20 21:25:14 +02:00
committed by GitHub
parent 7641dab0f0
commit d7c936e1ea
8 changed files with 133 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
libs/common/src/platform/models/domain/symmetric-crypto-key.ts
View File

@@ -16,13 +16,19 @@ export type Aes256CbcKey = {
encryptionKey: Uint8Array;
};
export type CoseKey = {
type: EncryptionType.CoseEncrypt0;
// Encryption key here refers to the cose-encoded and padded key. This MAY later be refactored to contain the actual key bytes, as is the case in the SDK
encryptionKey: Uint8Array;
};
/**
* A symmetric crypto key represents a symmetric key usable for symmetric encryption and decryption operations.
* The specific algorithm used is private to the key, and should only be exposed to encrypt service implementations.
* This can be done via `inner()`.
*/
export class SymmetricCryptoKey {
private innerKey: Aes256CbcHmacKey | Aes256CbcKey;
private innerKey: Aes256CbcHmacKey | Aes256CbcKey | CoseKey;
keyB64: string;
@@ -47,6 +53,12 @@ export class SymmetricCryptoKey {
authenticationKey: key.slice(32),
};
this.keyB64 = this.toBase64();
} else if (key.byteLength > 64) {
this.innerKey = {
type: EncryptionType.CoseEncrypt0,
encryptionKey: key,
};
this.keyB64 = this.toBase64();
} else {
throw new Error(`Unsupported encType/key length ${key.byteLength}`);
}
@@ -63,7 +75,7 @@ export class SymmetricCryptoKey {
*
* @returns The inner key instance that can be directly used for encryption primitives
*/
inner(): Aes256CbcHmacKey | Aes256CbcKey {
inner(): Aes256CbcHmacKey | Aes256CbcKey | CoseKey {
return this.innerKey;
}
@@ -90,6 +102,8 @@ export class SymmetricCryptoKey {
encodedKey.set(this.innerKey.encryptionKey, 0);
encodedKey.set(this.innerKey.authenticationKey, 32);
return encodedKey;
} else if (this.innerKey.type === EncryptionType.CoseEncrypt0) {
return this.innerKey.encryptionKey;
} else {
throw new Error("Unsupported encryption type.");
}