feat: HSM support

backend/src/lib/config/env.ts

@@ -176,7 +176,7 @@ const envSchema = z
         .string()
         .optional()
         .transform((val) => {
-          if (process.env.NODE_ENV === "development") return "/usr/local/lib/softhsm/libsofthsm2.so";
+          // if (process.env.NODE_ENV === "development") return "/usr/local/lib/softhsm/libsofthsm2.so";
           return val;
         })
     ),
@@ -201,6 +201,11 @@ const envSchema = z
     HSM_SLOT: z.coerce.number().optional().default(0),
     HSM_MECHANISM: zpStr(z.string().optional().default("AES_GCM"))
   })
+  // To ensure that basic encryption is always possible.
+  .refine(
+    (data) => data.ENCRYPTION_KEY != null || data.ROOT_ENCRYPTION_KEY != null,
+    "Either ENCRYPTION_KEY or ROOT_ENCRYPTION_KEY must be defined."
+  )
   .transform((data) => ({
     ...data,
 

backend/src/lib/crypto/index.ts

@@ -18,5 +18,6 @@ export {
   decryptSecrets,
   decryptSecretVersions
 } from "./secret-encryption";
+export { shamirsService } from "./shamirs";
 export { verifyOfflineLicense } from "./signing";
 export { generateSrpServerKey, srpCheckClientProof } from "./srp";

backend/src/lib/crypto/shamirs.ts

@@ -0,0 +1,38 @@
+import shamirs from "secrets.js-grempe";
+
+import { getConfig } from "../config/env";
+import { symmetricCipherService, SymmetricEncryption } from "./cipher";
+
+export const shamirsService = () => {
+  const $generateBasicEncryptionKey = () => {
+    const appCfg = getConfig();
+
+    const encryptionKey = appCfg.ENCRYPTION_KEY || appCfg.ROOT_ENCRYPTION_KEY;
+    const isBase64 = !appCfg.ENCRYPTION_KEY;
+    if (!encryptionKey)
+      throw new Error(
+        "Root encryption key not found for KMS service. Did you set the ENCRYPTION_KEY or ROOT_ENCRYPTION_KEY environment variables?"
+      );
+
+    return Buffer.from(encryptionKey, isBase64 ? "base64" : "utf8");
+  };
+
+  const share = (secretBuffer: Buffer, partsCount: number, thresholdCount: number) => {
+    const cipher = symmetricCipherService(SymmetricEncryption.AES_GCM_256);
+    const hexSecret = Buffer.from(cipher.encrypt(secretBuffer, $generateBasicEncryptionKey())).toString("hex");
+
+    const secretParts = shamirs.share(hexSecret, partsCount, thresholdCount);
+    return secretParts;
+  };
+
+  const combine = (parts: string[]) => {
+    const encryptedSecret = shamirs.combine(parts);
+
+    const cipher = symmetricCipherService(SymmetricEncryption.AES_GCM_256);
+    const decryptedSecret = cipher.decrypt(Buffer.from(encryptedSecret, "hex"), $generateBasicEncryptionKey());
+
+    return decryptedSecret;
+  };
+
+  return { share, combine };
+};