Examples with EncryptionKeyCanary org.cloudfoundry.credhub.entity.EncryptionKeyCanary used on opensource projects

Example 6 with EncryptionKeyCanary

use of org.cloudfoundry.credhub.entity.EncryptionKeyCanary in project credhub by cloudfoundry-incubator.

the class CredentialVersionDataRepositoryTest method beforeEach.

@Before
public void beforeEach() {
    name = "my-credential";
    EncryptionKeyCanary canary = canaryRepository.save(new EncryptionKeyCanary());
    canaryUuid = canary.getUuid();
}

Example 7 with EncryptionKeyCanary

use of org.cloudfoundry.credhub.entity.EncryptionKeyCanary in project credhub by cloudfoundry-incubator.

the class EncryptionKeyCanaryMapperTest method mapUuidsToKeys_whenTheActiveKeyIsTheOnlyKey_whenThereIsNoMatchingCanaryInTheDatabase_whenDecryptingWithTheWrongKeyRaisesAnInternalException_itShouldCreateACanaryForTheKey.

@Test
public void mapUuidsToKeys_whenTheActiveKeyIsTheOnlyKey_whenThereIsNoMatchingCanaryInTheDatabase_whenDecryptingWithTheWrongKeyRaisesAnInternalException_itShouldCreateACanaryForTheKey() throws Exception {
    when(encryptionKeysConfiguration.isKeyCreationEnabled()).thenReturn(true);
    when(encryptionKeysConfiguration.getKeys()).thenReturn(asList(activeKeyData));
    EncryptionKeyCanary nonMatchingCanary = new EncryptionKeyCanary();
    nonMatchingCanary.setUuid(UUID.randomUUID());
    nonMatchingCanary.setEncryptedCanaryValue("fake-non-matching-encrypted-value".getBytes());
    nonMatchingCanary.setNonce("fake-non-matching-nonce".getBytes());
    when(encryptionKeyCanaryDataService.findAll()).thenReturn(asArrayList(nonMatchingCanary));
    when(encryptionService.decrypt(activeKey, nonMatchingCanary.getEncryptedCanaryValue(), nonMatchingCanary.getNonce())).thenThrow(new AEADBadTagException());
    when(encryptionKeyCanaryDataService.save(any(EncryptionKeyCanary.class))).thenReturn(activeKeyCanary);
    subject = new EncryptionKeyCanaryMapper(encryptionKeyCanaryDataService, encryptionKeysConfiguration, timedRetry, providerFactory);
    subject.mapUuidsToKeys(keySet);
    assertCanaryValueWasEncryptedAndSavedToDatabase();
}

Example 8 with EncryptionKeyCanary

use of org.cloudfoundry.credhub.entity.EncryptionKeyCanary in project credhub by cloudfoundry-incubator.

the class EncryptionKeyCanaryMapperTest method mapUuidsToKeys_whenTheActiveKeyIsTheOnlyKey_whenThereIsNoMatchingCanaryInTheDatabase_whenDecryptingWithTheWrongKeyRaisesAnHSMException_throwsTheException.

@Test
public void mapUuidsToKeys_whenTheActiveKeyIsTheOnlyKey_whenThereIsNoMatchingCanaryInTheDatabase_whenDecryptingWithTheWrongKeyRaisesAnHSMException_throwsTheException() throws Exception {
    when(encryptionKeysConfiguration.isKeyCreationEnabled()).thenReturn(true);
    when(encryptionKeysConfiguration.getKeys()).thenReturn(asList(activeKeyData));
    EncryptionKeyCanary nonMatchingCanary = new EncryptionKeyCanary();
    nonMatchingCanary.setUuid(UUID.randomUUID());
    nonMatchingCanary.setEncryptedCanaryValue("fake-non-matching-encrypted-value".getBytes());
    nonMatchingCanary.setNonce("fake-non-matching-nonce".getBytes());
    when(encryptionKeyCanaryDataService.findAll()).thenReturn(asArrayList(nonMatchingCanary));
    when(activeKeyProxy.matchesCanary(nonMatchingCanary)).thenThrow(new RuntimeException(new IllegalBlockSizeException("I don't know what 0x41 means and neither do you")));
    when(encryptionKeyCanaryDataService.save(any(EncryptionKeyCanary.class))).thenReturn(activeKeyCanary);
    subject = new EncryptionKeyCanaryMapper(encryptionKeyCanaryDataService, encryptionKeysConfiguration, timedRetry, providerFactory);
    exception.expectMessage("javax.crypto.IllegalBlockSizeException: I don't know what 0x41 means and neither do you");
    subject.mapUuidsToKeys(keySet);
}

