Skip to content

Commit 7fa725f

Browse files
quextenquexten
committed
Implement security context
1 parent 7a1ae93 commit 7fa725f

File tree

24 files changed

+656
-104
lines changed

24 files changed

+656
-104
lines changed

‎crates/bitwarden-core/src/auth/auth_request.rs

Lines changed: 20 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -164,7 +164,7 @@ mod tests {
164164
let private_key ="2.yN7l00BOlUE0Sb0M//Q53w==|EwKG/BduQRQ33Izqc/ogoBROIoI5dmgrxSo82sgzgAMIBt3A2FZ9vPRMY+GWT85JiqytDitGR3TqwnFUBhKUpRRAq4x7rA6A1arHrFp5Tp1p21O3SfjtvB3quiOKbqWk6ZaU1Np9HwqwAecddFcB0YyBEiRX3VwF2pgpAdiPbSMuvo2qIgyob0CUoC/h4Bz1be7Qa7B0Xw9/fMKkB1LpOm925lzqosyMQM62YpMGkjMsbZz0uPopu32fxzDWSPr+kekNNyLt9InGhTpxLmq1go/pXR2uw5dfpXc5yuta7DB0EGBwnQ8Vl5HPdDooqOTD9I1jE0mRyuBpWTTI3FRnu3JUh3rIyGBJhUmHqGZvw2CKdqHCIrQeQkkEYqOeJRJVdBjhv5KGJifqT3BFRwX/YFJIChAQpebNQKXe/0kPivWokHWwXlDB7S7mBZzhaAPidZvnuIhalE2qmTypDwHy22FyqV58T8MGGMchcASDi/QXI6kcdpJzPXSeU9o+NC68QDlOIrMVxKFeE7w7PvVmAaxEo0YwmuAzzKy9QpdlK0aab/xEi8V4iXj4hGepqAvHkXIQd+r3FNeiLfllkb61p6WTjr5urcmDQMR94/wYoilpG5OlybHdbhsYHvIzYoLrC7fzl630gcO6t4nM24vdB6Ymg9BVpEgKRAxSbE62Tqacxqnz9AcmgItb48NiR/He3n3ydGjPYuKk/ihZMgEwAEZvSlNxYONSbYrIGDtOY+8Nbt6KiH3l06wjZW8tcmFeVlWv+tWotnTY9IqlAfvNVTjtsobqtQnvsiDjdEVtNy/s2ci5TH+NdZluca2OVEr91Wayxh70kpM6ib4UGbfdmGgCo74gtKvKSJU0rTHakQ5L9JlaSDD5FamBRyI0qfL43Ad9qOUZ8DaffDCyuaVyuqk7cz9HwmEmvWU3VQ+5t06n/5kRDXttcw8w+3qClEEdGo1KeENcnXCB32dQe3tDTFpuAIMLqwXs6FhpawfZ5kPYvLPczGWaqftIs/RXJ/EltGc0ugw2dmTLpoQhCqrcKEBDoYVk0LDZKsnzitOGdi9mOWse7Se8798ib1UsHFUjGzISEt6upestxOeupSTOh0v4+AjXbDzRUyogHww3V+Bqg71bkcMxtB+WM+pn1XNbVTyl9NR040nhP7KEf6e9ruXAtmrBC2ah5cFEpLIot77VFZ9ilLuitSz+7T8n1yAh1IEG6xxXxninAZIzi2qGbH69O5RSpOJuJTv17zTLJQIIc781JwQ2TTwTGnx5wZLbffhCasowJKd2EVcyMJyhz6ru0PvXWJ4hUdkARJs3Xu8dus9a86N8Xk6aAPzBDqzYb1vyFIfBxP0oO8xFHgd30Cgmz8UrSE3qeWRrF8ftrI6xQnFjHBGWD/JWSvd6YMcQED0aVuQkuNW9ST/DzQThPzRfPUoiL10yAmV7Ytu4fR3x2sF0Yfi87YhHFuCMpV/DsqxmUizyiJuD938eRcH8hzR/VO53Qo3UIsqOLcyXtTv6THjSlTopQ+JOLOnHm1w8dzYbLN44OG44rRsbihMUQp+wUZ6bsI8rrOnm9WErzkbQFbrfAINdoCiNa6cimYIjvvnMTaFWNymqY1vZxGztQiMiHiHYwTfwHTXrb9j0uPM=|09J28iXv9oWzYtzK2LBT6Yht4IT4MijEkk0fwFdrVQ4=".parse().unwrap();
165165
client
166166
.internal
167-
.initialize_user_crypto_master_key(master_key, user_key, private_key, None)
167+
.initialize_user_crypto_master_key(master_key, user_key, private_key, None, None)
168168
.unwrap();
169169

