feat(fips): requested changes (function renaming)

backend/src/db/migrations/20250210101840_webhook-to-kms.ts

@@ -69,12 +69,15 @@ export async function up(knex: Knex): Promise<void> {
 
       let encryptedSecretKey = null;
       if (el.encryptedSecretKey && el.iv && el.tag && el.keyEncoding) {
-        const decyptedSecretKey = crypto.encryption().decryptWithRootEncryptionKey({
-          keyEncoding: el.keyEncoding as SecretKeyEncoding,
-          iv: el.iv,
-          tag: el.tag,
-          ciphertext: el.encryptedSecretKey
-        });
+        const decyptedSecretKey = crypto
+          .encryption()
+          .symmetric()
+          .decryptWithRootEncryptionKey({
+            keyEncoding: el.keyEncoding as SecretKeyEncoding,
+            iv: el.iv,
+            tag: el.tag,
+            ciphertext: el.encryptedSecretKey
+          });
         encryptedSecretKey = projectKmsService.encryptor({
           plainText: Buffer.from(decyptedSecretKey, "utf8")
         }).cipherTextBlob;
@@ -82,12 +85,15 @@ export async function up(knex: Knex): Promise<void> {
 
       const decryptedUrl =
         el.urlIV && el.urlTag && el.urlCipherText && el.keyEncoding
-          ? crypto.encryption().decryptWithRootEncryptionKey({
-              keyEncoding: el.keyEncoding as SecretKeyEncoding,
-              iv: el.urlIV,
-              tag: el.urlTag,
-              ciphertext: el.urlCipherText
-            })
+          ? crypto
+              .encryption()
+              .symmetric()
+              .decryptWithRootEncryptionKey({
+                keyEncoding: el.keyEncoding as SecretKeyEncoding,
+                iv: el.urlIV,
+                tag: el.urlTag,
+                ciphertext: el.urlCipherText
+              })
           : null;
 
       const encryptedUrl = projectKmsService.encryptor({

backend/src/db/migrations/20250210101841_dynamic-secret-root-to-kms.ts

@@ -63,20 +63,23 @@ export async function up(knex: Knex): Promise<void> {
         // eslint-disable-next-line @typescript-eslint/ban-ts-comment
         // @ts-ignore This will be removed in next cycle so ignore the ts missing error
         el.inputIV && el.inputTag && el.inputCiphertext && el.keyEncoding
-          ? crypto.encryption().decryptWithRootEncryptionKey({
-              // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-              // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-              keyEncoding: el.keyEncoding as SecretKeyEncoding,
-              // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-              // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-              iv: el.inputIV,
-              // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-              // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-              tag: el.inputTag,
-              // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-              // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-              ciphertext: el.inputCiphertext
-            })
+          ? crypto
+              .encryption()
+              .symmetric()
+              .decryptWithRootEncryptionKey({
+                // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+                // @ts-ignore This will be removed in next cycle so ignore the ts missing error
+                keyEncoding: el.keyEncoding as SecretKeyEncoding,
+                // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+                // @ts-ignore This will be removed in next cycle so ignore the ts missing error
+                iv: el.inputIV,
+                // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+                // @ts-ignore This will be removed in next cycle so ignore the ts missing error
+                tag: el.inputTag,
+                // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+                // @ts-ignore This will be removed in next cycle so ignore the ts missing error
+                ciphertext: el.inputCiphertext
+              })
           : "";
 
       const encryptedInput = projectKmsService.encryptor({

backend/src/db/migrations/20250210101841_secret-rotation-to-kms.ts

@@ -56,20 +56,23 @@ export async function up(knex: Knex): Promise<void> {
         // eslint-disable-next-line @typescript-eslint/ban-ts-comment
         // @ts-ignore This will be removed in next cycle so ignore the ts missing error
         el.encryptedDataTag && el.encryptedDataIV && el.encryptedData && el.keyEncoding
-          ? crypto.encryption().decryptWithRootEncryptionKey({
-              // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-              // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-              keyEncoding: el.keyEncoding as SecretKeyEncoding,
-              // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-              // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-              iv: el.encryptedDataIV,
-              // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-              // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-              tag: el.encryptedDataTag,
-              // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-              // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-              ciphertext: el.encryptedData
-            })
+          ? crypto
+              .encryption()
+              .symmetric()
+              .decryptWithRootEncryptionKey({
+                // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+                // @ts-ignore This will be removed in next cycle so ignore the ts missing error
+                keyEncoding: el.keyEncoding as SecretKeyEncoding,
+                // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+                // @ts-ignore This will be removed in next cycle so ignore the ts missing error
+                iv: el.encryptedDataIV,
+                // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+                // @ts-ignore This will be removed in next cycle so ignore the ts missing error
+                tag: el.encryptedDataTag,
+                // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+                // @ts-ignore This will be removed in next cycle so ignore the ts missing error
+                ciphertext: el.encryptedData
+              })
           : "";
 
