Merge branch 'RM-3422_improve_pw_decryt_cli' into 'master'

jann0k · jann0k · commit 8831a43ea349 · 2024-07-02T11:47:24.000+03:00
Rm-3422: improve pw decryt cli

See merge request cdoc2/cdoc2-java-ref-impl!22
diff --git a/cdoc2-cli/README.md b/cdoc2-cli/README.md
@@ -66,7 +66,7 @@ Default expiration duration will be used if it is not requested by the client. D
 expiration durations are configurable values in put-server and get-server.
 
 
-### Encryption with symmetric key
+### Encryption with symmetric key and password
 
 Generate key with openssl (minimum length 32 bytes):
 ```
@@ -92,7 +92,7 @@ cat keys/b64secret.option --secret "label_b64secret:base64,aejUgxxSQXqiiyrxSGACf
 
 Or encrypt with password clear text (note, that password also can be encoded to base64 format, as secret):
 ```
-java -jar target/cdoc2-cli-*.jar create --password "passwordlabel:myPlainTextPassword" -f /tmp/symmetric.cdoc README.md
+java -jar target/cdoc2-cli-*.jar create --password "passwordlabel:myPlainTextPassword" -f /tmp/password.cdoc README.md
 ```
 
 Decryption is done with the same label and key used for encryption
@@ -102,9 +102,15 @@ java -jar target/cdoc2-cli-*.jar decrypt @keys/b64secret.option -f /tmp/symmetri
 
 Or with the same label and password used for encryption:
 ```
-java -jar target/cdoc2-cli-*.jar decrypt --password "passwordlabel:myPlainTextPassword" -f /tmp/symmetric.cdoc --output /tmp
+java -jar target/cdoc2-cli-*.jar decrypt --password "passwordlabel:myPlainTextPassword" -f /tmp/password.cdoc --output /tmp
 ```
 
+If cdoc2 file contains only one password, then specifying label is not required and label can be omitted:
+```
+java -jar target/cdoc2-cli-*.jar decrypt --password ":myPlainTextPassword" -f /tmp/password.cdoc --output /tmp
+```
+
+
 Or with the same label and secret used for encryption:
 ```
 java -jar target/cdoc2-cli-*.jar decrypt --secret "label_b64secret:base64,aejUgxxSQXqiiyrxSGACfMiIRBZq5KjlCwr/xVNY/B0=" -f /tmp/symmetric.cdoc --output /tmp
diff --git a/cdoc2-cli/src/main/java/ee/cyber/cdoc2/cli/CDocDecryptionHelper.java b/cdoc2-cli/src/main/java/ee/cyber/cdoc2/cli/CDocDecryptionHelper.java
@@ -34,7 +34,7 @@ public static DecryptionKeyMaterial getDecryptionKeyMaterial(
         String keyAlias
     ) throws GeneralSecurityException, IOException, CDocValidationException, CDocParseException {
         DecryptionKeyMaterial decryptionKm =
-            SymmetricKeyUtil.extractDecryptionKeyMaterialFromSymmetricKey(
+            SymmetricKeyUtil.extractDecryptionKeyMaterial(
                 cdocFile.toPath(), password, secret
             );
 
diff --git a/cdoc2-cli/src/main/java/ee/cyber/cdoc2/cli/InteractiveCommunicationUtil.java b/cdoc2-cli/src/main/java/ee/cyber/cdoc2/cli/InteractiveCommunicationUtil.java
@@ -31,28 +31,32 @@ private InteractiveCommunicationUtil() { }
 
     /**
      * Ask password and label interactively.
+     * @param verifyPw if true then password is asked twice and they must match
      * @return FormattedOptionParts with password chars and label
      * @throws CDocUserException if password wasn't entered
      * @throws IllegalArgumentException if entered passwords don't match
      */
-    public static FormattedOptionParts readPasswordAndLabelInteractively() {
+    public static FormattedOptionParts readPasswordAndLabelInteractively(boolean verifyPw) {
+
         Console console = System.console();
         char[] password = readPasswordInteractively(console, PROMPT_PASSWORD);
         PasswordValidationUtil.validatePassword(password);
 
