passbolt-browser-extension 3.0.6 → 4.6.2

package/src/all/background_page/service/crypto/decryptMessageService.test.js

@@ -0,0 +1,189 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         3.6.0
+ */
+
+/**
+ * Unit tests on DecryptMessageService in regard of specifications
+ */
+
+import DecryptMessageService from "./decryptMessageService";
+import EncryptMessageService from "./encryptMessageService";
+import {pgpKeys} from "../../../../../test/fixtures/pgpKeys/keys";
+import {OpenpgpAssertion} from "../../utils/openpgp/openpgpAssertions";
+
+describe("DecryptMessageService", () => {
+  describe("DecryptMessageService::decryptSymmetrically", () => {
+    it("should decrypt a message", async() => {
+      const messageClear = "message clear";
+      const password = "bim bam boom";
+      const messageEncryptedArmored = await EncryptMessageService.encryptSymmetrically(messageClear, [password]);
+      const messageEncrypted = await OpenpgpAssertion.readMessageOrFail(messageEncryptedArmored);
+      const resultDecrypt = await DecryptMessageService.decryptSymmetrically(messageEncrypted, password);
+      expect.assertions(1);
+      expect(resultDecrypt).toEqual(messageClear);
+    }, 10 * 1000);
+
+    it("should decrypt a message and verify a signature", async() => {
+      const messageClear = "message clear";
+      const password = "bim bam boom";
+      const signingKey = await OpenpgpAssertion.readKeyOrFail(pgpKeys.ada.private_decrypted);
+      const verifyingKey = await OpenpgpAssertion.readKeyOrFail(pgpKeys.ada.private);
+      const messageEncryptedArmored = await EncryptMessageService.encryptSymmetrically(messageClear, [password], [signingKey]);
+      const messageEncrypted = await OpenpgpAssertion.readMessageOrFail(messageEncryptedArmored);
+      const resultDecrypt = await DecryptMessageService.decryptSymmetrically(messageEncrypted, password, [verifyingKey]);
+
+      expect.assertions(1);
+      expect(resultDecrypt).toEqual(messageClear);
+    }, 10 * 1000);
+
+    it("should decrypt a message and verify multiple signatures", async() => {
+      const messageClear = "message clear";
+      const password = "bim bam boom";
+      const signingKeyUserA = await OpenpgpAssertion.readKeyOrFail(pgpKeys.ada.private_decrypted);
+      const signingKeyUserB = await OpenpgpAssertion.readKeyOrFail(pgpKeys.betty.private_decrypted);
+      const verifyingKeyA = await OpenpgpAssertion.readKeyOrFail(pgpKeys.ada.private_decrypted);
+      const verifyingKeyB = await OpenpgpAssertion.readKeyOrFail(pgpKeys.betty.public);
+      const messageEncryptedArmored = await EncryptMessageService.encryptSymmetrically(messageClear, [password], [signingKeyUserA, signingKeyUserB]);
+      const messageEncrypted = await OpenpgpAssertion.readMessageOrFail(messageEncryptedArmored);
+      const resultDecrypt = await DecryptMessageService.decryptSymmetrically(messageEncrypted, password, [verifyingKeyA, verifyingKeyB]);
+
+      expect.assertions(1);
+      expect(resultDecrypt).toEqual(messageClear);
+    }, 10 * 1000);
+
+    it("should throw an error if it cannot decrypt a message", async() => {
+      const messageClear = "message clear";
+      const password = "bim bam boom";
+      const messageEncryptedArmored = await EncryptMessageService.encryptSymmetrically(messageClear, [password]);
+      const messageEncrypted = await OpenpgpAssertion.readMessageOrFail(messageEncryptedArmored);
+      const resultDecrypt = DecryptMessageService.decryptSymmetrically(messageEncrypted, "wrong-password");
+
+      expect.assertions(1);
+      await expect(resultDecrypt).rejects.toThrow();
+    }, 10 * 1000);
+
+    it("should throw an error if it cannot verify a signature", async() => {
+      const messageClear = "message clear";
+      const password = "bim bam boom";
+      const signingKey = await OpenpgpAssertion.readKeyOrFail(pgpKeys.ada.private_decrypted);