170170
let public_key = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvyLRDUwXB4BfQ507D4meFPmwn5zwy3IqTPJO4plrrhnclWahXa240BzyFW9gHgYu+Jrgms5xBfRTBMcEsqqNm7+JpB6C1B6yvnik0DpJgWQw1rwvy4SUYidpR/AWbQi47n/hvnmzI/sQxGddVfvWu1iTKOlf5blbKYAXnUE5DZBGnrWfacNXwRRdtP06tFB0LwDgw+91CeLSJ9py6dm1qX5JIxoO8StJOQl65goLCdrTWlox+0Jh4xFUfCkb+s3px+OhSCzJbvG/hlrSRcUz5GnwlCEyF3v5lfUtV96MJD+78d8pmH6CfFAp2wxKRAbGdk+JccJYO6y6oIXd3Fm7twIDAQAB";
@@ -175,15 +175,16 @@ mod tests {
175175
let fingerprint = fingerprint("[email protected]", &pubkey).unwrap();
176176
assert_eq!(fingerprint, "childless-unfair-prowler-dropbox-designate");
177177

178-
approve_auth_request(&client, public_key.to_owned()).unwrap();
178+
approve_auth_request(&client, public_key.to_owned().into()).unwrap();
179179
}
180180

181181
#[tokio::test]
182182
async fn test_decrypt_user_key() {
183183
let private_key = "MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCzLtEUdxfcLxDj84yaGFsVF5hZ8Hjlb08NMQDy1RnBma06I3ZESshLYzVz4r/gegMn9OOltfV/Yxlyvida8oW6qdlfJ7AVz6Oa8pV7BiL40C7b76+oqraQpyYw2HChANB1AhXL9SqWngKmLZwjA7qiCrmcc0kZHeOb4KnKtp9iVvPVs+8veFvKgYO4ba2AAOHKFdR0W55/agXfAy+fWUAkC8mc9ikyJdQWaPV6OZvC2XFkOseBQm9Rynudh3BQpoWiL6w620efe7t5k+02/EyOFJL9f/XEEjM/+Yo0t3LAfkuhHGeKiRST59Xc9hTEmyJTeVXROtz+0fjqOp3xkaObAgMBAAECggEACs4xhnO0HaZhh1/iH7zORMIRXKeyxP2LQiTR8xwN5JJ9wRWmGAR9VasS7EZFTDidIGVME2u/h4s5EqXnhxfO+0gGksVvgNXJ/qw87E8K2216g6ZNo6vSGA7H1GH2voWwejJ4/k/cJug6dz2S402rRAKh2Wong1arYHSkVlQp3diiMa5FHAOSE+Cy09O2ZsaF9IXQYUtlW6AVXFrBEPYH2kvkaPXchh8VETMijo6tbvoKLnUHe+wTaDMls7hy8exjtVyI59r3DNzjy1lNGaGb5QSnFMXR+eHhPZc844Wv02MxC15zKABADrl58gpJyjTl6XpDdHCYGsmGpVGH3X9TQQKBgQDz/9beFjzq59ve6rGwn+EtnQfSsyYT+jr7GN8lNEXb3YOFXBgPhfFIcHRh2R00Vm9w2ApfAx2cd8xm2I6HuvQ1Os7g26LWazvuWY0Qzb+KaCLQTEGH1RnTq6CCG+BTRq/a3J8M4t38GV5TWlzv8wr9U4dl6FR4efjb65HXs1GQ4QKBgQC7/uHfrOTEHrLeIeqEuSl0vWNqEotFKdKLV6xpOvNuxDGbgW4/r/zaxDqt0YBOXmRbQYSEhmO3oy9J6XfE1SUln0gbavZeW0HESCAmUIC88bDnspUwS9RxauqT5aF8ODKN/bNCWCnBM1xyonPOs1oT1nyparJVdQoG//Y7vkB3+wKBgBqLqPq8fKAp3XfhHLfUjREDVoiLyQa/YI9U42IOz9LdxKNLo6p8rgVthpvmnRDGnpUuS+KOWjhdqDVANjF6G3t3DG7WNl8Rh5Gk2H4NhFswfSkgQrjebFLlBy9gjQVCWXt8KSmjvPbiY6q52Aaa8IUjA0YJAregvXxfopxO+/7BAoGARicvEtDp7WWnSc1OPoj6N14VIxgYcI7SyrzE0d/1x3ffKzB5e7qomNpxKzvqrVP8DzG7ydh8jaKPmv1MfF8tpYRy3AhmN3/GYwCnPqT75YYrhcrWcVdax5gmQVqHkFtIQkRSCIftzPLlpMGKha/YBV8c1fvC4LD0NPh/Ynv0gtECgYEAyOZg95/kte0jpgUEgwuMrzkhY/AaUJULFuR5MkyvReEbtSBQwV5tx60+T95PHNiFooWWVXiLMsAgyI2IbkxVR1Pzdri3gWK5CTfqb7kLuaj/B7SGvBa2Sxo478KS5K8tBBBWkITqo+wLC0mn3uZi1dyMWO1zopTA+KtEGF2dtGQ=";
184184