-        char[] reenteredPassword = readPasswordInteractively(console, PROMPT_PASSWORD_REENTER);
+        if (verifyPw) {
+            char[] reenteredPassword = readPasswordInteractively(console, PROMPT_PASSWORD_REENTER);
 
-        if (!Arrays.equals(password, reenteredPassword)) {
-            log.info("Passwords don't match");
-            throw new IllegalArgumentException("Passwords don't match");
+            if (!Arrays.equals(password, reenteredPassword)) {
+                log.info("Passwords don't match");
+                throw new IllegalArgumentException("Passwords don't match");
+            }
         }
 
         String label = readLabelInteractively(console);
 
         return new FormattedOptionParts(password, label, EncryptionKeyOrigin.PASSWORD);
     }
 
-    private static char[] readPasswordInteractively(Console console, String prompt) throws CDocUserException {
+    public static char[] readPasswordInteractively(Console console, String prompt) throws CDocUserException {
         if (console != null) {
             return console.readPassword(prompt);
         } else { //running from IDE, console is null
diff --git a/cdoc2-cli/src/main/java/ee/cyber/cdoc2/cli/SymmetricKeyUtil.java b/cdoc2-cli/src/main/java/ee/cyber/cdoc2/cli/SymmetricKeyUtil.java
@@ -9,6 +9,7 @@
 import java.util.LinkedList;
 import java.util.List;
 
+import ee.cyber.cdoc2.container.recipients.PBKDF2Recipient;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -23,6 +24,8 @@
 import ee.cyber.cdoc2.crypto.SymmetricKeyTools;
 import ee.cyber.cdoc2.util.PasswordValidationUtil;
 
+import javax.annotation.Nullable;
+
 
 /**
  * Symmetric key usage in CDOC is supported by CDOC format, but its use cases are not finalized.
@@ -38,13 +41,15 @@ public final class SymmetricKeyUtil {
     private static final String SYMMETRIC_KEY_DESCRIPTION = "symmetric key with label. "
         + "Must have format";
 
+    private static final String PW_DESCRIPTION = "password with label. Must have format";
+
     // --secret format description, used in cdoc <cmd> classes
     public static final String SECRET_DESCRIPTION = SYMMETRIC_KEY_DESCRIPTION
         + " <label>:<secret>. <secret> is a base64 encoded binary. "
         + "It must be prefixed with `base64,`";
 
     // --password format description, used in cdoc <cmd> classes
-    public static final String PASSWORD_DESCRIPTION = SYMMETRIC_KEY_DESCRIPTION
+    public static final String PASSWORD_DESCRIPTION = PW_DESCRIPTION
         + " <label>:<password>. <password> can be plain text or base64 "
         + "encoded binary. In case of base64, it must be prefixed with `base64,`";
 
@@ -140,23 +145,64 @@ public static FormattedOptionParts splitFormattedOption(
      * aejUgxxSQXqiiyrxSGACfMiIRBZq5KjlCwr/xVNY/B0="
      * @param formattedPassword formatted as label:password where 2nd param can be base64 encoded
      *                          bytes or regular utf-8 string. Base64 encoded string must be
-     *                          prefixed with 'base64,', followed by base64 string
+     *                          prefixed with 'base64,', followed by base64 string. If "",
+     *                          then password and label are asked interactively.
+     * @param verifyPw if password should be asked twice to verify that they match (encryption).
      * @return FormattedOptionParts with extracted password and label
      */
-    public static FormattedOptionParts getSplitPasswordAndLabel(String formattedPassword)
+    public static FormattedOptionParts getSplitPasswordAndLabel(String formattedPassword,
+                                                                boolean verifyPw)
         throws CDocValidationException {
         FormattedOptionParts passwordAndLabel;
         if (formattedPassword.isEmpty()) {
-            passwordAndLabel = InteractiveCommunicationUtil.readPasswordAndLabelInteractively();
+            passwordAndLabel = InteractiveCommunicationUtil.readPasswordAndLabelInteractively(verifyPw);
         } else {
             passwordAndLabel
                 = splitFormattedOption(formattedPassword, EncryptionKeyOrigin.PASSWORD);
-            PasswordValidationUtil.validatePassword(passwordAndLabel.optionChars());
+
+            if (verifyPw) {
+                PasswordValidationUtil.validatePassword(passwordAndLabel.optionChars());
+            }
         }
 
