Add test and update enrollment function

Author: quexten

crates/bitwarden-core/src/key_management/crypto.rs

@@ -579,42 +579,69 @@ pub(super) fn verify_asymmetric_keys(
     })
 }
 
-/// A new signing key pair along with the signed public key
+///
 #[derive(Serialize, Deserialize, Debug, JsonSchema)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 #[cfg_attr(feature = "uniffi", derive(uniffi::Record))]
 #[cfg_attr(feature = "wasm", derive(Tsify), tsify(into_wasm_abi, from_wasm_abi))]
-pub struct MakeUserSigningKeysResponse {
-    /// Base64 encoded verifying key
-    verifying_key: String,
-    /// Signing key, encrypted with the user's symmetric key
-    signing_key: EncString,
+pub struct EnrollUserCryptoV2Response {
+    /// User key
+    user_key: String,
+
+    /// Wrapped private key
+    private_key: EncString,
+    /// Public key
+    public_key: String,
     /// The user's public key, signed by the signing key
     signed_public_key: SignedPublicKey,
+
+    /// Signing key, encrypted with the user's symmetric key
+    signing_key: EncString,
+    /// Base64 encoded verifying key
+    verifying_key: String,
+
     /// The user's signed security state
     signed_security_state: SignedSecurityState,
 }
 
-/// Makes a new set of signing keys for a user, which should only be done during
-/// once. This also signs the public key with the signing key
-/// and returns the signed public key.
-pub fn make_user_signing_keys_for_enrollment(
+/// Initializes the user's cryptographic state for v2 users.
+/// If the client already contains a v1 user, then this user's private-key will be
+/// re-used.
+pub fn make_keys_for_user_crypto_v2(
     client: &Client,
-) -> Result<MakeUserSigningKeysResponse, CryptoError> {
+) -> Result<EnrollUserCryptoV2Response, CryptoError> {
     let key_store = client.internal.get_key_store();
     let mut ctx = key_store.context();
 
-    // Make new keypair and sign the public key with it
-    let signature_keypair = SigningKey::make(SignatureAlgorithm::Ed25519);
-    let temporary_signature_keypair_id = SigningKeyId::Local("temporary_key_for_rotation");
+    let temporary_user_key_id = SymmetricKeyId::Local("temporary_user_key");
+    let temporary_signing_key_id = SigningKeyId::Local("temporary_signing_key");
+    let temporary_private_key_id = AsymmetricKeyId::Local("temporary_private_key");
+
+    // If the user already has a private key, use it. Otherwise, create a temporary one.
+    let private_key_id = if ctx.has_asymmetric_key(AsymmetricKeyId::UserPrivateKey) {
+        AsymmetricKeyId::UserPrivateKey
+    } else {
+        ctx.make_asymmetric_key(temporary_private_key_id)?
+    };
+
+    // New user key
+    let user_key = SymmetricCryptoKey::make_xchacha20_poly1305_key();
     #[allow(deprecated)]
-    ctx.set_signing_key(temporary_signature_keypair_id, signature_keypair.clone())?;
-    let signed_public_key = ctx.make_signed_public_key(
-        AsymmetricKeyId::UserPrivateKey,
-        temporary_signature_keypair_id,
-    )?;
+    ctx.set_symmetric_key(temporary_user_key_id, user_key.clone())?;
+
+    // New signing key
+    let signing_key = SigningKey::make(SignatureAlgorithm::Ed25519);
+    #[allow(deprecated)]
+    ctx.set_signing_key(temporary_signing_key_id, signing_key.clone())?;
+
+    // Sign existing public key
+    let signed_public_key = ctx.make_signed_public_key(private_key_id, temporary_signing_key_id)?;
+    #[allow(deprecated)]
+    let public_key = ctx
+        .dangerous_get_asymmetric_key(private_key_id)?
+        .to_public_key();
 