+      const messageEncryptedArmored = await EncryptMessageService.encryptSymmetrically(messageClear, [password], [signingKey]);
+      const verfificationKey = await OpenpgpAssertion.readKeyOrFail(pgpKeys.admin.public);
+      const messageEncrypted = await OpenpgpAssertion.readMessageOrFail(messageEncryptedArmored);
+      const resultDecrypt = DecryptMessageService.decryptSymmetrically(messageEncrypted, password, [verfificationKey]);
+
+      expect.assertions(1);
+      await expect(resultDecrypt).rejects.toThrow("Could not find signing key with key ID 1353b5b15d9b054f");
+    }, 10 * 1000);
+
+    it("should throw an error if it cannot verify one of among multiple signatures", async() => {
+      const messageClear = "message clear";
+      const password = "bim bam boom";
+      const signingKeyUserA = await OpenpgpAssertion.readKeyOrFail(pgpKeys.ada.private_decrypted);
+      const signingKeyUserB = await OpenpgpAssertion.readKeyOrFail(pgpKeys.betty.private_decrypted);
+      const verifyingKeyA = await OpenpgpAssertion.readKeyOrFail(pgpKeys.ada.private_decrypted);
+      const messageEncryptedArmored = await EncryptMessageService.encryptSymmetrically(messageClear, [password], [signingKeyUserA, signingKeyUserB]);
+      const verifyingKeyB = await OpenpgpAssertion.readKeyOrFail(pgpKeys.admin.public);
+      const messageEncrypted = await OpenpgpAssertion.readMessageOrFail(messageEncryptedArmored);
+      const resultDecrypt = DecryptMessageService.decryptSymmetrically(messageEncrypted, password, [verifyingKeyA, verifyingKeyB]);
+
+      expect.assertions(1);
+      await expect(resultDecrypt).rejects.toThrow("Could not find signing key with key ID d3f1fe4be61d7009");
+    }, 10 * 1000);
+  });
+
+  describe("DecryptMessageService::decrypt", () => {
+    it("should decrypt a message", async() => {
+      const messageClear = "message clear";
+      const publicKey = await OpenpgpAssertion.readKeyOrFail(pgpKeys.betty.public);
+      const privateKey = await OpenpgpAssertion.readKeyOrFail(pgpKeys.betty.private_decrypted);
+      const messageEncryptedArmored = await EncryptMessageService.encrypt(messageClear, publicKey);
+      const messageEncrypted = await OpenpgpAssertion.readMessageOrFail(messageEncryptedArmored);
+      const resultDecrypt = await DecryptMessageService.decrypt(messageEncrypted, privateKey);
+
+      expect.assertions(1);
+      expect(resultDecrypt).toEqual(messageClear);
+    }, 10 * 1000);
+
+    it("should decrypt a message and verify a signature", async() => {
+      const messageClear = "message clear";
+      const publicKey = await OpenpgpAssertion.readKeyOrFail(pgpKeys.betty.public);
+      const privateKey = await OpenpgpAssertion.readKeyOrFail(pgpKeys.betty.private_decrypted);
+      const signingKey = await OpenpgpAssertion.readKeyOrFail(pgpKeys.ada.private_decrypted);
+      const verifyingKey = await OpenpgpAssertion.readKeyOrFail(pgpKeys.ada.public);
+      const messageEncryptedArmored = await EncryptMessageService.encrypt(messageClear, publicKey, [signingKey]);
+      const messageEncrypted = await OpenpgpAssertion.readMessageOrFail(messageEncryptedArmored);
+      const resultDecrypt = await DecryptMessageService.decrypt(messageEncrypted, privateKey, [verifyingKey]);
+
+      expect.assertions(1);
+      expect(resultDecrypt).toEqual(messageClear);
+    }, 10 * 1000);
+
+    it("should decrypt a message and verify multiple signatures", async() => {
+      const messageClear = "message clear";
+      const publicKey = await OpenpgpAssertion.readKeyOrFail(pgpKeys.betty.public);
+      const privateKey = await OpenpgpAssertion.readKeyOrFail(pgpKeys.betty.private_decrypted);
+      const signingKeyUserA = await OpenpgpAssertion.readKeyOrFail(pgpKeys.ada.private_decrypted);
+      const signingKeyUserB = await OpenpgpAssertion.readKeyOrFail(pgpKeys.betty.private_decrypted);
+      const verifyingKeyA = await OpenpgpAssertion.readKeyOrFail(pgpKeys.ada.public);