         return passwordAndLabel;
     }
 
+    /**
+     * Get password for decryption. Ignore user-entered label when there is only one pbkdf  (password) recipient
+     * in CDOC2 header.
+     * @param formattedPassword formatted as label:password where
+     *                          2nd param can be base64 encoded bytes or regular utf-8 string.
+     *                          Base64 encoded string must be
+     *                          prefixed with 'base64,', followed by base64 string. If "",
+     *                          then password and label are asked interactively.
+     * @param pbkdf2Recipients if pbkdf2Recipients.size() == 1 then label is read from CDOC header
+     * @return
+     * @throws CDocValidationException
+     */
+    public static FormattedOptionParts getSplitPasswordAndLabel(String formattedPassword,
+                                                                List<PBKDF2Recipient> pbkdf2Recipients)
+        throws CDocValidationException {
+
+        if (pbkdf2Recipients.size() == 1) {
+            String label = pbkdf2Recipients.get(0).getRecipientKeyLabel();
+            if (formattedPassword.isEmpty()) {
+                char[] pw = InteractiveCommunicationUtil.readPasswordInteractively(System.console(),
+                    InteractiveCommunicationUtil.PROMPT_PASSWORD);
+
+                return new FormattedOptionParts(pw, label, EncryptionKeyOrigin.PASSWORD);
+            } else {
+                FormattedOptionParts parsed =
+                    splitFormattedOption(formattedPassword, EncryptionKeyOrigin.PASSWORD);
+                //overwrite label with recipient label to allow entering password without label for
+                //single pbkdfRecipient eg -pw ":pw"
+                return new FormattedOptionParts(parsed.optionChars(), label, EncryptionKeyOrigin.PASSWORD);
+            }
+        } else {
+            return getSplitPasswordAndLabel(formattedPassword, false);
+        }
+    }
+
     /**
      * Extract decryption key material from formatted secret or password "label:topsecret123!"
      * or "label123:base64,aejUgxxSQXqiiyrxSGACfMiIRBZq5KjlCwr/xVNY/B0="
@@ -174,20 +220,25 @@ public static FormattedOptionParts getSplitPasswordAndLabel(String formattedPass
      * @throws IOException if header parsing has failed
      * @throws CDocParseException if recipients deserializing has failed
      */
-    public static DecryptionKeyMaterial extractDecryptionKeyMaterialFromSymmetricKey(
+    public static DecryptionKeyMaterial extractDecryptionKeyMaterial(
         Path cDocFilePath,
-        String formattedPassword,
-        String formattedSecret
+        @Nullable String formattedPassword,
+        @Nullable String formattedSecret
     ) throws CDocValidationException,
         GeneralSecurityException,
         IOException,
         CDocParseException {
 
         List<Recipient> recipients = Envelope.parseHeader(Files.newInputStream(cDocFilePath));
 
