diff --git a/Cargo.lock b/Cargo.lock index 1dd0d0b..e85f4a0 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -24,11 +24,44 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9e8b47f52ea9bae42228d07ec09eb676433d7c4ed1ebdf0f1d1c29ed446f1ab8" dependencies = [ "cfg-if", - "cipher", + "cipher 0.3.0", "cpufeatures", "opaque-debug", ] +[[package]] +name = "aes" +version = "0.8.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0" +dependencies = [ + "cfg-if", + "cipher 0.4.4", + "cpufeatures", + "zeroize", +] + +[[package]] +name = "aes-gcm-stream" +version = "0.2.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "163d1209787b2226543db17d317f5e9f5f54fd0d0f20834318f92013ebd78f37" +dependencies = [ + "aes 0.8.4", + "cipher 0.4.4", + "ghash", + "zeroize", +] + +[[package]] +name = "aes-kw" +version = "0.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "69fa2b352dcefb5f7f3a5fb840e02665d311d878955380515e4fd50095dd3d8c" +dependencies = [ + "aes 0.8.4", +] + [[package]] name = "ahash" version = "0.8.11" @@ -41,15 +74,6 @@ dependencies = [ "zerocopy", ] -[[package]] -name = "aho-corasick" -version = "1.1.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916" -dependencies = [ - "memchr", -] - [[package]] name = "android-tzdata" version = "0.1.1" @@ -112,6 +136,12 @@ dependencies = [ "windows-targets 0.52.6", ] +[[package]] +name = "base16ct" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf" + [[package]] name = "base64" version = "0.21.7" @@ -119,10 +149,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567" [[package]] -name = "base64" -version = "0.22.1" +name = "base64ct" +version = "1.6.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6" +checksum = "8c3c1a368f70d6cf7302d78f8f7093da241fb8e8807c05cc9e51a125895a6d5b" [[package]] name = "bitflags" @@ -161,7 +191,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2cb03d1bed155d89dce0f845b7899b18a9a163e148fd004e1c28421a783e2d8e" dependencies = [ "block-padding", - "cipher", + "cipher 0.3.0", ] [[package]] @@ -226,6 +256,16 @@ dependencies = [ "generic-array", ] +[[package]] +name = "cipher" +version = "0.4.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad" +dependencies = [ + "crypto-common", + "inout", +] + [[package]] name = "clap" version = "2.34.0" @@ -241,6 +281,12 @@ dependencies = [ "vec_map", ] +[[package]] +name = "const-oid" +version = "0.9.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8" + [[package]] name = "core-foundation-sys" version = "0.8.7" @@ -265,6 +311,18 @@ dependencies = [ "cfg-if", ] +[[package]] +name = "crypto-bigint" +version = "0.5.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76" +dependencies = [ + "generic-array", + "rand_core", + "subtle", + "zeroize", +] + [[package]] name = "crypto-common" version = "0.1.6" @@ -277,21 +335,23 @@ dependencies = [ [[package]] name = "crypto-mac" -version = "0.11.1" +version = "0.11.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b1d1a86f49236c215f271d40892d5fc950490551400b02ef360692c29815c714" +checksum = "25fab6889090c8133f3deb8f73ba3c65a7f456f66436fc012a1b1e272b1e103e" dependencies = [ "generic-array", "subtle", ] [[package]] -name = "deranged" -version = "0.3.11" +name = "der" +version = "0.7.9" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b42b6fa04a440b495c8b04d0e71b707c585f83cb9cb28cf8cd0d976c315e31b4" +checksum = "f55bf8e7b65898637379c1b74eb1551107c8294ed26d855ceb9fd1a09cfc9bc0" dependencies = [ - "powerfmt", + "const-oid", + "pem-rfc7468", + "zeroize", ] [[package]] @@ -310,6 +370,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292" dependencies = [ "block-buffer 0.10.4", + "const-oid", "crypto-common", ] @@ -334,6 +395,24 @@ dependencies = [ "winapi", ] +[[package]] +name = "elliptic-curve" +version = "0.13.