+      const verifyingKeyB = await OpenpgpAssertion.readKeyOrFail(pgpKeys.betty.public);
+      const messageEncryptedArmored = await EncryptMessageService.encrypt(messageClear, publicKey, [signingKeyUserA, signingKeyUserB]);
+      const messageEncrypted = await OpenpgpAssertion.readMessageOrFail(messageEncryptedArmored);
+      const resultDecrypt = await DecryptMessageService.decrypt(messageEncrypted, privateKey, [verifyingKeyA, verifyingKeyB]);
+
+      expect.assertions(1);
+      expect(resultDecrypt).toEqual(messageClear);
+    }, 10 * 1000);
+
+    it("should throw an error if it cannot decrypt a message", async() => {
+      const messageClear = "message clear";
+      const publicKey = await OpenpgpAssertion.readKeyOrFail(pgpKeys.betty.public);
+      const privateKey = await OpenpgpAssertion.readKeyOrFail(pgpKeys.ada.private_decrypted);
+      const messageEncryptedArmored = await EncryptMessageService.encrypt(messageClear, publicKey);
+      const messageEncrypted = await OpenpgpAssertion.readMessageOrFail(messageEncryptedArmored);
+      const resultDecrypt = DecryptMessageService.decrypt(messageEncrypted, privateKey);
+
+      expect.assertions(1);
+      await expect(resultDecrypt).rejects.toThrow();
+    }, 10 * 1000);
+
+    it("should throw an error if it cannot verify a signature", async() => {
+      const messageClear = "message clear";
+      const publicKey = await OpenpgpAssertion.readKeyOrFail(pgpKeys.betty.public);
+      const privateKey = await OpenpgpAssertion.readKeyOrFail(pgpKeys.betty.private_decrypted);
+      const signingKey = await OpenpgpAssertion.readKeyOrFail(pgpKeys.betty.private_decrypted);
+      const messageEncryptedArmored = await EncryptMessageService.encrypt(messageClear, publicKey, [signingKey]);
+      const verfificationKey = await OpenpgpAssertion.readKeyOrFail(pgpKeys.admin.public);
+      const messageEncrypted = await OpenpgpAssertion.readMessageOrFail(messageEncryptedArmored);
+      const resultDecrypt = DecryptMessageService.decrypt(messageEncrypted, privateKey, [verfificationKey]);
+
+      expect.assertions(1);
+      await expect(resultDecrypt).rejects.toThrow("Could not find signing key with key ID d3f1fe4be61d7009");
+    }, 10 * 1000);
+
+    it("should throw an error if it cannot verify one of among multiple signatures", async() => {
+      const messageClear = "message clear";
+      const publicKey = await OpenpgpAssertion.readKeyOrFail(pgpKeys.betty.public);
+      const privateKey = await OpenpgpAssertion.readKeyOrFail(pgpKeys.betty.private_decrypted);
+      const signingKeyUserA = await OpenpgpAssertion.readKeyOrFail(pgpKeys.ada.private_decrypted);
+      const signingKeyUserB = await OpenpgpAssertion.readKeyOrFail(pgpKeys.betty.private_decrypted);
+      const verifyingKeyA = await OpenpgpAssertion.readKeyOrFail(pgpKeys.ada.private_decrypted);
+      const messageEncryptedArmored = await EncryptMessageService.encrypt(messageClear, publicKey, [signingKeyUserA, signingKeyUserB]);
+      const verifyingKeyB = await OpenpgpAssertion.readKeyOrFail(pgpKeys.admin.public);
+      const messageEncrypted = await OpenpgpAssertion.readMessageOrFail(messageEncryptedArmored);
+      const resultDecrypt = DecryptMessageService.decrypt(messageEncrypted, privateKey, [verifyingKeyA, verifyingKeyB]);
+
+      expect.assertions(1);
+      await expect(resultDecrypt).rejects.toThrow("Could not find signing key with key ID d3f1fe4be61d7009");
+    }, 10 * 1000);
+  });
+});

package/src/all/background_page/service/crypto/decryptPrivateKeyService.js

@@ -0,0 +1,45 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         3.6.0
+ */
+
+import * as openpgp from 'openpgp';
+import {OpenpgpAssertion} from "../../utils/openpgp/openpgpAssertions";
+import InvalidMasterPasswordError from "../../error/invalidMasterPasswordError";
+import {assertPassphrase} from '../../utils/assertions';
+
+class DecryptPrivateKeyService {
+  /**
+   * Decrypt a private key with the given passphrase.