185185
let enc_user_key = "4.dxbd5OMwi/Avy7DQxvLV+Z7kDJgHBtg/jAbgYNO7QU0Zii4rLFNco2lS5aS9z42LTZHc2p5HYwn2ZwkZNfHsQ6//d5q40MDgGYJMKBXOZP62ZHhct1XsvYBmtcUtIOm5j2HSjt2pjEuGAc1LbyGIWRJJQ3Lp1ULbL2m71I+P23GF36JyOM8SUWvpvxE/3+qqVhRFPG2VqMCYa2kLLxwVfUmpV+KKjX1TXsrq6pfJIwHNwHw4h7MSfD8xTy2bx4MiBt638Z9Vt1pGsSQkh9RgPvCbnhuCpZQloUgJ8ByLVEcrlKx3yaaxiQXvte+ZhuOI7rGdjmoVoOzisooje4JgYw==".parse().unwrap();
186-
let dec = auth_request_decrypt_user_key(private_key.to_owned(), enc_user_key).unwrap();
186+
let dec =
187+
auth_request_decrypt_user_key(private_key.to_owned().into(), enc_user_key).unwrap();
187188

188189
assert_eq!(
189190
&dec.to_encoded().to_vec(),
@@ -200,9 +201,12 @@ mod tests {
200201

201202
let enc_master_key = "4.dxbd5OMwi/Avy7DQxvLV+Z7kDJgHBtg/jAbgYNO7QU0Zii4rLFNco2lS5aS9z42LTZHc2p5HYwn2ZwkZNfHsQ6//d5q40MDgGYJMKBXOZP62ZHhct1XsvYBmtcUtIOm5j2HSjt2pjEuGAc1LbyGIWRJJQ3Lp1ULbL2m71I+P23GF36JyOM8SUWvpvxE/3+qqVhRFPG2VqMCYa2kLLxwVfUmpV+KKjX1TXsrq6pfJIwHNwHw4h7MSfD8xTy2bx4MiBt638Z9Vt1pGsSQkh9RgPvCbnhuCpZQloUgJ8ByLVEcrlKx3yaaxiQXvte+ZhuOI7rGdjmoVoOzisooje4JgYw==".parse().unwrap();
202203
let enc_user_key = "2.Q/2PhzcC7GdeiMHhWguYAQ==|GpqzVdr0go0ug5cZh1n+uixeBC3oC90CIe0hd/HWA/pTRDZ8ane4fmsEIcuc8eMKUt55Y2q/fbNzsYu41YTZzzsJUSeqVjT8/iTQtgnNdpo=|dwI+uyvZ1h/iZ03VQ+/wrGEFYVewBUUl/syYgjsNMbE=".parse().unwrap();
203-
let dec =
204-
auth_request_decrypt_master_key(private_key.to_owned(), enc_master_key, enc_user_key)
205-
.unwrap();
204+
let dec = auth_request_decrypt_master_key(
205+
private_key.to_owned().into(),
206+
enc_master_key,
207+
enc_user_key,
208+
)
209+
.unwrap();
206210

207211
assert_eq!(
208212
&dec.to_encoded().to_vec(),
@@ -232,15 +236,22 @@ mod tests {
232236