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47" +dependencies = [ + "base16ct", + "crypto-bigint", + "digest 0.10.7", + "ff", + "generic-array", + "group", + "rand_core", + "sec1", + "subtle", + "zeroize", +] + [[package]] name = "equivalent" version = "1.0.1" @@ -383,6 +462,16 @@ version = "0.1.9" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7360491ce676a36bf9bb3c56c1aa791658183a54d2744120f27285738d90465a" +[[package]] +name = "ff" +version = "0.13.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ded41244b729663b1e574f1b4fb731469f69f79c17667b5d776b16cda0479449" +dependencies = [ + "rand_core", + "subtle", +] + [[package]] name = "flate2" version = "1.0.34" @@ -399,21 +488,6 @@ version = "1.0.7" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1" -[[package]] -name = "foreign-types" -version = "0.3.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1" -dependencies = [ - "foreign-types-shared", -] - -[[package]] -name = "foreign-types-shared" -version = "0.1.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b" - [[package]] name = "futures-channel" version = "0.3.31" @@ -461,6 +535,7 @@ checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a" dependencies = [ "typenum", "version_check", + "zeroize", ] [[package]] @@ -474,12 +549,33 @@ dependencies = [ "wasi", ] +[[package]] +name = "ghash" +version = "0.5.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f0d8a4362ccb29cb0b265253fb0a2728f592895ee6854fd9bc13f2ffda266ff1" +dependencies = [ + "opaque-debug", + "polyval", +] + [[package]] name = "gimli" version = "0.31.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f" +[[package]] +name = "group" +version = "0.13.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63" +dependencies = [ + "ff", + "rand_core", + "subtle", +] + [[package]] name = "h2" version = "0.3.26" @@ -645,6 +741,15 @@ dependencies = [ "hashbrown 0.15.1", ] +[[package]] +name = "inout" +version = "0.1.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a0c10553d664a4d0bcff9f4215d0aac67a639cc68ef660840afe309b807bc9f5" +dependencies = [ + "generic-array", +] + [[package]] name = "io-lifetimes" version = "0.7.5" @@ -658,21 +763,39 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b" [[package]] -name = "josekit" -version = "0.8.7" +name = "jose-b64" +version = "0.1.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "54b85e2125819afc4fd2ae57416207e792c7e12797858e5db2a6c6f24a166829" +checksum = "bec69375368709666b21c76965ce67549f2d2db7605f1f8707d17c9656801b56" dependencies = [ - "anyhow", - "base64 0.22.1", - "flate2", - "once_cell", - "openssl", - "regex", + "base64ct", "serde", - "serde_json", - "thiserror", - "time", + "subtle", + "zeroize", +] + +[[package]] +name = "jose-jwa" +version = "0.1.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9ab78e053fe886a351d67cf0d194c000f9d0dcb92906eb34d853d7e758a4b3a7" +dependencies = [ + "serde", +] + +[[package]] +name = "jose-jwk" +version = "0.1.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "280fa263807fe0782ecb6f2baadc28dffc04e00558a58e33bfdb801d11fd58e7" +dependencies = [ + "jose-b64", + "jose-jwa", + "p256", + "p384", + "rsa", + "serde", + "zeroize", ] [[package]] @@ -689,6 +812,9 @@ name = "lazy_static" version = "1.5.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe" +dependencies = [ + "spin", +] [[package]] name = "libc" @@ -696,6 +822,12 @@ version = "0.2.162" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "18d287de67fe55fd7e1581fe933d965a5a9477b38e949cfa9f8574ef01506398" +[[package]] +name = "libm" +version = "0.2.