+   *
+   * @param {openpgp.PrivateKey} privateKey the private key to decrypt
+   * @param {string} passphrase the passphrase with which to do the decryption operation
+   * @returns {Promise<openpgp.PrivateKey>} the private key decrypted
+   * @throws {InvalidMasterPasswordError} if the key cannot be decrypted with the passphrase
+   * @throws {Error} If the private key is already decrypted.
+   */
+  static async decrypt(privateKey, passphrase) {
+    OpenpgpAssertion.assertEncryptedPrivateKey(privateKey);
+    assertPassphrase(passphrase);
+
+    try {
+      return (await openpgp.decryptKey({
+        privateKey: privateKey,
+        passphrase: passphrase
+      }));
+    } catch (error) {
+      throw new InvalidMasterPasswordError();
+    }
+  }
+}
+
+export default DecryptPrivateKeyService;

package/src/all/background_page/service/crypto/decryptPrivateKeyService.test.js

@@ -0,0 +1,41 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         3.6.0
+ */
+import DecryptPrivateKeyService from "./decryptPrivateKeyService";
+import InvalidMasterPasswordError from '../../error/invalidMasterPasswordError';
+import {pgpKeys} from '../../../../../test/fixtures/pgpKeys/keys';
+import {OpenpgpAssertion} from "../../utils/openpgp/openpgpAssertions";
+
+describe("DecryptPrivateKey service", () => {
+  it('should validate a private key with the right passphrase', async() => {
+    expect.assertions(1);
+    const key = await OpenpgpAssertion.readKeyOrFail(pgpKeys.ada.private);
+    await expect(DecryptPrivateKeyService.decrypt(key, "ada@passbolt.com")).resolves.not.toBeNull();
+  }, 10 * 1000);
+
+  it('should throw an InvalidMasterPasswordError when the passphrase is not correct', async() => {
+    expect.assertions(1);
+    const key = await OpenpgpAssertion.readKeyOrFail(pgpKeys.ada.private);
+    await expect(DecryptPrivateKeyService.decrypt(key, "wrong passphrase")).rejects.toThrow(new InvalidMasterPasswordError());
+  }, 10 * 1000);
+
+  it('should throw an Error if the private key is already decrypted', async() => {
+    expect.assertions(1);
+    try {
+      const key = await OpenpgpAssertion.readKeyOrFail(pgpKeys.ada.private_decrypted);
+      await DecryptPrivateKeyService.decrypt(key, "");
+    } catch (e) {
+      expect(e).toStrictEqual(new Error("The private key should be encrypted."));
+    }
+  }, 10 * 1000);
+});

package/src/all/background_page/service/crypto/decryptSsoPassphraseService.js

@@ -0,0 +1,77 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         3.9.0
+ */
+import {Buffer} from 'buffer';
+import OutdatedSsoKitError from '../../error/outdatedSsoKitError';
+import {
+  assertBase64String,
+  assertNonExtractableSsoKey,
+  assertExtractableSsoKey,
+  assertValidInitialisationVector
+} from '../../utils/assertions';
+
+class DecryptSsoPassphraseService {
+  /**
+   * Decrypt a given ciphered text using an AES-GCM generated keys and with the given IVs.