-    // Make signed security state
+    // Initialize security state for the user
     let security_state = bitwarden_crypto::security_state::SecurityState::initialize_for_user(
         client
             .internal
@@ -623,17 +650,28 @@ pub fn make_user_signing_keys_for_enrollment(
     );
     let signed_security_state = bitwarden_crypto::security_state::sign(
         &security_state,
-        temporary_signature_keypair_id,
+        temporary_signing_key_id,
         &mut ctx,
     )?;
-    Ok(MakeUserSigningKeysResponse {
-        verifying_key: STANDARD.encode(signature_keypair.to_verifying_key().to_cose()),
+
+    Ok(EnrollUserCryptoV2Response {
+        user_key: user_key.to_base64(),
+
+        #[allow(deprecated)]
+        private_key: ctx
+            .dangerous_get_asymmetric_key(private_key_id)?
+            .to_der()?
+            .encrypt(&mut ctx, temporary_user_key_id)?,
+        public_key: STANDARD.encode(public_key.to_der()?),
+        signed_public_key,
+
         // This needs to be changed to use the correct COSE content format before rolling out to
         // users: https://bitwarden.atlassian.net/browse/PM-22189
-        signing_key: signature_keypair
+        signing_key: signing_key
             .to_cose()
-            .encrypt(&mut ctx, SymmetricKeyId::User)?,
-        signed_public_key,
+            .encrypt(&mut ctx, temporary_user_key_id)?,
+        verifying_key: STANDARD.encode(signing_key.to_verifying_key().to_cose()),
+
         signed_security_state,
     })
 }
@@ -866,6 +904,68 @@ mod tests {
         assert_eq!(client_key, client3_key);
     }
 