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8355be11b20d696c8f18f6cc018c4e372165b1fa8126cef092399c9951984ffa" + [[package]] name = "libredox" version = "0.1.3" @@ -742,17 +874,20 @@ checksum = "78b3ae25bc7c8c38cec158d1f2757ee79e9b3740fbc7ccf0e59e4b08d793fa89" [[package]] name = "local-mini-kms" -version = "0.3.7" +version = "1.0.0" dependencies = [ - "base64 0.21.7", + "aes-gcm-stream", + "aes-kw", + "base64", "clap", "hex", "hyper", - "josekit", + "jose-jwk", "lazy_static", "procfs", "rand", "rpassword", + "rsa", "rusqlite", "rust_util", "seckey", @@ -760,6 +895,7 @@ dependencies = [ "serde", "serde_derive", "serde_json", + "sha1", "sha2", "tokio", "yubico_manager", @@ -821,10 +957,41 @@ dependencies = [ ] [[package]] -name = "num-conv" -version = "0.1.0" +name = "num-bigint-dig" +version = "0.8.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9" +checksum = "dc84195820f291c7697304f3cbdadd1cb7199c0efc917ff5eafd71225c136151" +dependencies = [ + "byteorder", + "lazy_static", + "libm", + "num-integer", + "num-iter", + "num-traits", + "rand", + "smallvec", + "zeroize", +] + +[[package]] +name = "num-integer" +version = "0.1.46" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f" +dependencies = [ + "num-traits", +] + +[[package]] +name = "num-iter" +version = "0.1.45" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1429034a0490724d0075ebb2bc9e875d6503c3cf69e235a8941aa757d83ef5bf" +dependencies = [ + "autocfg", + "num-integer", + "num-traits", +] [[package]] name = "num-traits" @@ -833,6 +1000,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841" dependencies = [ "autocfg", + "libm", ] [[package]] @@ -857,41 +1025,23 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381" [[package]] -name = "openssl" -version = "0.10.68" +name = "p256" +version = "0.13.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6174bc48f102d208783c2c84bf931bb75927a617866870de8a4ea85597f871f5" +checksum = "c9863ad85fa8f4460f9c48cb909d38a0d689dba1f6f6988a5e3e0d31071bcd4b" dependencies = [ - "bitflags 2.6.0", - "cfg-if", - "foreign-types", - "libc", - "once_cell", - "openssl-macros", - "openssl-sys", + "elliptic-curve", + "primeorder", ] [[package]] -name = "openssl-macros" -version = "0.1.1" +name = "p384" +version = "0.13.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c" +checksum = "70786f51bcc69f6a4c0360e063a4cac5419ef7c5cd5b3c99ad70f3be5ba79209" dependencies = [ - "proc-macro2", - "quote 1.0.37", - "syn", -] - -[[package]] -name = "openssl-sys" -version = "0.9.104" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "45abf306cbf99debc8195b66b7346498d7b10c210de50418b5ccd7ceba08c741" -dependencies = [ - "cc", - "libc", - "pkg-config", - "vcpkg", + "elliptic-curve", + "primeorder", ] [[package]] @@ -917,6 +1067,15 @@ dependencies = [ "windows-targets 0.52.6", ] +[[package]] +name = "pem-rfc7468" +version = "0.7.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412" +dependencies = [ + "base64ct", +] + [[package]] name = "pin-project-lite" version = "0.2.15" @@ -929,6 +1088,27 @@ version = "0.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184" +[[package]] +name = "pkcs1" +version = "0.7.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f" +dependencies = [ + "der", + "pkcs8", + "spki", +] + +[[package]] +name = "pkcs8" +version = "0.10.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7" +dependencies = [ + "der", + "spki", +] + [[package]] name = "pkg-config" version = "0.3.31" @@ -936,10 +1116,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "953ec861398dccce10c670dfeaf3ec4911ca479e9c02154b3a215178c5f566f2" [[package]] -name = "powerfmt" -version = "0.2.0" +name = "polyval" +version = "0.6.