Merge pull request #3973 from Infisical/daniel/fips-initative

feat(fips): native FIPS support

backend/src/services/org/org-service.ts

@@ -1,7 +1,5 @@
 import { ForbiddenError } from "@casl/ability";
 import slugify from "@sindresorhus/slugify";
-import crypto from "crypto";
-import jwt from "jsonwebtoken";
 import { Knex } from "knex";
 
 import {
@@ -33,8 +31,7 @@ import { ProjectPermissionMemberActions, ProjectPermissionSub } from "@app/ee/se
 import { TProjectUserAdditionalPrivilegeDALFactory } from "@app/ee/services/project-user-additional-privilege/project-user-additional-privilege-dal";
 import { TSamlConfigDALFactory } from "@app/ee/services/saml-config/saml-config-dal";
 import { getConfig } from "@app/lib/config/env";
-import { generateAsymmetricKeyPair } from "@app/lib/crypto";
-import { generateSymmetricKey, infisicalSymmetricDecrypt, infisicalSymmetricEncypt } from "@app/lib/crypto/encryption";
+import { crypto } from "@app/lib/crypto/cryptography";
 import { generateUserSrpKeys } from "@app/lib/crypto/srp";
 import { applyJitter } from "@app/lib/dates";
 import { delay as delayMs } from "@app/lib/delay";
@@ -261,6 +258,7 @@ export const orgServiceFactory = ({
 
   const addGhostUser = async (orgId: string, tx?: Knex) => {
     const email = `sudo-${alphaNumericNanoId(16)}-${orgId}@infisical.com`; // We add a nanoid because the email is unique. And we have to create a new ghost user each time, so we can have access to the private key.
+
     const password = crypto.randomBytes(128).toString("hex");
 
     const user = await userDAL.create(
@@ -502,22 +500,22 @@ export const orgServiceFactory = ({
     orgName: string;
     userEmail?: string | null;
   }) => {
-    const { privateKey, publicKey } = generateAsymmetricKeyPair();
-    const key = generateSymmetricKey();
+    const { privateKey, publicKey } = await crypto.encryption().asymmetric().generateKeyPair();
+    const key = crypto.randomBytes(32).toString("base64");
     const {
       ciphertext: encryptedPrivateKey,
       iv: privateKeyIV,
       tag: privateKeyTag,
       encoding: privateKeyKeyEncoding,
       algorithm: privateKeyAlgorithm
-    } = infisicalSymmetricEncypt(privateKey);
+    } = crypto.encryption().symmetric().encryptWithRootEncryptionKey(privateKey);
     const {
       ciphertext: encryptedSymmetricKey,
       iv: symmetricKeyIV,
       tag: symmetricKeyTag,
       encoding: symmetricKeyKeyEncoding,
       algorithm: symmetricKeyAlgorithm
-    } = infisicalSymmetricEncypt(key);
+    } = crypto.encryption().symmetric().encryptWithRootEncryptionKey(key);
 
     const customerId = await licenseService.generateOrgCustomerId(orgName, userEmail);
     const organization = await orgDAL.transaction(async (tx) => {
@@ -600,7 +598,7 @@ export const orgServiceFactory = ({
     const cfg = getConfig();
     const authToken = authorizationHeader.replace("Bearer ", "");
 
-    const decodedToken = jwt.verify(authToken, cfg.AUTH_SECRET) as AuthModeJwtTokenPayload;
+    const decodedToken = crypto.jwt().verify(authToken, cfg.AUTH_SECRET) as AuthModeJwtTokenPayload;
     if (!decodedToken.authMethod) throw new UnauthorizedError({ name: "Auth method not found on existing token" });
 
     const response = await orgDAL.transaction(async (tx) => {
@@ -839,6 +837,7 @@ export const orgServiceFactory = ({
     const mailsForOrgInvitation: { email: string; userId: string; firstName: string; lastName: string }[] = [];
     const mailsForProjectInvitation: { email: string[]; projectName: string }[] = [];
     const newProjectMemberships: TProjectMemberships[] = [];
+
     await orgDAL.transaction(async (tx) => {
       const users: Pick<TUsers, "id" | "firstName" | "lastName" | "email" | "username">[] = [];
 
@@ -878,7 +877,10 @@ export const orgServiceFactory = ({
         // Then when user sign in (as login is not possible as isAccepted is false) we rencrypt the private key with the user password
         if (!inviteeUser || (inviteeUser && !inviteeUser?.isAccepted && !existingEncrytionKey)) {
           const serverGeneratedPassword = crypto.randomBytes(32).toString("hex");
-          const { tag, encoding, ciphertext, iv } = infisicalSymmetricEncypt(serverGeneratedPassword);
+          const { tag, encoding, ciphertext, iv } = crypto
+            .encryption()
+            .symmetric()
+            .encryptWithRootEncryptionKey(serverGeneratedPassword);
           const encKeys = await generateUserSrpKeys(inviteeEmail, serverGeneratedPassword);
           await userDAL.createUserEncryption(
             {
@@ -1096,9 +1098,10 @@ export const orgServiceFactory = ({
             tx
           );
 
-          const { iv, tag, ciphertext, encoding, algorithm } = infisicalSymmetricEncypt(
-            newGhostUser.keys.plainPrivateKey
-          );
+          const { iv, tag, ciphertext, encoding, algorithm } = crypto
+            .encryption()
+            .symmetric()
+            .encryptWithRootEncryptionKey(newGhostUser.keys.plainPrivateKey);
           if (autoGeneratedBot) {
             await projectBotDAL.updateById(
               autoGeneratedBot.id,
@@ -1136,12 +1139,15 @@ export const orgServiceFactory = ({
           });
         }
 
-        const botPrivateKey = infisicalSymmetricDecrypt({
-          keyEncoding: bot.keyEncoding as SecretKeyEncoding,
-          iv: bot.iv,
-          tag: bot.tag,
-          ciphertext: bot.encryptedPrivateKey
-        });
+        const botPrivateKey = crypto
+          .encryption()
+          .symmetric()
+          .decryptWithRootEncryptionKey({
+            keyEncoding: bot.keyEncoding as SecretKeyEncoding,
+            iv: bot.iv,
+            tag: bot.tag,
+            ciphertext: bot.encryptedPrivateKey
+          });
 
         const newWsMembers = assignWorkspaceKeysToMembers({
           decryptKey: ghostUserLatestKey,
@@ -1306,7 +1312,7 @@ export const orgServiceFactory = ({
     }
 
     const appCfg = getConfig();
-    const token = jwt.sign(
+    const token = crypto.jwt().sign(
       {
         authTokenType: AuthTokenType.SIGNUP_TOKEN,
         userId: user.id