+   *
+   * @param {string} text a base64 string to decipher with keys and ivs.
+   * @param {CryptoKey} nek the non-extractable key used to decrypt the text on second round
+   * @param {CryptoKey} ek the extractable key used to decrypt the text on first round
+   * @param {Uint8Array} iv1 the initialization vector for the second encryption round
+   * @param {Uint8Array} iv2 the initialization vector for the first encryption round
+   * @returns {Promise<string>} the deciphered string
+   */
+  static async decrypt(base64Text, nek, ek, iv1, iv2) {
+    assertBase64String(base64Text);
+    assertNonExtractableSsoKey(nek);
+    assertExtractableSsoKey(ek);
+    assertValidInitialisationVector(iv1);
+    assertValidInitialisationVector(iv2);
+
+    const buffer = Buffer.from(base64Text, 'base64');
+    const firstDecryptionAlgorithm = {
+      name: ek.algorithm.name,
+      iv: iv2
+    };
+    const secondDecryptionAlgorithm = {
+      name: nek.algorithm.name,
+      iv: iv1
+    };
+
+    let firstDecryptionBuffer = null;
+    try {
+      firstDecryptionBuffer = await crypto.subtle.decrypt(firstDecryptionAlgorithm, ek, buffer);
+    } catch (e) {
+      /**
+       * This might happen if a backup client side or server side was done and both kits are mismatching.
+       */
+      console.error(e);
+      throw new OutdatedSsoKitError(`Unable to decrypt passphrase from the server SSO kit: ${e.message}`);
+    }
+
+    let secondDecryptionBuffer = null;
+    try {
+      secondDecryptionBuffer = await crypto.subtle.decrypt(secondDecryptionAlgorithm, nek, firstDecryptionBuffer);
+    } catch (e) {
+      /**
+       * This can happen if the local SSO kit nek and/or iv1 has changed (manually?).
+       */
+      console.error(e);
+      throw new Error(`Unable to decrypt passphrase with the local SSO kit: ${e.message}`);
+    }
+
+    return Buffer.from(secondDecryptionBuffer).toString();
+  }
+}
+
+export default DecryptSsoPassphraseService;

package/src/all/background_page/service/crypto/decryptSsoPassphraseService.test.js

@@ -0,0 +1,105 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         3.9.0
+ */
+import "../../../../../test/mocks/mockCryptoKey";
+import DecryptSsoPassphraseService from "./decryptSsoPassphraseService";
+import OutdatedSsoKitError from "../../error/outdatedSsoKitError";
+import {buildMockedCryptoKey} from "../../utils/assertions.test.data";
+import GenerateSsoIvService from "./generateSsoIvService";
+
+describe("DecryptSsoPassphrase service", () => {
+  const key1Promise = buildMockedCryptoKey({algoName: "AES-GCM", extractable: false});
+  const key2Promise = buildMockedCryptoKey({algoName: "AES-GCM"});
+  const iv1 = GenerateSsoIvService.generateIv();
+  const iv2 = GenerateSsoIvService.generateIv();
+  const buffer1 = Buffer.from("This is a buffer").toString('base64');
+  const buffer2 = Buffer.from("This is a second buffer");
+
+  it('should decrypt the passphrase if all data are correct', async() => {
+    expect.assertions(7);
+    const key1 = await key1Promise;
+    const key2 = await key2Promise;
+
+    let step = 0;
+    const expectedDecryptedPassphrase = "passphrase";
+
+    const firstDecrypyCallExpectation = (algo, key, buffer) => {
+      expect(algo).toStrictEqual({
+        name: "AES-GCM",
+        iv: iv2
+      });
+      expect(key).toBe(key2);
+      expect(buffer).toStrictEqual(Buffer.from(buffer1, 'base64'));