233237
existing_device
234238
.internal
235-
.initialize_user_crypto_master_key(master_key, user_key, private_key.clone(), None)
239+
.initialize_user_crypto_master_key(
240+
master_key,
241+
user_key,
242+
private_key.clone(),
243+
None,
244+
None,
245+
)
236246
.unwrap();
237247

238248
// Initialize a new device which will request to be logged in
239249
let new_device = Client::new(None);
240250

241251
// Initialize an auth request, and approve it on the existing device
242252
let auth_req = new_auth_request(email).unwrap();
243-
let approved_req = approve_auth_request(&existing_device, auth_req.public_key).unwrap();
253+
let approved_req =
254+
approve_auth_request(&existing_device, auth_req.public_key.into()).unwrap();
244255

245256
// Unlock the vault using the approved request
246257
new_device
@@ -251,6 +262,7 @@ mod tests {
251262
email: email.to_owned(),
252263
private_key,
253264
signing_key: None,
265+
security_state: None,
254266
method: InitUserCryptoMethod::AuthRequest {
255267
request_private_key: auth_req.private_key,
256268
method: AuthRequestMethod::UserKey {

‎crates/bitwarden-core/src/auth/login/api_key.rs

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ pub(crate) async fn login_api_key(
5656
user_key,
5757
private_key,
5858
None,
59+
None,
5960
)?;
6061
}
6162

‎crates/bitwarden-core/src/auth/login/auth_request.rs

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,7 @@ pub(crate) async fn complete_auth_request(
121121
email: auth_req.email,
122122
private_key: require!(r.private_key).parse()?,
123123
signing_key: None,
124+
security_state: None,
124125
method: InitUserCryptoMethod::AuthRequest {
125126
request_private_key: auth_req.private_key,
126127
method,

‎crates/bitwarden-core/src/auth/login/password.rs

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,7 @@ pub(crate) async fn login_password(
5555
user_key,
5656
private_key,
5757
None,
58+
None,
5859
)?;
5960
}
6061

‎crates/bitwarden-core/src/auth/password/validate.rs

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,7 @@ mod tests {
145145
user_key.parse().unwrap(),
146146
private_key,
147147
None,
148+
None,
148149
)
149150
.unwrap();
150151

@@ -193,6 +194,7 @@ mod tests {
193194
user_key.parse().unwrap(),
194195
private_key,
195196
None,
197+
None,
196198
)
197199
.unwrap();
198200

‎crates/bitwarden-core/src/auth/pin.rs

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,7 @@ mod tests {
8080
user_key.parse().unwrap(),
8181
private_key,
8282
None,
83+
None,
8384
)
8485
.unwrap();
8586

‎crates/bitwarden-core/src/auth/tde.rs

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,10 @@
1-
use base64::{engine::general_purpose::STANDARD, Engine};
21
use bitwarden_crypto::{
32
AsymmetricPublicCryptoKey, DeviceKey, EncString, Kdf, SpkiPublicKeyBytes, SymmetricCryptoKey,
43
TrustDeviceResponse, UnsignedSharedKey, UserKey,
54
};
65

6+
use base64::{engine::general_purpose::STANDARD, Engine};
7+
78
use crate::{client::encryption_settings::EncryptionSettingsError, Client};
89

910
/// This function generates a new user key and key pair, initializes the client's crypto with the
@@ -45,6 +46,7 @@ pub(super) fn make_register_tde_keys(
4546
// Note: Signing keys are not supported on registration yet. This needs to be changed as
4647
// soon as registration is supported.
4748
None,
49+
None,
4850
)?;
4951

5052
Ok(RegisterTdeKeyResponse {

‎crates/bitwarden-core/src/client/encryption_settings.rs

Lines changed: 77 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
#[cfg(feature = "internal")]
2-
use bitwarden_crypto::{EncString, UnsignedSharedKey};
2+
use bitwarden_crypto::{security_state::SignedSecurityState, EncString, UnsignedSharedKey};
3+
use bitwarden_crypto::{CryptoError, Pkcs8PrivateKeyBytes};
34
#[cfg(any(feature = "internal", feature = "secrets"))]
45
use bitwarden_crypto::{KeyStore, SymmetricCryptoKey};
56
use bitwarden_error::bitwarden_error;
@@ -30,6 +31,9 @@ pub enum EncryptionSettingsError {
3031
#[error("Invalid signing key")]
3132
InvalidSigningKey,
3233

34+
#[error("Invalid security state")]
35+
InvalidSecurityState,
36+
3337
#[error(transparent)]
3438
MissingPrivateKey(#[from] MissingPrivateKeyError),
3539