+    #[tokio::test]
+    async fn test_user_crypto_v2() {
+        let client = Client::new(None);
+
+        let priv_key: EncString = "2.kmLY8NJVuiKBFJtNd/ZFpA==|qOodlRXER+9ogCe3yOibRHmUcSNvjSKhdDuztLlucs10jLiNoVVVAc+9KfNErLSpx5wmUF1hBOJM8zwVPjgQTrmnNf/wuDpwiaCxNYb/0v4FygPy7ccAHK94xP1lfqq7U9+tv+/yiZSwgcT+xF0wFpoxQeNdNRFzPTuD9o4134n8bzacD9DV/WjcrXfRjbBCzzuUGj1e78+A7BWN7/5IWLz87KWk8G7O/W4+8PtEzlwkru6Wd1xO19GYU18oArCWCNoegSmcGn7w7NDEXlwD403oY8Oa7ylnbqGE28PVJx+HLPNIdSC6YKXeIOMnVs7Mctd/wXC93zGxAWD6ooTCzHSPVV50zKJmWIG2cVVUS7j35H3rGDtUHLI+ASXMEux9REZB8CdVOZMzp2wYeiOpggebJy6MKOZqPT1R3X0fqF2dHtRFPXrNsVr1Qt6bS9qTyO4ag1/BCvXF3P1uJEsI812BFAne3cYHy5bIOxuozPfipJrTb5WH35bxhElqwT3y/o/6JWOGg3HLDun31YmiZ2HScAsUAcEkA4hhoTNnqy4O2s3yVbCcR7jF7NLsbQc0MDTbnjxTdI4VnqUIn8s2c9hIJy/j80pmO9Bjxp+LQ9a2hUkfHgFhgHxZUVaeGVth8zG2kkgGdrp5VHhxMVFfvB26Ka6q6qE/UcS2lONSv+4T8niVRJz57qwctj8MNOkA3PTEfe/DP/LKMefke31YfT0xogHsLhDkx+mS8FCc01HReTjKLktk/Jh9mXwC5oKwueWWwlxI935ecn+3I2kAuOfMsgPLkoEBlwgiREC1pM7VVX1x8WmzIQVQTHd4iwnX96QewYckGRfNYWz/zwvWnjWlfcg8kRSe+68EHOGeRtC5r27fWLqRc0HNcjwpgHkI/b6czerCe8+07TWql4keJxJxhBYj3iOH7r9ZS8ck51XnOb8tGL1isimAJXodYGzakwktqHAD7MZhS+P02O+6jrg7d+yPC2ZCuS/3TOplYOCHQIhnZtR87PXTUwr83zfOwAwCyv6KP84JUQ45+DItrXLap7nOVZKQ5QxYIlbThAO6eima6Zu5XHfqGPMNWv0bLf5+vAjIa5np5DJrSwz9no/hj6CUh0iyI+SJq4RGI60lKtypMvF6MR3nHLEHOycRUQbZIyTHWl4QQLdHzuwN9lv10ouTEvNr6sFflAX2yb6w3hlCo7oBytH3rJekjb3IIOzBpeTPIejxzVlh0N9OT5MZdh4sNKYHUoWJ8mnfjdM+L4j5Q2Kgk/XiGDgEebkUxiEOQUdVpePF5uSCE+TPav/9FIRGXGiFn6NJMaU7aBsDTFBLloffFLYDpd8/bTwoSvifkj7buwLYM+h/qcnfdy5FWau1cKav+Blq/ZC0qBpo658RTC8ZtseAFDgXoQZuksM10hpP9bzD04Bx30xTGX81QbaSTNwSEEVrOtIhbDrj9OI43KH4O6zLzK+t30QxAv5zjk10RZ4+5SAdYndIlld9Y62opCfPDzRy3ubdve4ZEchpIKWTQvIxq3T5ogOhGaWBVYnkMtM2GVqvWV//46gET5SH/MdcwhACUcZ9kCpMnWH9CyyUwYvTT3UlNyV+DlS27LMPvaw7tx7qa+GfNCoCBd8S4esZpQYK/WReiS8=|pc7qpD42wxyXemdNPuwxbh8iIaryrBPu8f/DGwYdHTw=".parse().unwrap();
+        let encrypted_userkey: EncString =  "2.u2HDQ/nH2J7f5tYHctZx6Q==|NnUKODz8TPycWJA5svexe1wJIz2VexvLbZh2RDfhj5VI3wP8ZkR0Vicvdv7oJRyLI1GyaZDBCf9CTBunRTYUk39DbZl42Rb+Xmzds02EQhc=|rwuo5wgqvTJf3rgwOUfabUyzqhguMYb3sGBjOYqjevc=".parse().unwrap();
+
+        initialize_user_crypto(
+            &client,
+            InitUserCryptoRequest {
+                user_id: Some(uuid::Uuid::new_v4()),
+                kdf_params: Kdf::PBKDF2 {
+                    iterations: 100_000.try_into().unwrap(),
+                },
+                email: "[email protected]".into(),
+                private_key: priv_key,
+                signing_key: None,
+                security_state: None,
+                method: InitUserCryptoMethod::Password {
+                    password: "asdfasdfasdf".into(),
+                    user_key: encrypted_userkey.clone(),
+                },
+            },
+        )
+        .await
+        .unwrap();
+
+        let master_key = MasterKey::derive(
+            "asdfasdfasdf",
+            "[email protected]",
+            &Kdf::PBKDF2 {
+                iterations: NonZeroU32::new(100_000).unwrap(),
+            },
+        )
+        .unwrap();
+        let enrollment_response = make_keys_for_user_crypto_v2(&client).unwrap();
+        let encrypted_userkey_v2 = master_key
+            .encrypt_user_key(&SymmetricCryptoKey::try_from(enrollment_response.user_key).unwrap())
+            .unwrap();
+
+        let client2 = Client::new(None);
+        initialize_user_crypto(
+            &client2,
+            InitUserCryptoRequest {
+                user_id: Some(uuid::Uuid::new_v4()),
+                kdf_params: Kdf::PBKDF2 {
+                    iterations: 100_000.try_into().unwrap(),
+                },
+                email: "[email protected]".into(),
+                private_key: enrollment_response.private_key,
+                signing_key: Some(enrollment_response.signing_key),
+                security_state: Some(enrollment_response.signed_security_state),
+                method: InitUserCryptoMethod::Password {
+                    password: "asdfasdfasdf".into(),
+                    user_key: encrypted_userkey_v2,
+                },
+            },
+        )
+        .await
+        .unwrap();
+    }
+
     #[test]
     fn test_enroll_admin_password_reset() {
         use base64::{engine::general_purpose::STANDARD, Engine};