       const encryptedRotationData = projectKmsService.encryptor({

backend/src/db/migrations/20250210101842_identity-k8-auth-to-kms.ts

@@ -102,18 +102,21 @@ const reencryptIdentityK8sAuth = async (knex: Knex) => {
       orgEncryptionRingBuffer.push(orgId, orgKmsService);
     }
 
-    const key = crypto.encryption().decryptWithRootEncryptionKey({
-      ciphertext: encryptedSymmetricKey,
-      iv: symmetricKeyIV,
-      tag: symmetricKeyTag,
-      keyEncoding: symmetricKeyKeyEncoding as SecretKeyEncoding
-    });
+    const key = crypto
+      .encryption()
+      .symmetric()
+      .decryptWithRootEncryptionKey({
+        ciphertext: encryptedSymmetricKey,
+        iv: symmetricKeyIV,
+        tag: symmetricKeyTag,
+        keyEncoding: symmetricKeyKeyEncoding as SecretKeyEncoding
+      });
 
     const decryptedTokenReviewerJwt =
       // eslint-disable-next-line @typescript-eslint/ban-ts-comment
       // @ts-ignore This will be removed in next cycle so ignore the ts missing error
       el.encryptedTokenReviewerJwt && el.tokenReviewerJwtIV && el.tokenReviewerJwtTag
-        ? crypto.encryption().decryptSymmetric({
+        ? crypto.encryption().symmetric().decrypt({
             key,
             keySize: SymmetricKeySize.Bits256,
             // eslint-disable-next-line @typescript-eslint/ban-ts-comment
@@ -132,7 +135,7 @@ const reencryptIdentityK8sAuth = async (knex: Knex) => {
       // eslint-disable-next-line @typescript-eslint/ban-ts-comment
       // @ts-ignore This will be removed in next cycle so ignore the ts missing error
       el.encryptedCaCert && el.caCertIV && el.caCertTag
-        ? crypto.encryption().decryptSymmetric({
+        ? crypto.encryption().symmetric().decrypt({
             key,
             keySize: SymmetricKeySize.Bits256,
             // eslint-disable-next-line @typescript-eslint/ban-ts-comment

backend/src/db/migrations/20250210101842_identity-oidc-auth-to-kms.ts

@@ -75,18 +75,21 @@ const reencryptIdentityOidcAuth = async (knex: Knex) => {
           orgEncryptionRingBuffer.push(orgId, orgKmsService);
         }
 
-        const key = crypto.encryption().decryptWithRootEncryptionKey({
-          ciphertext: encryptedSymmetricKey,
-          iv: symmetricKeyIV,
-          tag: symmetricKeyTag,
-          keyEncoding: symmetricKeyKeyEncoding as SecretKeyEncoding
-        });
+        const key = crypto
+          .encryption()
+          .symmetric()
+          .decryptWithRootEncryptionKey({
+            ciphertext: encryptedSymmetricKey,
+            iv: symmetricKeyIV,
+            tag: symmetricKeyTag,
+            keyEncoding: symmetricKeyKeyEncoding as SecretKeyEncoding
+          });
 
         const decryptedCertificate =
           // eslint-disable-next-line @typescript-eslint/ban-ts-comment
           // @ts-ignore This will be removed in next cycle so ignore the ts missing error
           el.encryptedCaCert && el.caCertIV && el.caCertTag
-            ? crypto.encryption().decryptSymmetric({
+            ? crypto.encryption().symmetric().decrypt({
                 key,
                 keySize: SymmetricKeySize.Bits256,
                 // eslint-disable-next-line @typescript-eslint/ban-ts-comment

backend/src/db/migrations/20250210101845_directory-config-to-kms.ts

@@ -5,12 +5,12 @@ import { crypto, SymmetricKeySize } from "@app/lib/crypto/cryptography";
 import { selectAllTableCols } from "@app/lib/knex";
 import { initLogger } from "@app/lib/logger";
 import { KmsDataKey } from "@app/services/kms/kms-types";
+import { superAdminDALFactory } from "@app/services/super-admin/super-admin-dal";
 
 import { SecretKeyEncoding, TableName } from "../schemas";
 import { getMigrationEnvConfig } from "./utils/env-config";
 import { createCircularCache } from "./utils/ring-buffer";
 import { getMigrationEncryptionServices } from "./utils/services";
-import { superAdminDALFactory } from "@app/services/super-admin/super-admin-dal";
 
 const BATCH_SIZE = 500;
 const reencryptSamlConfig = async (knex: Knex) => {
@@ -61,18 +61,21 @@ const reencryptSamlConfig = async (knex: Knex) => {
           orgEncryptionRingBuffer.push(el.orgId, orgKmsService);
         }
 