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391" +checksum = "9d1fe60d06143b2430aa532c94cfe9e29783047f06c0d7fd359a9a51b729fa25" +dependencies = [ + "cfg-if", + "cpufeatures", + "opaque-debug", + "universal-hash", +] [[package]] name = "ppv-lite86" @@ -950,6 +1136,15 @@ dependencies = [ "zerocopy", ] +[[package]] +name = "primeorder" +version = "0.13.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "353e1ca18966c16d9deb1c69278edbc5f194139612772bd9537af60ac231e1e6" +dependencies = [ + "elliptic-curve", +] + [[package]] name = "proc-macro-hack" version = "0.4.3" @@ -1054,35 +1249,6 @@ dependencies = [ "thiserror", ] -[[package]] -name = "regex" -version = "1.11.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b544ef1b4eac5dc2db33ea63606ae9ffcfac26c1416a2806ae0bf5f56b201191" -dependencies = [ - "aho-corasick", - "memchr", - "regex-automata", - "regex-syntax", -] - -[[package]] -name = "regex-automata" -version = "0.4.9" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "809e8dc61f6de73b46c85f4c96486310fe304c434cfa43669d7b40f711150908" -dependencies = [ - "aho-corasick", - "memchr", - "regex-syntax", -] - -[[package]] -name = "regex-syntax" -version = "0.8.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c" - [[package]] name = "rpassword" version = "7.3.1" @@ -1094,6 +1260,26 @@ dependencies = [ "windows-sys 0.48.0", ] +[[package]] +name = "rsa" +version = "0.9.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5d0e5124fcb30e76a7e79bfee683a2746db83784b86289f6251b54b7950a0dfc" +dependencies = [ + "const-oid", + "digest 0.10.7", + "num-bigint-dig", + "num-integer", + "num-traits", + "pkcs1", + "pkcs8", + "rand_core", + "signature", + "spki", + "subtle", + "zeroize", +] + [[package]] name = "rtoolbox" version = "0.0.2" @@ -1194,6 +1380,19 @@ version = "1.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49" +[[package]] +name = "sec1" +version = "0.7.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc" +dependencies = [ + "base16ct", + "der", + "generic-array", + "subtle", + "zeroize", +] + [[package]] name = "seckey" version = "0.12.1" @@ -1243,7 +1442,6 @@ version = "1.0.132" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d726bfaff4b320266d395898905d0eba0345aae23b54aee3a737e260fd46db03" dependencies = [ - "indexmap", "itoa", "memchr", "ryu", @@ -1263,6 +1461,17 @@ dependencies = [ "opaque-debug", ] +[[package]] +name = "sha1" +version = "0.10.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba" +dependencies = [ + "cfg-if", + "cpufeatures", + "digest 0.10.7", +] + [[package]] name = "sha2" version = "0.10.8" @@ -1289,6 +1498,16 @@ dependencies = [ "libc", ] +[[package]] +name = "signature" +version = "2.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de" +dependencies = [ + "digest 0.10.7", + "rand_core", +] + [[package]] name = "slab" version = "0.4.9" @@ -1314,6 +1533,22 @@ dependencies = [ "windows-sys 0.52.0", ] +[[package]] +name = "spin" +version = "0.9.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67" + +[[package]] +name = "spki" +version = "0.7.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d" +dependencies = [ + "base64ct", + "der", +] + [[package]] name = "strsim" version = "0.8.0" @@ -1343,9 +1578,9 @@ dependencies = [ [[package]] name = "subtle" -version = "2.4.1" +version = "2.6.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6bdef32e8150c2a081110b42772ffe7d7c9032b606bc226c8260fd97e0976601" +checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292" [[package]] name = "syn" @@ -1408,25 +1643,6 @@ dependencies = [ "syn", ] -[[package]] -name = "time" -version = "0.3.36" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885" -dependencies = [ - "deranged", - "num-conv", - "powerfmt", - "serde", - "time-core", -] - -[[package]] -name = "time-core" -version = "0.1.