Example 9 with EncryptionKeyCanary

use of org.cloudfoundry.credhub.entity.EncryptionKeyCanary in project credhub by cloudfoundry-incubator.

the class EncryptionKeyCanaryMapper method createCanary.

private EncryptionKeyCanary createCanary(KeyProxy keyProxy, EncryptionService encryptionService) {
    if (encryptionKeysConfiguration.isKeyCreationEnabled()) {
        logger.info("Creating a new active key canary");
        EncryptionKeyCanary canary = new EncryptionKeyCanary();
        try {
            EncryptedValue encryptionData = encryptionService.encrypt(null, keyProxy.getKey(), CANARY_VALUE);
            canary.setEncryptedCanaryValue(encryptionData.getEncryptedValue());
            canary.setNonce(encryptionData.getNonce());
            final List<Byte> salt = keyProxy.getSalt();
            final Byte[] saltArray = new Byte[salt.size()];
            canary.setSalt(toPrimitive(salt.toArray(saltArray)));
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
        return encryptionKeyCanaryDataService.save(canary);
    } else {
        final EncryptionKeyCanary[] matchingCanary = new EncryptionKeyCanary[1];
        timedRetry.retryEverySecondUntil(CANARY_POPULATION_WAIT_SEC, () -> {
            for (EncryptionKeyCanary encryptionKeyCanary : encryptionKeyCanaryDataService.findAll()) {
                if (keyProxy.matchesCanary(encryptionKeyCanary)) {
                    matchingCanary[0] = encryptionKeyCanary;
                    return true;
                }
            }
            logger.info("Waiting for the active key's canary");
            return false;
        });
        if (matchingCanary[0] == null) {
            throw new RuntimeException("Timed out waiting for active key canary to be created");
        }
        return matchingCanary[0];
    }
}

Example 10 with EncryptionKeyCanary

use of org.cloudfoundry.credhub.entity.EncryptionKeyCanary in project credhub by cloudfoundry-incubator.

the class EncryptionKeyCanaryMapper method mapUuidsToKeys.

void mapUuidsToKeys(EncryptionKeySet keySet) throws Exception {
    List<EncryptionKeyCanary> encryptionKeyCanaries = encryptionKeyCanaryDataService.findAll();
    for (EncryptionKeyMetadata keyMetadata : encryptionKeysConfiguration.getKeys()) {
        EncryptionService encryptionService = providerFactory.getEncryptionService(keyMetadata.getProviderType());
        KeyProxy keyProxy = encryptionService.createKeyProxy(keyMetadata);
        EncryptionKeyCanary matchingCanary = null;
        for (EncryptionKeyCanary canary : encryptionKeyCanaries) {
            if (keyProxy.matchesCanary(canary)) {
                matchingCanary = canary;
                break;
            }
        }
        if (matchingCanary == null) {
            if (keyMetadata.isActive()) {
                matchingCanary = createCanary(keyProxy, encryptionService);
            } else {
                continue;
            }
        }
        if (keyMetadata.isActive()) {
            keySet.setActive(matchingCanary.getUuid());
        }
        try {
            keySet.add(new EncryptionKey(providerFactory.getEncryptionService(keyMetadata.getProviderType()), matchingCanary.getUuid(), keyProxy.getKey()));
        } catch (Exception e) {
            throw new RuntimeException("Failed to connect to encryption provider", e);
        }
    }
    if (keySet.getActive() == null) {
        throw new RuntimeException("No active key was found");
    }
}