-        const key = crypto.encryption().decryptWithRootEncryptionKey({
-          ciphertext: encryptedSymmetricKey,
-          iv: symmetricKeyIV,
-          tag: symmetricKeyTag,
-          keyEncoding: symmetricKeyKeyEncoding as SecretKeyEncoding
-        });
+        const key = crypto
+          .encryption()
+          .symmetric()
+          .decryptWithRootEncryptionKey({
+            ciphertext: encryptedSymmetricKey,
+            iv: symmetricKeyIV,
+            tag: symmetricKeyTag,
+            keyEncoding: symmetricKeyKeyEncoding as SecretKeyEncoding
+          });
 
         const decryptedEntryPoint =
           // eslint-disable-next-line @typescript-eslint/ban-ts-comment
           // @ts-ignore This will be removed in next cycle so ignore the ts missing error
           el.encryptedEntryPoint && el.entryPointIV && el.entryPointTag
-            ? crypto.encryption().decryptSymmetric({
+            ? crypto.encryption().symmetric().decrypt({
                 key,
                 keySize: SymmetricKeySize.Bits256,
                 // eslint-disable-next-line @typescript-eslint/ban-ts-comment
@@ -91,7 +94,7 @@ const reencryptSamlConfig = async (knex: Knex) => {
           // eslint-disable-next-line @typescript-eslint/ban-ts-comment
           // @ts-ignore This will be removed in next cycle so ignore the ts missing error
           el.encryptedIssuer && el.issuerIV && el.issuerTag
-            ? crypto.encryption().decryptSymmetric({
+            ? crypto.encryption().symmetric().decrypt({
                 key,
                 keySize: SymmetricKeySize.Bits256,
                 // eslint-disable-next-line @typescript-eslint/ban-ts-comment
@@ -110,7 +113,7 @@ const reencryptSamlConfig = async (knex: Knex) => {
           // eslint-disable-next-line @typescript-eslint/ban-ts-comment
           // @ts-ignore This will be removed in next cycle so ignore the ts missing error
           el.encryptedCert && el.certIV && el.certTag
-            ? crypto.encryption().decryptSymmetric({
+            ? crypto.encryption().symmetric().decrypt({
                 key,
                 keySize: SymmetricKeySize.Bits256,
                 // eslint-disable-next-line @typescript-eslint/ban-ts-comment
@@ -224,18 +227,21 @@ const reencryptLdapConfig = async (knex: Knex) => {
           orgEncryptionRingBuffer.push(el.orgId, orgKmsService);
         }
 
-        const key = crypto.encryption().decryptWithRootEncryptionKey({
-          ciphertext: encryptedSymmetricKey,
-          iv: symmetricKeyIV,
-          tag: symmetricKeyTag,
-          keyEncoding: symmetricKeyKeyEncoding as SecretKeyEncoding
-        });
+        const key = crypto
+          .encryption()
+          .symmetric()
+          .decryptWithRootEncryptionKey({
+            ciphertext: encryptedSymmetricKey,
+            iv: symmetricKeyIV,
+            tag: symmetricKeyTag,
+            keyEncoding: symmetricKeyKeyEncoding as SecretKeyEncoding
+          });
 
