kms_encrypted 0.3.0 → 1.2.0

data/lib/kms_encrypted.rb

@@ -1,12 +1,28 @@
 # dependencies
 require "active_support"
+require "base64"
+require "json"
+require "securerandom"
 
 # modules
+require "kms_encrypted/box"
+require "kms_encrypted/database"
 require "kms_encrypted/log_subscriber"
 require "kms_encrypted/model"
 require "kms_encrypted/version"
 
+# clients
+require "kms_encrypted/client"
+require "kms_encrypted/clients/base"
+require "kms_encrypted/clients/aws"
+require "kms_encrypted/clients/google"
+require "kms_encrypted/clients/test"
+require "kms_encrypted/clients/vault"
+
 module KmsEncrypted
+  class Error < StandardError; end
+  class DecryptionError < Error; end
+
   class << self
     attr_writer :aws_client
     attr_writer :google_client
@@ -14,7 +30,7 @@ module KmsEncrypted
 
     def aws_client
       @aws_client ||= Aws::KMS::Client.new(
-        retry_limit: 2,
+        retry_limit: 1,
         http_open_timeout: 2,
         http_read_timeout: 2
       )
@@ -27,12 +43,21 @@ module KmsEncrypted
         client.authorization = ::Google::Auth.get_application_default(
           "https://www.googleapis.com/auth/cloud-platform"
         )
+        client.client_options.log_http_requests = false
+        client.client_options.open_timeout_sec = 2
+        client.client_options.read_timeout_sec = 2
         client
       end
     end
 
     def vault_client
-      @vault_client ||= ::Vault
+      @vault_client ||= ::Vault::Client.new
+    end
+
+    # hash is independent of key, but specific to audit device
+    def context_hash(context, path:)
+      context = Base64.encode64(context.to_json)
+      vault_client.logical.write("sys/audit-hash/#{path}", input: context).data[:hash]
     end
   end
 end

data/lib/kms_encrypted/box.rb

@@ -0,0 +1,91 @@
+module KmsEncrypted
+  class Box
+    attr_reader :key_id, :version, :previous_versions
+
+    def initialize(key_id: nil, version: nil, previous_versions: nil)
+      @key_id = key_id || ENV["KMS_KEY_ID"]
+      @version = version || 1
+      @previous_versions = previous_versions || {}
+    end
+
+    def encrypt(plaintext, context: nil)
+      context = version_context(context, version)
+      key_id = version_key_id(version)
+      ciphertext = KmsEncrypted::Client.new(key_id: key_id, data_key: true).encrypt(plaintext, context: context)
+      "v#{version}:#{encode64(ciphertext)}"
+    end
+
+    def decrypt(ciphertext, context: nil)
+      m = /\Av(\d+):/.match(ciphertext)
+      if m
+        version = m[1].to_i
+        ciphertext = ciphertext.sub("v#{version}:", "")
+      else
+        version = 1
+        legacy_context = true
+
+        # legacy
+        if ciphertext.start_with?("$gc$")
+          _, _, short_key_id, ciphertext = ciphertext.split("$", 4)
+
+          # restore key, except for cryptoKeyVersion
+          stored_key_id = decode64(short_key_id).split("/")[0..3]
+          stored_key_id.insert(0, "projects")
+          stored_key_id.insert(2, "locations")
+          stored_key_id.insert(4, "keyRings")
+          stored_key_id.insert(6, "cryptoKeys")
+          key_id = stored_key_id.join("/")
+        elsif ciphertext.start_with?("vault:")
+          ciphertext = Base64.encode64(ciphertext)
+        end
+      end
+
+      key_id ||= version_key_id(version)
+      ciphertext = decode64(ciphertext)
+      context = version_context(context, version)
+
+      KmsEncrypted::Client.new(
+        key_id: key_id,
+        data_key: true,
+        legacy_context: legacy_context
+      ).decrypt(ciphertext, context: context)
+    end
+
+    private
+
+    def version_key_id(version)
+      key_id =
+        if previous_versions[version]
+          previous_versions[version][:key_id]
+        elsif self.version == version
+          self.key_id
+        else
+          raise KmsEncrypted::Error, "Version not active: #{version}"
+        end
+
+      raise ArgumentError, "Missing key id" unless key_id
+
+      key_id
+    end
+
+    def version_context(context, version)
+      if context.respond_to?(:call)
+        if context.arity == 0
+          context.call
+        else
+          context.call(version)
+        end
+      else
+        context
+      end
+    end
+
+    def encode64(bytes)
+      Base64.strict_encode64(bytes)
+    end
+
+    def decode64(bytes)
+      Base64.decode64(bytes)
+    end
+  end
+end