+      return buffer2;
+    };
+
+    const secondDecrypyCallExpectation = (algo, key, buffer) => {
+      expect(algo).toStrictEqual({
+        name: "AES-GCM",
+        iv: iv1
+      });
+      expect(key).toBe(key1);
+      expect(buffer).toBe(buffer2);
+      return expectedDecryptedPassphrase;
+    };
+
+    crypto.subtle.decrypt.mockImplementation(async(algo, key, buffer) => {
+      step++;
+      return step === 1
+        ? firstDecrypyCallExpectation(algo, key, buffer)
+        : secondDecrypyCallExpectation(algo, key, buffer);
+    });
+
+    const decrypted = await DecryptSsoPassphraseService.decrypt(buffer1, key1, key2, iv1, iv2);
+    expect(decrypted).toStrictEqual(expectedDecryptedPassphrase);
+  });
+
+  it("should throw an OutdatedSsoKitError if the server SSO kit doesn't match the local SSO kit", async() => {
+    expect.assertions(1);
+    const key1 = await key1Promise;
+    const key2 = await key2Promise;
+
+    crypto.subtle.decrypt.mockImplementation(async() => {
+      throw new Error("Unable to decrypt somehow");
+    });
+
+    try {
+      await DecryptSsoPassphraseService.decrypt(buffer1, key1, key2, iv1, iv2);
+    } catch (e) {
+      expect(e).toBeInstanceOf(OutdatedSsoKitError);
+    }
+  });
+
+  it("should throw an Error if the local SSO kit has been modified somehow", async() => {
+    expect.assertions(1);
+    const key1 = await key1Promise;
+    const key2 = await key2Promise;
+
+    let step = 0;
+    const firstDecrypyCallExpectation = async() => buffer2;
+    const secondDecrypyCallExpectation =  async() => { throw new Error("Unable to decrypt somehow"); };
+
+    crypto.subtle.decrypt.mockImplementation(async(algo, key, buffer) => {
+      step++;
+      return step === 1
+        ? firstDecrypyCallExpectation(algo, key, buffer)
+        : secondDecrypyCallExpectation(algo, key, buffer);
+    });
+
+    try {
+      await DecryptSsoPassphraseService.decrypt(buffer1, key1, key2, iv1, iv2);
+    } catch (e) {
+      expect(e).toBeInstanceOf(Error);
+    }
+  });
+});

package/src/all/background_page/service/crypto/encryptMessageService.js

@@ -0,0 +1,63 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         3.6.0
+ */
+
+import * as openpgp from 'openpgp';
+import {OpenpgpAssertion} from "../../utils/openpgp/openpgpAssertions";
+
+class EncryptMessageService {
+  /**
+   * Encrypt symmetrically a message.
+   *
+   * @param {string} message The message to encrypt.
+   * @param {array<string>} passwords The password to use to encrypt the message.
+   * @param {array<openpgp.PrivateKey>} signingKeys The private key(s) to use to sign the message.
+   * @returns {Promise<string>} the encrypted message in its armored version
+   */
+  static async encryptSymmetrically(message, passwords, signingKeys = null) {
+    if (signingKeys) {
+      OpenpgpAssertion.assertDecryptedPrivateKeys(signingKeys);
+    }
+
+    const gpgMessage = await OpenpgpAssertion.createMessageOrFail(message);
+    return openpgp.encrypt({
+      message: gpgMessage,
+      passwords: passwords,
+      signingKeys: signingKeys,
+    });
+  }
+
+  /**
+   * Encrypt and sign text message.
+   *
+   * @param {string} message The message to encrypt.
+   * @param {openpgp.PublicKey} encryptionKey The public key(s) to use to encrypt the message
+   * @param {array<openpgp.PrivateKey>} signingKeys The private key(s) to use to sign the message.