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3" - [[package]] name = "tokio" version = "1.41.1" @@ -1518,6 +1734,16 @@ version = "0.1.14" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7dd6e30e90baa6f72411720665d41d89b9a3d039dc45b8faea1ddd07f617f6af" +[[package]] +name = "universal-hash" +version = "0.5.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea" +dependencies = [ + "crypto-common", + "subtle", +] + [[package]] name = "vcpkg" version = "0.2.15" @@ -1873,7 +2099,7 @@ version = "0.9.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ff64094218f27836b8683bd93fa7f257475d217449eb7629746fa8eaee068eee" dependencies = [ - "aes", + "aes 0.7.5", "bitflags 1.3.2", "block-modes", "hmac", @@ -1909,3 +2135,18 @@ name = "zeroize" version = "1.8.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ced3678a2879b30306d323f4542626697a464a97c0a07c9aebf7ebca65cd4dde" +dependencies = [ + "serde", + "zeroize_derive", +] + +[[package]] +name = "zeroize_derive" +version = "1.4.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ce36e65b0d2999d2aafac989fb249189a141aee1f53c612c1f37d72631959f69" +dependencies = [ + "proc-macro2", + "quote 1.0.37", + "syn", +] diff --git a/Cargo.toml b/Cargo.toml index eac8e55..8998eee 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "local-mini-kms" -version = "0.3.7" +version = "1.0.0" edition = "2021" # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html @@ -19,7 +19,6 @@ lazy_static = "1.5" serde_derive = "1.0" serde = { version = "1.0", features = ["derive"] } serde_json = "1.0" -josekit = "0.8" secmem-proc = "0.3" seckey = "0.12" rust_util = { version = "0.6", features = ["use_clap"] } @@ -29,6 +28,11 @@ rusqlite = "0.31" yubico_manager = { version = "0.9", optional = true } rpassword = "7.3" rand = "0.8" +rsa = "0.9" +aes-kw = { version = "0.2", features = ["alloc"] } +sha1 = "0.10" +aes-gcm-stream = "0.2" +jose-jwk = "0.1" [target.'cfg(target_os = "linux")'.dependencies] procfs = "0.13" diff --git a/src/cli.rs b/src/cli.rs index a2f9610..53f850a 100644 --- a/src/cli.rs +++ b/src/cli.rs @@ -1,16 +1,16 @@ use std::io::Write; -use base64::Engine; use base64::engine::general_purpose::STANDARD; +use base64::Engine; use clap::{App, Arg, ArgMatches, SubCommand}; -use hyper::{Body, Client, Method, Request, Response, StatusCode}; use hyper::body::Buf; -use josekit::jwk::Jwk; -use rust_util::{debugging, opt_value_result, simple_error, success, XResult}; +use hyper::{Body, Client, Method, Request, Response, StatusCode}; use rust_util::util_clap::{Command, CommandError}; +use rust_util::{debugging, opt_value_result, simple_error, success, XResult}; use serde_json::{json, Map, Value}; use crate::jose; +use crate::jose::jwk_to_rsa_pubic_key; pub struct CommandImpl; @@ -138,7 +138,7 @@ async fn do_read(_arg_matches: &ArgMatches<'_>, sub_arg_matches: &ArgMatches<'_> return simple_error!("Require key"); }; let data = do_inner_request(sub_arg_matches, "read", &body).await?; - success!("Value: {}", serde_json::to_string_pretty(&data)?); + println!("{}", serde_json::to_string_pretty(&data)?); Ok(Some(0)) } @@ -209,8 +209,8 @@ fn do_offline_init(_arg_matches: &ArgMatches<'_>, _sub_arg_matches: &ArgMatches< line.as_bytes().to_vec() }; let jwk = read_line("Input JWK: ")?; - let jwk = Jwk::from_bytes(jwk.as_bytes())?; - let encrypted_master_key = jose::serialize_jwe_rsa(&master_key, &jwk)?; + let rsa_public_key = jwk_to_rsa_pubic_key(&jwk)?; + let encrypted_master_key = jose::serialize_jwe_rsa(&master_key, &rsa_public_key)?; success!