data/lib/kms_encrypted/client.rb

@@ -0,0 +1,69 @@
+module KmsEncrypted
+  class Client
+    delegate :encrypt, :decrypt, to: :client
+
+    attr_reader :key_id, :data_key
+
+    def initialize(key_id: nil, legacy_context: false, data_key: false)
+      @key_id = key_id || ENV["KMS_KEY_ID"]
+      @legacy_context = legacy_context
+      @data_key = data_key
+    end
+
+    def encrypt(plaintext, context: nil)
+      event = {
+        key_id: key_id,
+        context: context,
+        data_key: data_key
+      }
+
+      ActiveSupport::Notifications.instrument("encrypt.kms_encrypted", event) do
+        client.encrypt(plaintext, context: context)
+      end
+    end
+
+    def decrypt(ciphertext, context: nil)
+      event = {
+        key_id: key_id,
+        context: context,
+        data_key: data_key
+      }
+
+      ActiveSupport::Notifications.instrument("decrypt.kms_encrypted", event) do
+        client.decrypt(ciphertext, context: context)
+      end
+    end
+
+    private
+
+    def provider
+      if key_id == "insecure-test-key"
+        :test
+      elsif key_id.start_with?("vault/")
+        :vault
+      elsif key_id.start_with?("projects/")
+        :google
+      else
+        :aws
+      end
+    end
+
+    def client
+      @client ||= begin
+        klass =
+          case provider
+          when :test
+            KmsEncrypted::Clients::Test
+          when :vault
+            KmsEncrypted::Clients::Vault
+          when :google
+            KmsEncrypted::Clients::Google
+          else
+            KmsEncrypted::Clients::Aws
+          end
+
+        klass.new(key_id: key_id, legacy_context: @legacy_context)
+      end
+    end
+  end
+end

data/lib/kms_encrypted/clients/aws.rb

@@ -0,0 +1,36 @@
+module KmsEncrypted
+  module Clients
+    class Aws < Base
+      def encrypt(plaintext, context: nil)
+        options = {
+          key_id: key_id,
+          plaintext: plaintext
+        }
+        options[:encryption_context] = generate_context(context) if context
+
+        KmsEncrypted.aws_client.encrypt(options).ciphertext_blob
+      end
+
+      def decrypt(ciphertext, context: nil)
+        options = {
+          ciphertext_blob: ciphertext
+        }
+        options[:encryption_context] = generate_context(context) if context
+
+        begin
+          KmsEncrypted.aws_client.decrypt(options).plaintext
+        rescue ::Aws::KMS::Errors::InvalidCiphertextException
+          decryption_failed!
+        end
+      end
+
+      private
+
+      # make integers strings for convenience
+      def generate_context(context)
+        raise ArgumentError, "Context must be a hash" unless context.is_a?(Hash)
+        Hash[context.map { |k, v| [k, context_value(v)] }]
+      end
+    end
+  end
+end

data/lib/kms_encrypted/clients/base.rb

@@ -0,0 +1,45 @@
+module KmsEncrypted
+  module Clients
+    class Base
+      attr_reader :key_id
+
+      def initialize(key_id: nil, legacy_context: false)
+        @key_id = key_id
+        @legacy_context = legacy_context
+      end
+
+      protected
+
+      def decryption_failed!
+        raise DecryptionError, "Decryption failed"
+      end
+
+      # keys must be ordered consistently
+      # values are checked for validity
+      # then converted to strings
+      def generate_context(context)
+        if @legacy_context
+          context.to_json
+        elsif context.is_a?(Hash)
+          Hash[context.sort_by { |k| k.to_s }.map { |k, v| [context_key(k), context_value(v)] }].to_json
+        else
+          context
+        end
+      end
+
+      def context_key(k)
+        unless k.is_a?(String) || k.is_a?(Symbol)
+          raise ArgumentError, "Context keys must be a string or symbol"
+        end
+        k.to_s
+      end
+
+      def context_value(v)
+        unless v.is_a?(String) || v.is_a?(Integer)
+          raise ArgumentError, "Context values must be a string or integer"
+        end
+        v.to_s
+      end
+    end
+  end
+end