+
         DecryptionKeyMaterial decryptionKm = null;
         if (null != formattedPassword) {
-            FormattedOptionParts splitPassword = getSplitPasswordAndLabel(formattedPassword);
+            List<PBKDF2Recipient> pbkdf2Recipients = recipients.stream()
+                .filter(recipient -> recipient instanceof PBKDF2Recipient)
+                .map(r -> (PBKDF2Recipient)r).toList();
+
+            FormattedOptionParts splitPassword = getSplitPasswordAndLabel(formattedPassword, pbkdf2Recipients);
             decryptionKm =
                 SymmetricKeyTools.extractDecryptionKeyMaterialFromPassword(splitPassword, recipients);
         }
diff --git a/cdoc2-cli/src/main/java/ee/cyber/cdoc2/cli/commands/CDocCreateCmd.java b/cdoc2-cli/src/main/java/ee/cyber/cdoc2/cli/commands/CDocCreateCmd.java
@@ -168,7 +168,7 @@ private void addSymmetricKeysWithLabels(List<EncryptionKeyMaterial> recipients)
         );
         if (null != recipient.password) {
             FormattedOptionParts password
-                = SymmetricKeyUtil.getSplitPasswordAndLabel(recipient.password);
+                = SymmetricKeyUtil.getSplitPasswordAndLabel(recipient.password, true);
             recipients.add(SymmetricKeyUtil.extractEncryptionKeyMaterialFromPassword(password));
         }
     }
diff --git a/cdoc2-cli/src/main/java/ee/cyber/cdoc2/cli/commands/CDocInfoCmd.java b/cdoc2-cli/src/main/java/ee/cyber/cdoc2/cli/commands/CDocInfoCmd.java
@@ -1,22 +1,29 @@
 package ee.cyber.cdoc2.cli.commands;
 
 import ee.cyber.cdoc2.container.Envelope;
+import ee.cyber.cdoc2.container.recipients.PBKDF2Recipient;
 import ee.cyber.cdoc2.container.recipients.PublicKeyRecipient;
 import ee.cyber.cdoc2.container.recipients.Recipient;
 import ee.cyber.cdoc2.container.recipients.ServerRecipient;
+import ee.cyber.cdoc2.container.recipients.SymmetricKeyRecipient;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 import picocli.CommandLine;
 
 import java.io.File;
 import java.nio.file.Files;
 import java.util.List;
 import java.util.Map;
+import java.util.Objects;
 import java.util.concurrent.Callable;
 
 //S106 Standard outputs should not be used directly to log anything
 //CLI needs to interact with standard outputs
 @SuppressWarnings("java:S106")
 @CommandLine.Command(name = "info",  showAtFileInUsageHelp = true)
 public class CDocInfoCmd implements Callable<Void> {
+
+    private static final Logger log = LoggerFactory.getLogger(CDocInfoCmd.class);
     @CommandLine.Option(names = {"-f", "--file" }, required = true,
             paramLabel = "CDOC", description = "the CDOC2 file")
     private File cdocFile;
@@ -37,9 +44,7 @@ public Void call() throws Exception {
         List<Recipient> recipients = Envelope.parseHeader(Files.newInputStream(cdocFile.toPath()));
         for (Recipient recipient: recipients) {
 
-            String type = (recipient instanceof PublicKeyRecipient)
-                    ? ((PublicKeyRecipient) recipient).getRecipientPubKey().getAlgorithm() + " PublicKey"
-                    : "SymmetricKey";
+            String type = getHumanReadableType(recipient);
 
             String label = recipient.getRecipientKeyLabel();
 
@@ -52,4 +57,20 @@ public Void call() throws Exception {
 
         return null;
     }
+
+    String getHumanReadableType(Recipient recipient) {
+        Objects.requireNonNull(recipient); //can't have null recipient, fail with exception
+
+        if (recipient instanceof PublicKeyRecipient) {
+            return ((PublicKeyRecipient) recipient).getRecipientPubKey().getAlgorithm() + " PublicKey";
+        } else if (recipient instanceof SymmetricKeyRecipient) {
+            return "SymmetricKey";
+        } else if (recipient instanceof PBKDF2Recipient) {
+            return "Password";
+        } else {
+            //unknown recipient type, don't fail as other recipients might be supported
+            log.warn("Unknown recipient {}", recipient.getClass());
+            return recipient.getClass().toString();
+        }
+    }
 }
diff --git a/cdoc2-cli/src/main/java/ee/cyber/cdoc2/cli/commands/CDocListCmd.java b/cdoc2-cli/src/main/java/ee/cyber/cdoc2/cli/commands/CDocListCmd.java
@@ -89,7 +89,7 @@ public Void call() throws Exception {
         }
 