("Encrypted master key: {}", encrypted_master_key); Ok(Some(0)) diff --git a/src/jose.rs b/src/jose.rs index eaf0021..39c479e 100644 --- a/src/jose.rs +++ b/src/jose.rs @@ -1,44 +1,184 @@ -use josekit::jwe; -use josekit::jwe::alg::aeskw::AeskwJweAlgorithm; -use josekit::jwe::alg::rsaes::RsaesJweAlgorithm; -use josekit::jwe::JweHeader; -use josekit::jwk::alg::rsa::RsaKeyPair; -use josekit::jwk::Jwk; -use rust_util::XResult; -use serde_json::Value; +use aes_gcm_stream::{Aes256GcmStreamDecryptor, Aes256GcmStreamEncryptor}; +use aes_kw::Kek; +use base64::engine::general_purpose::URL_SAFE_NO_PAD; +use base64::Engine; +use jose_jwk::{Key, Rsa}; +use rand::{random, thread_rng}; +use rsa::pkcs1::LineEnding; +use rsa::pkcs8::EncodePublicKey; +use rsa::{Oaep, RsaPrivateKey, RsaPublicKey}; +use rust_util::{opt_result, simple_error, XResult}; +use serde_derive::{Deserialize, Serialize}; +use sha1::Sha1; use sha2::{Digest, Sha256}; const LOCAL_KMS_PREFIX: &str = "LKMS:"; +const JWE_ENC_A256GCM: &str = "A256GCM"; +const JWE_ALG_A256KW: &str = "A256KW"; +const JWE_ALG_RSA_OAEP: &str = "RSA-OAEP"; +const JWE_DOT: &str = "."; -pub fn generate_rsa_key(bits: u32) -> XResult { - Ok(RsaKeyPair::generate(bits)?) +#[derive(Debug, Serialize, Deserialize)] +pub struct JweHeader { + pub enc: String, + pub alg: String, + pub vendor: String, + pub version: Option, } -pub fn serialize_jwe_rsa(payload: &[u8], jwk: &Jwk) -> XResult { - let mut header = JweHeader::new(); - header.set_content_encryption("A256GCM"); - header.set_claim("vendor", Some(Value::String("local-mini-kms".to_string())))?; - let encrypter = RsaesJweAlgorithm::RsaOaep.encrypter_from_jwk(jwk)?; - Ok(format!("{}{}", LOCAL_KMS_PREFIX, jwe::serialize_compact(payload, &header, &encrypter)?)) +pub fn generate_rsa_key(bits: u32) -> XResult { + let mut rng = thread_rng(); + Ok(RsaPrivateKey::new(&mut rng, bits as usize)?) } -pub fn deserialize_jwe_rsa(jwe: &str, jwk: &Jwk) -> XResult<(Vec, JweHeader)> { - let decrypter = RsaesJweAlgorithm::RsaOaep.decrypter_from_jwk(jwk)?; - Ok(jwe::deserialize_compact(&get_jwe(jwe), &decrypter)?) +pub fn rsa_key_to_jwk(rsa_private_key: &RsaPrivateKey) -> XResult { + let rsa_public_key = rsa_private_key.as_ref(); + let public_rsa: Rsa = rsa_public_key.into(); + Ok(jose_jwk::Jwk { + key: Key::Rsa(public_rsa), + prm: Default::default(), + }) +} + +pub fn rsa_key_to_pem(rsa_private_key: &RsaPrivateKey) -> XResult { + Ok(rsa_private_key.to_public_key().to_public_key_pem(LineEnding::LF)?) +} + +pub fn jwk_to_rsa_pubic_key(rsa_jwk: &str) -> XResult { + let rsa: Rsa = opt_result!(serde_json::from_str(&rsa_jwk), "Bad RSA JWK: {}, error: {}", rsa_jwk); + let rsa_public_key = opt_result!(RsaPublicKey::try_from(rsa), "Bad RSA JWK: {}, error: {:?}", rsa_jwk); + Ok(rsa_public_key) +} + +pub fn serialize_jwe_rsa(payload: &[u8], rsa_public_key: &RsaPublicKey) -> XResult { + let header = JweHeader { + enc: JWE_ENC_A256GCM.to_string(), + alg: JWE_ALG_RSA_OAEP.to_string(), + vendor: "local-mini-kms".to_string(), + version: None, + }; + serialize_jwe_fn(&header, payload, |data_key| -> XResult> { + let mut r = thread_rng(); + Ok(opt_result!(rsa_public_key.encrypt(&mut r, Oaep::new::(), data_key), "Wrap key failed: {}")) + }) +} + +pub fn deserialize_jwe_rsa(jwe: &str, rsa: &RsaPrivateKey) -> XResult<(Vec, JweHeader)> { + deserialize_jwe_fn(jwe, |alg, key_wrap| -> XResult> { + if alg != JWE_ALG_RSA_OAEP { + return simple_error!("Invalid JWE header alg: {}", alg); + } + Ok(opt_result!(rsa.decrypt(Oaep::new::(), &key_wrap), "Unwrap key failed: {}")) + }) } pub fn serialize_jwe_aes(payload: &[u8], key: &[u8]) -> XResult { - let mut header = JweHeader::new(); - header.set_content_encryption("A256GCM"); - header.set_claim("vendor", Some(Value::String("local-mini-kms".to_string())))?; - header.set_claim("version", Some(Value::String(get_master_key_checksum(key))))?; - let encrypter = AeskwJweAlgorithm::A256kw.encrypter_from_bytes(key)?; - Ok(format!