         const decryptedBindDN =
           // eslint-disable-next-line @typescript-eslint/ban-ts-comment
           // @ts-ignore This will be removed in next cycle so ignore the ts missing error
           el.encryptedBindDN && el.bindDNIV && el.bindDNTag
-            ? crypto.encryption().decryptSymmetric({
+            ? crypto.encryption().symmetric().decrypt({
                 key,
                 keySize: SymmetricKeySize.Bits256,
                 // eslint-disable-next-line @typescript-eslint/ban-ts-comment
@@ -254,7 +260,7 @@ const reencryptLdapConfig = async (knex: Knex) => {
           // eslint-disable-next-line @typescript-eslint/ban-ts-comment
           // @ts-ignore This will be removed in next cycle so ignore the ts missing error
           el.encryptedBindPass && el.bindPassIV && el.bindPassTag
-            ? crypto.encryption().decryptSymmetric({
+            ? crypto.encryption().symmetric().decrypt({
                 key,
                 keySize: SymmetricKeySize.Bits256,
                 // eslint-disable-next-line @typescript-eslint/ban-ts-comment
@@ -273,7 +279,7 @@ const reencryptLdapConfig = async (knex: Knex) => {
           // eslint-disable-next-line @typescript-eslint/ban-ts-comment
           // @ts-ignore This will be removed in next cycle so ignore the ts missing error
           el.encryptedCACert && el.caCertIV && el.caCertTag
-            ? crypto.encryption().decryptSymmetric({
+            ? crypto.encryption().symmetric().decrypt({
                 key,
                 keySize: SymmetricKeySize.Bits256,
                 // eslint-disable-next-line @typescript-eslint/ban-ts-comment
@@ -381,18 +387,21 @@ const reencryptOidcConfig = async (knex: Knex) => {
           orgEncryptionRingBuffer.push(el.orgId, orgKmsService);
         }
 
-        const key = crypto.encryption().decryptWithRootEncryptionKey({
-          ciphertext: encryptedSymmetricKey,
-          iv: symmetricKeyIV,
-          tag: symmetricKeyTag,
-          keyEncoding: symmetricKeyKeyEncoding as SecretKeyEncoding
-        });
+        const key = crypto
+          .encryption()
+          .symmetric()
+          .decryptWithRootEncryptionKey({
+            ciphertext: encryptedSymmetricKey,
+            iv: symmetricKeyIV,
+            tag: symmetricKeyTag,
+            keyEncoding: symmetricKeyKeyEncoding as SecretKeyEncoding
+          });
 
         const decryptedClientId =
           // eslint-disable-next-line @typescript-eslint/ban-ts-comment
           // @ts-ignore This will be removed in next cycle so ignore the ts missing error
           el.encryptedClientId && el.clientIdIV && el.clientIdTag
-            ? crypto.encryption().decryptSymmetric({
+            ? crypto.encryption().symmetric().decrypt({
                 key,
                 keySize: SymmetricKeySize.Bits256,
                 // eslint-disable-next-line @typescript-eslint/ban-ts-comment
@@ -411,7 +420,7 @@ const reencryptOidcConfig = async (knex: Knex) => {
           // eslint-disable-next-line @typescript-eslint/ban-ts-comment
           // @ts-ignore This will be removed in next cycle so ignore the ts missing error
           el.encryptedClientSecret && el.clientSecretIV && el.clientSecretTag
-            ? crypto.encryption().decryptSymmetric({
+            ? crypto.encryption().symmetric().decrypt({
                 key,
                 keySize: SymmetricKeySize.Bits256,
                 // eslint-disable-next-line @typescript-eslint/ban-ts-comment

backend/src/db/seed-data.ts

@@ -84,7 +84,7 @@ export const generateUserSrpKeys = async (password: string) => {
     ciphertext: encryptedPrivateKey,
     iv: encryptedPrivateKeyIV,
     tag: encryptedPrivateKeyTag
-  } = crypto.encryption().encryptSymmetric({
+  } = crypto.encryption().symmetric().encrypt({
     plaintext: privateKey,
     key,
     keySize: SymmetricKeySize.Bits128
@@ -98,7 +98,8 @@ export const generateUserSrpKeys = async (password: string) => {
     tag: protectedKeyTag
   } = crypto
     .encryption()
-    .encryptSymmetric({ plaintext: key.toString("hex"), key: derivedKey, keySize: SymmetricKeySize.Bits128 });
+    .symmetric()
+    .encrypt({ plaintext: key.toString("hex"), key: derivedKey, keySize: SymmetricKeySize.Bits128 });
 
   return {
     protectedKey,
@@ -125,21 +126,27 @@ export const getUserPrivateKey = async (password: string, user: TUserEncryptionK
   });
   if (!derivedKey) throw new Error("Failed to derive key from password");
 
-  const key = crypto.encryption().decryptSymmetric({
-    ciphertext: user.protectedKey as string,
-    iv: user.protectedKeyIV as string,
-    tag: user.protectedKeyTag as string,
-    key: derivedKey,
-    keySize: SymmetricKeySize.Bits128
-  });
+  const key = crypto
+    .encryption()
+    .symmetric()
+    .decrypt({
+      ciphertext: user.protectedKey as string,
+      iv: user.protectedKeyIV as string,
+      tag: user.protectedKeyTag as string,
+      key: derivedKey,
+      keySize: SymmetricKeySize.Bits128
+    });
 