+   * @returns {Promise<string>} the encrypted message in its armored version
+   */
+  static async encrypt(message, encryptionKey, signingKeys = null) {
+    OpenpgpAssertion.assertPublicKey(encryptionKey);
+    if (signingKeys) {
+      OpenpgpAssertion.assertDecryptedPrivateKeys(signingKeys);
+    }
+
+    const gpgMessage = await OpenpgpAssertion.createMessageOrFail(message);
+    return openpgp.encrypt({
+      message: gpgMessage,
+      encryptionKeys: encryptionKey,
+      signingKeys: signingKeys,
+    });
+  }
+}
+
+export default EncryptMessageService;

package/src/all/background_page/service/crypto/encryptMessageService.test.js

@@ -0,0 +1,149 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         3.6.0
+ */
+
+import {pgpKeys} from "../../../../../test/fixtures/pgpKeys/keys";
+import {OpenpgpAssertion} from "../../utils/openpgp/openpgpAssertions";
+import DecryptMessageService from "./decryptMessageService";
+import EncryptMessageService from "./encryptMessageService";
+import * as openpgp from 'openpgp';
+
+/**
+ * Unit tests on ConfirmSaveAccountRecoverySettings in regard of specifications
+ */
+
+describe("EncryptMessageService", () => {
+  describe("EncryptMessageService::encryptSymmetrically", () => {
+    it("should encrypt symmetrically", async() => {
+      const messageClear = "message clear";
+      const encryptPassword = "encrypt-password";
+      const resultEncrypt = await EncryptMessageService.encryptSymmetrically(messageClear, [encryptPassword]);
+      expect.assertions(3);
+
+      expect(resultEncrypt).toBeTruthy();
+      const resultDecrypt = await openpgp.decrypt({
+        message: await openpgp.readMessage({armoredMessage: resultEncrypt}),
+        passwords: [encryptPassword]
+      });
+      expect(resultDecrypt).not.toBeNull();
+      expect(resultDecrypt.data).toEqual(messageClear);
+    }, 10 * 1000);
+
+    it("should encrypt symmetrically and sign with one key", async() => {
+      const messageClear = "message clear";
+      const encryptPassword = "encrypt-password";
+      const signingKey = await OpenpgpAssertion.readKeyOrFail(pgpKeys.ada.private_decrypted);
+      const resultEncrypt = await EncryptMessageService.encryptSymmetrically(messageClear, [encryptPassword], [signingKey]);
+      expect.assertions(4);
+      expect(resultEncrypt).toBeTruthy();
+      const messageEncrypted = await OpenpgpAssertion.readMessageOrFail(resultEncrypt);
+      const resultDecrypt = await openpgp.decrypt({
+        message: messageEncrypted,
+        passwords: [encryptPassword],
+        verificationKeys: [signingKey]
+      });
+      expect(resultDecrypt).not.toBeNull();
+      expect(resultDecrypt.data).toEqual(messageClear);
+      expect(await resultDecrypt.signatures[0].verified).toBeTruthy();
+    }, 10 * 1000);
+
+    it("should encrypt symmetrically and sign with multiple keys", async() => {
+      const messageClear = "message clear";
+      const encryptPassword = "encrypt-password";
+      const signingKeyUserA = await OpenpgpAssertion.readKeyOrFail(pgpKeys.ada.private_decrypted);
+      const signingKeyUserB = await OpenpgpAssertion.readKeyOrFail(pgpKeys.betty.private_decrypted);
+      const resultEncrypt = await EncryptMessageService.encryptSymmetrically(messageClear, [encryptPassword], [signingKeyUserA, signingKeyUserB]);
+
+      expect.assertions(5);
+      expect(resultEncrypt).toBeTruthy();
+      const messageEncrypted = await OpenpgpAssertion.readMessageOrFail(resultEncrypt);
+      const resultDecrypt = await openpgp.decrypt({
+        message: messageEncrypted,
+        passwords: [encryptPassword],
+        verificationKeys: [signingKeyUserA, signingKeyUserB]
+      });
+      expect(resultDecrypt).not.toBeNull();
+      expect(resultDecrypt.data).toEqual(messageClear);
+      expect(await resultDecrypt.signatures[0].verified).toBeTruthy();
+      expect(await resultDecrypt.signatures[1].verified).toBeTruthy();