crates/bitwarden-core/src/key_management/crypto_client.rs

@@ -5,10 +5,9 @@ use bitwarden_crypto::{EncString, UnsignedSharedKey};
 use wasm_bindgen::prelude::*;
 
 use super::crypto::{
-    derive_key_connector, make_key_pair, make_user_signing_keys_for_enrollment,
-    verify_asymmetric_keys, DeriveKeyConnectorError, DeriveKeyConnectorRequest,
-    EnrollAdminPasswordResetError, MakeKeyPairResponse, MakeUserSigningKeysResponse,
-    VerifyAsymmetricKeysRequest, VerifyAsymmetricKeysResponse,
+    derive_key_connector, make_key_pair, verify_asymmetric_keys, DeriveKeyConnectorError,
+    DeriveKeyConnectorRequest, EnrollAdminPasswordResetError, EnrollUserCryptoV2Response,
+    MakeKeyPairResponse, VerifyAsymmetricKeysRequest, VerifyAsymmetricKeysResponse,
 };
 #[cfg(feature = "internal")]
 use crate::key_management::crypto::{
@@ -18,7 +17,9 @@ use crate::key_management::crypto::{
 };
 use crate::{
     client::encryption_settings::EncryptionSettingsError,
-    key_management::crypto::{get_v2_rotated_account_keys, CryptoClientError},
+    key_management::crypto::{
+        get_v2_rotated_account_keys, make_keys_for_user_crypto_v2, CryptoClientError,
+    },
     Client,
 };
 
@@ -65,10 +66,8 @@ impl CryptoClient {
     }
 
     /// Makes a new signing key pair and signs the public key for the user
-    pub fn make_user_signing_keys_for_enrollment(
-        &self,
-    ) -> Result<MakeUserSigningKeysResponse, CryptoError> {
-        make_user_signing_keys_for_enrollment(&self.client)
+    pub fn make_keys_for_user_crypto_v2(&self) -> Result<EnrollUserCryptoV2Response, CryptoError> {
+        make_keys_for_user_crypto_v2(&self.client)
     }
 
     /// Creates a rotated set of account keys for the current state

crates/bitwarden-crypto/src/store/context.rs

@@ -9,9 +9,9 @@ use zeroize::Zeroizing;
 use super::KeyStoreInner;
 use crate::{
     derive_shareable_key, error::UnsupportedOperation, signing, store::backend::StoreBackend,
-    AsymmetricCryptoKey, CryptoError, EncString, KeyId, KeyIds, Result, Signature,
-    SignatureAlgorithm, SignedObject, SignedPublicKey, SignedPublicKeyMessage, SigningKey,
-    SymmetricCryptoKey, UnsignedSharedKey,
+    AsymmetricCryptoKey, CryptoError, EncString, KeyId, KeyIds, PublicKeyEncryptionAlgorithm,
+    Result, Signature, SignatureAlgorithm, SignedObject, SignedPublicKey, SignedPublicKeyMessage,
+    SigningKey, SymmetricCryptoKey, UnsignedSharedKey,
 };
 
 /// The context of a crypto operation using [super::KeyStore]
@@ -265,6 +265,15 @@ impl<Ids: KeyIds> KeyStoreContext<'_, Ids> {
         Ok(key_id)
     }
 
+    /// Makes a new asymmetric encryption key using the current default algorithm, and stores it in the
+    /// context
+    pub fn make_asymmetric_key(&mut self, key_id: Ids::Asymmetric) -> Result<Ids::Asymmetric> {
+        let key = AsymmetricCryptoKey::make(PublicKeyEncryptionAlgorithm::RsaOaepSha1);
+        #[allow(deprecated)]
+        self.set_asymmetric_key(key_id, key)?;
+        Ok(key_id)
+    }
+
     /// Generate a new signature key using the current default algorithm, and store it in the
     /// context
     pub fn make_signing_key(&mut self, key_id: Ids::Signing) -> Result<Ids::Signing> {