@@ -50,49 +54,85 @@ impl EncryptionSettings {
5054
user_key: SymmetricCryptoKey,
5155
private_key: EncString,
5256
signing_key: Option<EncString>,
57+
security_state: Option<SignedSecurityState>,
5358
store: &KeyStore<KeyIds>,
5459
) -> Result<(), EncryptionSettingsError> {
55-
use bitwarden_crypto::{AsymmetricCryptoKey, CoseSerializable, KeyDecryptable, SigningKey};
60+
use bitwarden_crypto::{AsymmetricCryptoKey, KeyDecryptable};
5661
use log::warn;
5762

58-
use crate::key_management::{AsymmetricKeyId, SigningKeyId, SymmetricKeyId};
59-
60-
let private_key = {
61-
let dec: Vec<u8> = private_key.decrypt_with_key(&user_key)?;
62-
// FIXME: [PM-11690] - Temporarily ignore invalid private keys until we have a recovery
63-
// process in place.
64-
AsymmetricCryptoKey::from_der(&dec.into())
65-
.map_err(|_| {
66-
warn!("Invalid private key");
67-
})
68-
.ok()
69-
70-
// Some(
71-
// AsymmetricCryptoKey::from_der(&dec)
72-
// .map_err(|_| EncryptionSettingsError::InvalidPrivateKey)?,
73-
// )
74-
};
75-
let signing_key = signing_key
76-
.map(|key| {
77-
use bitwarden_crypto::CryptoError;
78-
79-
let dec: Vec<u8> = key.decrypt_with_key(&user_key)?;
80-
SigningKey::from_cose(&dec.into()).map_err(Into::<CryptoError>::into)
81-
})
82-
.transpose()?;
83-
84-
// FIXME: [PM-18098] When this is part of crypto we won't need to use deprecated methods
85-
#[allow(deprecated)]
86-
{
87-
let mut ctx = store.context_mut();
88-
ctx.set_symmetric_key(SymmetricKeyId::User, user_key)?;
89-
if let Some(private_key) = private_key {
63+
use crate::key_management::{AsymmetricKeyId, SymmetricKeyId};
64+
65+
// This is an all-or-nothing check. The server cannot pretend a signing key or security
66+
// state to be missing, because they are *always* present when the user key is an
67+
// XChaCha20Poly1305Key. Thus, the server or network cannot lie about the presence of these,
68+
// because otherwise the entire user account will fail to decrypt.
69+
let is_v2_user = matches!(user_key, SymmetricCryptoKey::XChaCha20Poly1305Key(_));
70+
if is_v2_user {
71+
// For v2 users, we mandate the signing key and security state to be present
72+
// The private key must also be valid.
73+
74+
use bitwarden_crypto::{
75+
security_state::SecurityState, CoseKeyBytes, CoseSerializable, SigningKey,
76+
};
77+
78+
// Both of these are required for v2 users
79+
let signing_key = signing_key.ok_or(EncryptionSettingsError::Crypto(
80+
CryptoError::SecurityDowngrade("Signing key is required for v2 users".to_string()),
81+
))?;
82+
let security_state = security_state.ok_or(EncryptionSettingsError::Crypto(
83+
CryptoError::SecurityDowngrade(
84+
"Security state is required for v2 users".to_string(),
85+
),
86+
))?;
87+
88+
// Everything MUST decrypt.
89+
let signing_key: Vec<u8> = signing_key.decrypt_with_key(&user_key)?;
90+
let signing_key = SigningKey::from_cose(&CoseKeyBytes::from(signing_key))
91+
.map_err(|_| EncryptionSettingsError::InvalidSigningKey)?;
92+
let private_key: Vec<u8> = private_key.decrypt_with_key(&user_key)?;
93+
let private_key =
94+
AsymmetricCryptoKey::from_der(&Pkcs8PrivateKeyBytes::from(private_key))
95+
.map_err(|_| EncryptionSettingsError::InvalidPrivateKey)?;
96+
let _security_state: SecurityState = security_state
97+
.verify_and_unwrap(&signing_key.to_verifying_key())
98+
.map_err(|_| EncryptionSettingsError::InvalidSecurityState)?;
99+
100+
#[allow(deprecated)]
101+
{
102+
use crate::key_management::SigningKeyId;
103+
104+
let mut ctx = store.context_mut();
105+
ctx.set_symmetric_key(SymmetricKeyId::User, user_key)?;
90106
ctx.set_asymmetric_key(AsymmetricKeyId::UserPrivateKey, private_key)?;
91-
}
92-
93-
if let Some(signing_key) = signing_key {
94107
ctx.set_signing_key(SigningKeyId::UserSigningKey, signing_key)?;
95108
}
109+
} else {
110+
let private_key = {
111+
let dec: Vec<u8> = private_key.decrypt_with_key(&user_key)?;
112+
113+
// FIXME: [PM-11690] - Temporarily ignore invalid private keys until we have a
114+
// recovery process in place.
115+
AsymmetricCryptoKey::from_der(&Pkcs8PrivateKeyBytes::from(dec))
116+
.map_err(|_| {
117+
warn!("Invalid private key");
118+
})
119+
.ok()
120+
121+
// Some(
122+
// AsymmetricCryptoKey::from_der(&dec)
123+
// .map_err(|_| EncryptionSettingsError::InvalidPrivateKey)?,
124+
// )
125+
};
126+
127+
// FIXME: [PM-18098] When this is part of crypto we won't need to use deprecated methods
128+
#[allow(deprecated)]
129+
{
130+
let mut ctx = store.context_mut();
131+
ctx.set_symmetric_key(SymmetricKeyId::User, user_key)?;
132+
if let Some(private_key) = private_key {
133+
ctx.set_asymmetric_key(AsymmetricKeyId::UserPrivateKey, private_key)?;
134+
}
135+
}
96136
}
97137