         DecryptionKeyMaterial decryptionKm =
-            SymmetricKeyUtil.extractDecryptionKeyMaterialFromSymmetricKey(
+            SymmetricKeyUtil.extractDecryptionKeyMaterial(
                 this.cdocFile.toPath(), this.password, this.secret
             );
 
diff --git a/cdoc2-cli/src/main/java/ee/cyber/cdoc2/cli/commands/CDocReEncryptCmd.java b/cdoc2-cli/src/main/java/ee/cyber/cdoc2/cli/commands/CDocReEncryptCmd.java
@@ -135,7 +135,7 @@ private EncryptionKeyMaterial extractSymmetricKeyEncKeyMaterial()
 
         if (null != this.reEncryptPassword) {
             FormattedOptionParts splitPasswordAndLabel
-                = SymmetricKeyUtil.getSplitPasswordAndLabel(this.reEncryptPassword);
+                = SymmetricKeyUtil.getSplitPasswordAndLabel(this.reEncryptPassword, true);
             return SymmetricKeyUtil.extractEncryptionKeyMaterialFromPassword(splitPasswordAndLabel);
         }
 
diff --git a/test/README.md b/test/README.md
@@ -11,6 +11,13 @@ This command will install helper libraries into temporary folder `/target` and a
 into specified release tags. The folder won't be commited and can be deleted manually after testing 
 and recreated again running the command ones more.
 
+#### Expect
+
+For interactive tests, 'expect' tool is used. For Debian based system it can be installed with:
+```bash
+sudo apt-get install expect
+```
+If expect is not installed, then tests that require it, will be skipped.
 
 ## Tests running
 
diff --git a/test/bats/cdoc2_tests.bats b/test/bats/cdoc2_tests.bats

Original file line number	Diff line number	Diff line change
`@@ -168,7 +168,7 @@ private void addSymmetricKeysWithLabels(List<EncryptionKeyMaterial> recipients)`
`168`	`168`	`);`
`169`	`169`	`if (null != recipient.password) {`
`170`	`170`	`FormattedOptionParts password`
`171`		`- = SymmetricKeyUtil.getSplitPasswordAndLabel(recipient.password);`
	`171`	`+ = SymmetricKeyUtil.getSplitPasswordAndLabel(recipient.password, true);`
`172`	`172`	`recipients.add(SymmetricKeyUtil.extractEncryptionKeyMaterialFromPassword(password));`
`173`	`173`	`}`
`174`	`174`	`}`
Original file line number	Diff line number	Diff line change
`@@ -89,7 +89,7 @@ public Void call() throws Exception {`
`89`	`89`	`}`
`90`	`90`
`91`	`91`	`DecryptionKeyMaterial decryptionKm =`
`92`		`- SymmetricKeyUtil.extractDecryptionKeyMaterialFromSymmetricKey(`
	`92`	`+ SymmetricKeyUtil.extractDecryptionKeyMaterial(`
`93`	`93`	`this.cdocFile.toPath(), this.password, this.secret`
`94`	`94`	`);`
`95`	`95`
Original file line number	Diff line number	Diff line change
`@@ -135,7 +135,7 @@ private EncryptionKeyMaterial extractSymmetricKeyEncKeyMaterial()`
`135`	`135`
`136`	`136`	`if (null != this.reEncryptPassword) {`
`137`	`137`	`FormattedOptionParts splitPasswordAndLabel`
`138`		`- = SymmetricKeyUtil.getSplitPasswordAndLabel(this.reEncryptPassword);`
	`138`	`+ = SymmetricKeyUtil.getSplitPasswordAndLabel(this.reEncryptPassword, true);`
`139`	`139`	`return SymmetricKeyUtil.extractEncryptionKeyMaterialFromPassword(splitPasswordAndLabel);`
`140`	`140`	`}`
`141`	`141`