-  const privateKey = crypto.encryption().decryptSymmetric({
-    ciphertext: user.encryptedPrivateKey,
-    iv: user.iv,
-    tag: user.tag,
-    key: Buffer.from(key, "hex"),
-    keySize: SymmetricKeySize.Bits128
-  });
+  const privateKey = crypto
+    .encryption()
+    .symmetric()
+    .decrypt({
+      ciphertext: user.encryptedPrivateKey,
+      iv: user.iv,
+      tag: user.tag,
+      key: Buffer.from(key, "hex"),
+      keySize: SymmetricKeySize.Bits128
+    });
   return privateKey;
 };
 
@@ -164,7 +171,7 @@ export const encryptSecret = (encKey: string, key: string, value?: string, comme
     ciphertext: secretKeyCiphertext,
     iv: secretKeyIV,
     tag: secretKeyTag
-  } = crypto.encryption().encryptSymmetric({
+  } = crypto.encryption().symmetric().encrypt({
     plaintext: key,
     key: encKey,
     keySize: SymmetricKeySize.Bits128
@@ -175,22 +182,28 @@ export const encryptSecret = (encKey: string, key: string, value?: string, comme
     ciphertext: secretValueCiphertext,
     iv: secretValueIV,
     tag: secretValueTag
-  } = crypto.encryption().encryptSymmetric({
-    plaintext: value ?? "",
-    key: encKey,
-    keySize: SymmetricKeySize.Bits128
-  });
+  } = crypto
+    .encryption()
+    .symmetric()
+    .encrypt({
+      plaintext: value ?? "",
+      key: encKey,
+      keySize: SymmetricKeySize.Bits128
+    });
 
   // encrypt comment
   const {
     ciphertext: secretCommentCiphertext,
     iv: secretCommentIV,
     tag: secretCommentTag
-  } = crypto.encryption().encryptSymmetric({
-    plaintext: comment ?? "",
-    key: encKey,
-    keySize: SymmetricKeySize.Bits128
-  });
+  } = crypto
+    .encryption()
+    .symmetric()
+    .encrypt({
+      plaintext: comment ?? "",
+      key: encKey,
+      keySize: SymmetricKeySize.Bits128
+    });
 
   return {
     secretKeyCiphertext,
@@ -206,7 +219,7 @@ export const encryptSecret = (encKey: string, key: string, value?: string, comme
 };
 
 export const decryptSecret = (decryptKey: string, encSecret: TSecrets) => {
-  const secretKey = crypto.encryption().decryptSymmetric({
+  const secretKey = crypto.encryption().symmetric().decrypt({
     key: decryptKey,
     ciphertext: encSecret.secretKeyCiphertext,
     tag: encSecret.secretKeyTag,
@@ -214,7 +227,7 @@ export const decryptSecret = (decryptKey: string, encSecret: TSecrets) => {
     keySize: SymmetricKeySize.Bits128
   });
 
-  const secretValue = crypto.encryption().decryptSymmetric({
+  const secretValue = crypto.encryption().symmetric().decrypt({
     key: decryptKey,
     ciphertext: encSecret.secretValueCiphertext,
     tag: encSecret.secretValueTag,
@@ -224,7 +237,7 @@ export const decryptSecret = (decryptKey: string, encSecret: TSecrets) => {
 
   const secretComment =
     encSecret.secretCommentIV && encSecret.secretCommentTag && encSecret.secretCommentCiphertext
-      ? crypto.encryption().decryptSymmetric({
+      ? crypto.encryption().symmetric().decrypt({
           key: decryptKey,
           ciphertext: encSecret.secretCommentCiphertext,
           tag: encSecret.secretCommentTag,

backend/src/db/seeds/3-project.ts

@@ -70,7 +70,7 @@ export async function seed(knex: Knex): Promise<void> {
   const encKey = process.env.ENCRYPTION_KEY;
   if (!encKey) throw new Error("Missing ENCRYPTION_KEY");
   const salt = crypto.randomBytes(16).toString("base64");
-  const secretBlindIndex = crypto.encryption().encryptSymmetric({
+  const secretBlindIndex = crypto.encryption().symmetric().encrypt({
     plaintext: salt,
     key: encKey,
     keySize: SymmetricKeySize.Bits128