98138
Ok(())

‎crates/bitwarden-core/src/client/internal.rs

Lines changed: 26 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,9 @@ use bitwarden_crypto::KeyStore;
44
#[cfg(any(feature = "internal", feature = "secrets"))]
55
use bitwarden_crypto::SymmetricCryptoKey;
66
#[cfg(feature = "internal")]
7-
use bitwarden_crypto::{EncString, Kdf, MasterKey, PinKey, UnsignedSharedKey};
7+
use bitwarden_crypto::{
8+
security_state::SignedSecurityState, EncString, Kdf, MasterKey, PinKey, UnsignedSharedKey,
9+
};
810
#[cfg(feature = "internal")]
911
use bitwarden_state::registry::StateRegistry;
1012
use chrono::Utc;
@@ -217,9 +219,16 @@ impl InternalClient {
217219
user_key: EncString,
218220
private_key: EncString,
219221
signing_key: Option<EncString>,
222+
security_state: Option<SignedSecurityState>,
220223
) -> Result<(), EncryptionSettingsError> {
221224
let user_key = master_key.decrypt_user_key(user_key)?;
222-
EncryptionSettings::new_decrypted_key(user_key, private_key, signing_key, &self.key_store)?;
225+
EncryptionSettings::new_decrypted_key(
226+
user_key,
227+
private_key,
228+
signing_key,
229+
security_state,
230+
&self.key_store,
231+
)?;
223232

224233
Ok(())
225234
}
@@ -230,8 +239,15 @@ impl InternalClient {
230239
user_key: SymmetricCryptoKey,
231240
private_key: EncString,
232241
signing_key: Option<EncString>,
242+
security_state: Option<SignedSecurityState>,
233243
) -> Result<(), EncryptionSettingsError> {
234-
EncryptionSettings::new_decrypted_key(user_key, private_key, signing_key, &self.key_store)?;
244+
EncryptionSettings::new_decrypted_key(
245+
user_key,
246+
private_key,
247+
signing_key,
248+
security_state,
249+
&self.key_store,
250+
)?;
235251

236252
Ok(())
237253
}
@@ -243,9 +259,15 @@ impl InternalClient {
243259
pin_protected_user_key: EncString,
244260
private_key: EncString,
245261
signing_key: Option<EncString>,
262+
security_state: Option<SignedSecurityState>,
246263
) -> Result<(), EncryptionSettingsError> {
247264
let decrypted_user_key = pin_key.decrypt_user_key(pin_protected_user_key)?;
248-
self.initialize_user_crypto_decrypted_key(decrypted_user_key, private_key, signing_key)
265+
self.initialize_user_crypto_decrypted_key(
266+
decrypted_user_key,
267+
private_key,
268+
signing_key,
269+
security_state,
270+
)
249271
}
250272

251273
#[cfg(feature = "secrets")]

0 commit comments

Comments
 (0)