data/lib/kms_encrypted/clients/google.rb

@@ -0,0 +1,40 @@
+module KmsEncrypted
+  module Clients
+    class Google < Base
+      attr_reader :last_key_version
+
+      def encrypt(plaintext, context: nil)
+        options = {
+          plaintext: plaintext
+        }
+        options[:additional_authenticated_data] = generate_context(context) if context
+
+        # ensure namespace gets loaded
+        client = KmsEncrypted.google_client
+        request = ::Google::Apis::CloudkmsV1::EncryptRequest.new(options)
+        response = client.encrypt_crypto_key(key_id, request)
+
+        @last_key_version = response.name
+
+        response.ciphertext
+      end
+
+      def decrypt(ciphertext, context: nil)
+        options = {
+          ciphertext: ciphertext
+        }
+        options[:additional_authenticated_data] = generate_context(context) if context
+
+        # ensure namespace gets loaded
+        client = KmsEncrypted.google_client
+        request = ::Google::Apis::CloudkmsV1::DecryptRequest.new(options)
+        begin
+          client.decrypt_crypto_key(key_id, request).plaintext
+        rescue ::Google::Apis::ClientError => e
+          decryption_failed! if e.message.include?("Decryption failed")
+          raise e
+        end
+      end
+    end
+  end
+end

data/lib/kms_encrypted/clients/test.rb

@@ -0,0 +1,29 @@
+module KmsEncrypted
+  module Clients
+    class Test < Base
+      PREFIX = Base64.decode64("insecure+data+A")
+
+      def encrypt(plaintext, context: nil)
+        parts = [PREFIX, Base64.strict_encode64(plaintext)]
+        parts << generate_context(context) if context
+        parts.join(":")
+      end
+
+      def decrypt(ciphertext, context: nil)
+        prefix, plaintext, stored_context = ciphertext.split(":")
+
+        context = generate_context(context) if context
+        decryption_failed! if context != stored_context
+
+        Base64.decode64(plaintext)
+      end
+
+      private
+
+      # turn hash into json
+      def generate_context(context)
+        Base64.encode64(super)
+      end
+    end
+  end
+end

data/lib/kms_encrypted/clients/vault.rb

@@ -0,0 +1,48 @@
+module KmsEncrypted
+  module Clients
+    class Vault < Base
+      def encrypt(plaintext, context: nil)
+        options = {
+          plaintext: Base64.encode64(plaintext)
+        }
+        options[:context] = generate_context(context) if context
+
+        response = KmsEncrypted.vault_client.logical.write(
+          "transit/encrypt/#{key_id.sub("vault/", "")}",
+          options
+        )
+
+        response.data[:ciphertext]
+      end
+
+      def decrypt(ciphertext, context: nil)
+        options = {
+          ciphertext: ciphertext
+        }
+        options[:context] = generate_context(context) if context
+
+        response =
+          begin
+            KmsEncrypted.vault_client.logical.write(
+              "transit/decrypt/#{key_id.sub("vault/", "")}",
+              options
+            )
+          rescue ::Vault::HTTPClientError => e
+            decryption_failed! if e.message.include?("unable to decrypt")
+            raise e
+          rescue Encoding::UndefinedConversionError
+            decryption_failed!
+          end
+
+        Base64.decode64(response.data[:plaintext])
+      end
+
+      private
+
+      # turn hash into json
+      def generate_context(context)
+        Base64.encode64(super)
+      end
+    end
+  end
+end

data/lib/kms_encrypted/database.rb

@@ -0,0 +1,63 @@
+module KmsEncrypted
+  class Database
+    attr_reader :record, :key_method, :options
+
+    def initialize(record, key_method)
+      @record = record
+      @key_method = key_method
+      @options = record.class.kms_keys[key_method.to_sym]
+    end
+
+    def version
+      @version ||= evaluate_option(:version).to_i
+    end
+
+    def key_id
+      @key_id ||= evaluate_option(:key_id)
+    end
+
+    def previous_versions
+      @previous_versions ||= evaluate_option(:previous_versions)
+    end
+
+    def context(version)
+      name = options[:name]
+      context_method = name ? "kms_encryption_context_#{name}" : "kms_encryption_context"
+      if record.method(context_method).arity == 0
+        record.send(context_method)
+      else
+        record.send(context_method, version: version)
+      end
+    end
+
+    def encrypt(plaintext)
+      context = context(version)
+
+      KmsEncrypted::Box.new(
+        key_id: key_id,
+        version: version,
+        previous_versions: previous_versions
+      ).encrypt(plaintext, context: context)
+    end
+
+    def decrypt(ciphertext)
+      # determine version for context
+      m = /\Av(\d+):/.match(ciphertext)
+      version = m ? m[1].to_i : 1
+      context = (options[:upgrade_context] && !m) ? {} : context(version)
+
+      KmsEncrypted::Box.new(
+        key_id: key_id,
+        previous_versions: previous_versions
+      ).decrypt(ciphertext, context: context)
+    end
+
+    private
+
+    def evaluate_option(key)
+      opt = options[key]
+      opt = record.instance_exec(&opt) if opt.respond_to?(:call)
+      opt
+    end
+  end
+end