("{}{}", LOCAL_KMS_PREFIX, jwe::serialize_compact(payload, &header, &encrypter)?)) + serialize_jwe_aes_32(payload, to_bytes32(key)?) +} + +pub fn serialize_jwe_aes_32(payload: &[u8], key: [u8; 32]) -> XResult { + let header = JweHeader { + enc: JWE_ENC_A256GCM.to_string(), + alg: JWE_ALG_A256KW.to_string(), + vendor: "local-mini-kms".to_string(), + version: Some(get_master_key_checksum(&key)), + }; + serialize_jwe_fn(&header, payload, |data_key| -> XResult> { + let kek = Kek::from(key); + Ok(opt_result!(kek.wrap_vec(&data_key[..]), "Wrap key failed: {}")) + }) } pub fn deserialize_jwe_aes(jwe: &str, key: &[u8]) -> XResult<(Vec, JweHeader)> { - let decrypter = AeskwJweAlgorithm::A256kw.decrypter_from_bytes(key)?; - Ok(jwe::deserialize_compact(&get_jwe(jwe), &decrypter)?) + deserialize_jwe_aes_32(jwe, to_bytes32(key)?) +} + +pub fn deserialize_jwe_aes_32(jwe: &str, key: [u8; 32]) -> XResult<(Vec, JweHeader)> { + deserialize_jwe_fn(jwe, |alg, key_wrap| -> XResult> { + if alg != JWE_ALG_A256KW { + return simple_error!("Invalid JWE header alg: {}", alg); + } + let kek = Kek::from(key); + Ok(opt_result!(kek.unwrap_vec(&key_wrap), "Unwrap key failed: {}")) + }) +} + +fn serialize_jwe_fn(header: &JweHeader, payload: &[u8], key_wrap_fn: F) -> XResult +where + F: Fn(&[u8]) -> XResult>, +{ + let header_str = opt_result!(serde_json::to_string(&header), "Invalid JWE header: {}"); + let header_b64 = URL_SAFE_NO_PAD.encode(header_str.as_bytes()); + + let data_key: [u8; 32] = random(); + let iv: [u8; 12] = random(); + let mut encryptor = Aes256GcmStreamEncryptor::new(data_key, &iv); + encryptor.init_adata(header_b64.as_bytes()); + let mut ciphertext = encryptor.update(payload); + let (ciphertext_final, tag) = encryptor.finalize(); + ciphertext.extend_from_slice(&ciphertext_final); + + let cek = key_wrap_fn(&data_key)?; + + Ok(format!( + "{}{}.{}.{}.{}.{}", + LOCAL_KMS_PREFIX, + header_b64, + URL_SAFE_NO_PAD.encode(&cek), + URL_SAFE_NO_PAD.encode(&iv), + URL_SAFE_NO_PAD.encode(&ciphertext), + URL_SAFE_NO_PAD.encode(&tag) + )) +} + +fn deserialize_jwe_fn(jwe: &str, key_unwrap_fn: F) -> XResult<(Vec, JweHeader)> +where + F: Fn(&str, &[u8]) -> XResult>, +{ + let jwe = get_jwe(jwe); + let jwe_parts = jwe.split(JWE_DOT).collect::>(); + if jwe_parts.len() != 5 { + return simple_error!("Invalid JWE: {}", jwe); + } + let header_bytes = opt_result!(decode_url_safe_no_pad(jwe_parts[0]), "Invalid JWE header: {}, JWE: {}", jwe); + let header: JweHeader = opt_result!(serde_json::from_slice(&header_bytes), "Invalid JWE header: {}, JWE: {}", jwe); + if header.enc != JWE_ENC_A256GCM { + return simple_error!("Invalid JWE header enc: {}", header.enc); + } + + let cek = opt_result!(decode_url_safe_no_pad(jwe_parts[1]), "Invalid JWE CEK: {}, JWE: {}", jwe); + let iv = opt_result!(decode_url_safe_no_pad(jwe_parts[2]), "Invalid JWE IV: {}, JWE: {}", jwe); + let ciphertext = opt_result!(decode_url_safe_no_pad(jwe_parts[3]), "Invalid JWE ciphertext: {}, JWE: {}", jwe); + let tag = opt_result!(decode_url_safe_no_pad(jwe_parts[4]), "Invalid JWE tag: {}, JWE: {}", jwe); + + let data_key = key_unwrap_fn(&header.alg, &cek)?; + let data_key_b32 = opt_result!(to_bytes32(&data_key), "Invalid JWE CEK: {}, JWE: {}", jwe); + + let mut decryptor = Aes256GcmStreamDecryptor::new(data_key_b32, &iv); + decryptor.init_adata(jwe_parts[0].as_bytes()); + let mut plaintext = decryptor.update(&ciphertext); + let plaintext_2 = decryptor.update(&tag); + let plaintext_final = opt_result!(decryptor.finalize(), "Invalid JWE: {}, JWE: {}", jwe); + plaintext.extend_from_slice(&plaintext_2); + plaintext.extend_from_slice(&plaintext_final); + Ok((plaintext, header)) +} + +#[inline] +fn decode_url_safe_no_pad(s: &str) -> XResult> { + Ok(URL_SAFE_NO_PAD.decode(s.as_bytes())?) +} + +#[inline] +fn to_bytes32(bytes: &[u8]) -> XResult<[u8; 32]> { + if bytes.len() != 32 { + return simple_error!