+    }, 10 * 1000);
+
+    it("should throw an error if the signing key is not a valid decrypted openpgp key", async() => {
+      const messageClear = "message clear";
+      const encryptPassword = "encrypt-password";
+      const signKey = await OpenpgpAssertion.readKeyOrFail(pgpKeys.ada.private);
+      const resultEncryptPromise = EncryptMessageService.encryptSymmetrically(messageClear, [encryptPassword], [signKey]);
+
+      expect.assertions(1);
+      await expect(resultEncryptPromise).rejects.toThrow("The private key should be decrypted.");
+    });
+  });
+
+  describe("EncryptMessageService::encrypt", () => {
+    it("should encrypt asymmetrically", async() => {
+      const messageClear = "message clear";
+      const publicKey = await OpenpgpAssertion.readKeyOrFail(pgpKeys.ada.public);
+
+      const resultEncrypt = await EncryptMessageService.encrypt(messageClear, publicKey);
+      expect.assertions(2);
+      expect(resultEncrypt).toBeTruthy();
+      const privateDecryptedKey = await OpenpgpAssertion.readKeyOrFail(pgpKeys.ada.private_decrypted);
+      const messageEncrypted = await OpenpgpAssertion.readMessageOrFail(resultEncrypt);
+      const resultDecrypt = await DecryptMessageService.decrypt(messageEncrypted, privateDecryptedKey);
+      expect(resultDecrypt).toEqual(messageClear);
+    }, 10 * 1000);
+
+    it("should encrypt asymmetrically and sign with one key", async() => {
+      const messageClear = "message clear";
+      const publicKey = await OpenpgpAssertion.readKeyOrFail(pgpKeys.ada.public);
+      const signingKey = await OpenpgpAssertion.readKeyOrFail(pgpKeys.betty.private_decrypted);
+
+      const resultEncrypt = await EncryptMessageService.encrypt(messageClear, publicKey, [signingKey]);
+
+      expect.assertions(2);
+      expect(resultEncrypt).toBeTruthy();
+      const verificationKeys = [await OpenpgpAssertion.readKeyOrFail(pgpKeys.betty.public)];
+      const privateDecryptedKey = await OpenpgpAssertion.readKeyOrFail(pgpKeys.ada.private_decrypted);
+      const messageEncrypted = await OpenpgpAssertion.readMessageOrFail(resultEncrypt);
+      const resultDecrypt = await DecryptMessageService.decrypt(messageEncrypted, privateDecryptedKey, verificationKeys);
+      expect(resultDecrypt).toEqual(messageClear);
+    }, 10 * 1000);
+
+    it("should encrypt asymmetrically and sign with multiple keys", async() => {
+      const messageClear = "message clear";
+      const publicKey = await OpenpgpAssertion.readKeyOrFail(pgpKeys.ada.public);
+      const signingKeyUserA = await OpenpgpAssertion.readKeyOrFail(pgpKeys.ada.private_decrypted);
+      const signingKeyUserB = await OpenpgpAssertion.readKeyOrFail(pgpKeys.betty.private_decrypted);
+
+      const resultEncrypt = await EncryptMessageService.encrypt(messageClear, publicKey, [signingKeyUserA, signingKeyUserB]);
+
+      expect.assertions(2);
+      expect(resultEncrypt).toBeTruthy();
+      const verificationKeys = [signingKeyUserA, signingKeyUserB];
+      const privateDecryptedKey = await OpenpgpAssertion.readKeyOrFail(pgpKeys.ada.private_decrypted);
+      const messageEncrypted = await OpenpgpAssertion.readMessageOrFail(resultEncrypt);
+      const resultDecrypt = await DecryptMessageService.decrypt(messageEncrypted, privateDecryptedKey, verificationKeys);
+      expect(resultDecrypt).toEqual(messageClear);
+    }, 10 * 1000);
+
+    it("should throw an error if the signing key is not a valid decrypted openpgp key", async() => {
+      const messageClear = "message clear";
+      const publicKey = await OpenpgpAssertion.readKeyOrFail(pgpKeys.ada.public);
+      const signingKey = await OpenpgpAssertion.readKeyOrFail(pgpKeys.ada.private);
+      const resultEncrypt = EncryptMessageService.encrypt(messageClear, publicKey, [signingKey]);
+
+      expect.assertions(1);
+      await expect(resultEncrypt).rejects.toThrow("The private key should be decrypted.");
+    });
+  });
+});