From c0926bec6973681ee677689808c1ddf47bf04535 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Mon, 14 Apr 2025 21:36:38 +0400 Subject: [PATCH] fix: no check for encryption algorithm on external KMS --- backend/src/services/kms/kms-service.ts | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/backend/src/services/kms/kms-service.ts b/backend/src/services/kms/kms-service.ts index 754c9be76..07ed90bef 100644 --- a/backend/src/services/kms/kms-service.ts +++ b/backend/src/services/kms/kms-service.ts @@ -288,11 +288,6 @@ export const kmsServiceFactory = ({ throw new NotFoundError({ message: `KMS with ID '${kmsId}' not found` }); } - const encryptionAlgorithm = kmsDoc.internalKms?.encryptionAlgorithm as SymmetricKeyAlgorithm; - verifyKeyTypeAndAlgorithm(kmsDoc.keyUsage as KmsKeyUsage, encryptionAlgorithm, { - forceType: KmsKeyUsage.ENCRYPT_DECRYPT - }); - if (kmsDoc.externalKms) { let externalKms: TExternalKmsProviderFns; @@ -353,6 +348,11 @@ export const kmsServiceFactory = ({ }; } + const encryptionAlgorithm = kmsDoc.internalKms?.encryptionAlgorithm as SymmetricKeyAlgorithm; + verifyKeyTypeAndAlgorithm(kmsDoc.keyUsage as KmsKeyUsage, encryptionAlgorithm, { + forceType: KmsKeyUsage.ENCRYPT_DECRYPT + }); + // internal KMS const keyCipher = symmetricCipherService(SymmetricKeyAlgorithm.AES_GCM_256); const dataCipher = symmetricCipherService(encryptionAlgorithm); @@ -509,11 +509,6 @@ export const kmsServiceFactory = ({ throw new NotFoundError({ message: `KMS with ID '${kmsId}' not found` }); } - const encryptionAlgorithm = kmsDoc.internalKms?.encryptionAlgorithm as SymmetricKeyAlgorithm; - verifyKeyTypeAndAlgorithm(kmsDoc.keyUsage as KmsKeyUsage, encryptionAlgorithm, { - forceType: KmsKeyUsage.ENCRYPT_DECRYPT - }); - if (kmsDoc.externalKms) { let externalKms: TExternalKmsProviderFns; if (!kmsDoc.orgKms.id || !kmsDoc.orgKms.encryptedDataKey) { @@ -568,6 +563,11 @@ export const kmsServiceFactory = ({ }; } + const encryptionAlgorithm = kmsDoc.internalKms?.encryptionAlgorithm as SymmetricKeyAlgorithm; + verifyKeyTypeAndAlgorithm(kmsDoc.keyUsage as KmsKeyUsage, encryptionAlgorithm, { + forceType: KmsKeyUsage.ENCRYPT_DECRYPT + }); + // internal KMS const keyCipher = symmetricCipherService(SymmetricKeyAlgorithm.AES_GCM_256); const dataCipher = symmetricCipherService(encryptionAlgorithm);