("Not valid 32 bytes"); + } + let mut ret = [0; 32]; + for i in 0..32 { + ret[i] = bytes[i]; + } + Ok(ret) } fn get_master_key_checksum(key: &[u8]) -> String { diff --git a/src/main.rs b/src/main.rs index 03744d6..1f8bd56 100644 --- a/src/main.rs +++ b/src/main.rs @@ -31,6 +31,12 @@ impl DefaultCommandImpl { } fn main() { + if let Err(e) = inner_main() { + failure_and_exit!("Run local-mini-kms error: {}", e); + } +} + +fn harden_process() { let ignore_harden_process_error = std::env::var("IGNORE_HARDEN_PROCESS_ERROR") .map(|v| &v == "true").unwrap_or_else(|_| false); match secmem_proc::harden_process() { @@ -41,9 +47,6 @@ fn main() { } Ok(_) => success!("Harden local-mini-kms success"), } - if let Err(e) = inner_main() { - failure_and_exit!("Run local-mini-kms error: {}", e); - } } fn inner_main() -> CommandError { @@ -72,6 +75,7 @@ fn inner_main() -> CommandError { let matches = app.get_matches(); for command in &commands { if let Some(sub_cmd_matches) = matches.subcommand_matches(command.name()) { + if command.name() == "serve" { harden_process(); } return command.run(&matches, sub_cmd_matches); } } diff --git a/src/serve_common.rs b/src/serve_common.rs index 15083e9..52e3417 100644 --- a/src/serve_common.rs +++ b/src/serve_common.rs @@ -3,7 +3,7 @@ use std::sync::Mutex; use base64::engine::general_purpose::STANDARD; use base64::Engine; use hyper::StatusCode; -use josekit::jwk::alg::rsa::RsaKeyPair; +use rsa::RsaPrivateKey; use rusqlite::Connection; use rust_util::{opt_result, simple_error, XResult}; use seckey::SecBytes; @@ -50,7 +50,7 @@ pub fn error(error: &str) -> XResult<(StatusCode, Value)> { pub struct MemoryKey { pub database_file: String, - pub instance_rsa_key_pair: RsaKeyPair, + pub instance_rsa_key_pair: RsaPrivateKey, pub master_key: Option, } diff --git a/src/serve_init.rs b/src/serve_init.rs index 4c892bf..6dd3c70 100644 --- a/src/serve_init.rs +++ b/src/serve_init.rs @@ -50,7 +50,7 @@ pub async fn inner_init_request(init_request: InitRequest) -> XResult<(StatusCod } else if let Some(encrypted_master_key) = init_request.encrypted_master_key { debugging!("Received encrypted master key: {}", encrypted_master_key); if let Some(k) = &*startup_rw_lock { - let (clear_master_key, _) = jose::deserialize_jwe_rsa(&encrypted_master_key, &k.instance_rsa_key_pair.to_jwk_private_key())?; + let (clear_master_key, _) = jose::deserialize_jwe_rsa(&encrypted_master_key, &k.instance_rsa_key_pair)?; clear_master_key } else { return Ok((StatusCode::INTERNAL_SERVER_ERROR, json!({ "error": "internal_error", "error_message": "not init " }))); diff --git a/src/serve_status.rs b/src/serve_status.rs index 670c8e0..8220ca4 100644 --- a/src/serve_status.rs +++ b/src/serve_status.rs @@ -3,6 +3,7 @@ use rust_util::XResult; use serde_json::{json, Value}; use crate::do_response; +use crate::jose::{rsa_key_to_jwk, rsa_key_to_pem}; use crate::serve_common::{self, Result}; pub async fn status() -> Result> { @@ -16,8 +17,8 @@ async fn inner_status() -> XResult<(StatusCode, Value)> { Some(memory_key) => match memory_key.master_key { None => json!({ "status": "not-ready", - "instance_public_key_jwk": memory_key.instance_rsa_key_pair.to_jwk_key_pair().to_public_key()?, - "instance_public_key_pem": String::from_utf8_lossy(&memory_key.instance_rsa_key_pair.to_pem_public_key()).to_string(), + "instance_public_key_jwk": rsa_key_to_jwk(&memory_key.instance_rsa_key_pair)?, + "instance_public_key_pem": rsa_key_to_pem(&memory_key.instance_rsa_key_pair)?, }), Some(_) => json!({ "status": "ready",