feat(kms): sign & verify data

backend/src/services/kms/kms-fns.ts

@@ -1,13 +1,55 @@
-import { SymmetricEncryption } from "@app/lib/crypto/cipher";
+import { SymmetricKeyEncryptDecrypt } from "@app/lib/crypto/cipher";
+import { AsymmetricKeySignVerify } from "@app/lib/crypto/sign";
+import { BadRequestError } from "@app/lib/errors";
+
+import { KmsKeyIntent } from "./kms-types";
 
 export const KMS_ROOT_CONFIG_UUID = "00000000-0000-0000-0000-000000000000";
 
-export const getByteLengthForAlgorithm = (encryptionAlgorithm: SymmetricEncryption) => {
+export const getByteLengthForSymmetricEncryptionAlgorithm = (encryptionAlgorithm: SymmetricKeyEncryptDecrypt) => {
   switch (encryptionAlgorithm) {
-    case SymmetricEncryption.AES_GCM_128:
+    case SymmetricKeyEncryptDecrypt.AES_GCM_128:
       return 16;
-    case SymmetricEncryption.AES_GCM_256:
+    case SymmetricKeyEncryptDecrypt.AES_GCM_256:
     default:
       return 32;
   }
 };
+
+export const verifyKeyTypeAndAlgorithm = (
+  type: KmsKeyIntent,
+  algorithm: SymmetricKeyEncryptDecrypt | AsymmetricKeySignVerify,
+  extra?: {
+    forceType?: KmsKeyIntent;
+  }
+) => {
+  if (extra?.forceType && type !== extra.forceType) {
+    throw new BadRequestError({
+      message: `Unsupported key type, expected ${extra.forceType} but got ${type}`
+    });
+  }
+
+  if (type === KmsKeyIntent.ENCRYPT_DECRYPT) {
+    if (!Object.values(SymmetricKeyEncryptDecrypt).includes(algorithm as SymmetricKeyEncryptDecrypt)) {
+      throw new BadRequestError({
+        message: `Unsupported encryption algorithm for encrypt/decrypt key: ${algorithm as string}`
+      });
+    }
+
+    return true;
+  }
+
+  if (type === KmsKeyIntent.SIGN_VERIFY) {
+    if (!Object.values(AsymmetricKeySignVerify).includes(algorithm as AsymmetricKeySignVerify)) {
+      throw new BadRequestError({
+        message: `Unsupported sign/verify algorithm for sign/verify key: ${algorithm as string}`
+      });
+    }
+
+    return true;
+  }
+
+  throw new BadRequestError({
+    message: `Unsupported key type: ${type as string}`
+  });
+};

backend/src/services/kms/kms-service.ts

@@ -1,3 +1,5 @@
+import crypto from "node:crypto";
+
 import slugify from "@sindresorhus/slugify";
 import { Knex } from "knex";
 import { z } from "zod";
@@ -15,12 +17,17 @@ import { THsmServiceFactory } from "@app/ee/services/hsm/hsm-service";
 import { KeyStorePrefixes, PgSqlLock, TKeyStoreFactory } from "@app/keystore/keystore";
 import { TEnvConfig } from "@app/lib/config/env";
 import { randomSecureBytes } from "@app/lib/crypto";
-import { symmetricCipherService, SymmetricEncryption } from "@app/lib/crypto/cipher";
+import { symmetricCipherService, SymmetricKeyEncryptDecrypt } from "@app/lib/crypto/cipher";
 import { generateHash } from "@app/lib/crypto/encryption";
+import { AsymmetricKeySignVerify, signingService } from "@app/lib/crypto/sign";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
-import { getByteLengthForAlgorithm, KMS_ROOT_CONFIG_UUID } from "@app/services/kms/kms-fns";
+import {
+  getByteLengthForSymmetricEncryptionAlgorithm,
+  KMS_ROOT_CONFIG_UUID,
+  verifyKeyTypeAndAlgorithm
+} from "@app/services/kms/kms-fns";
 
 import { TOrgDALFactory } from "../org/org-dal";
 import { TProjectDALFactory } from "../project/project-dal";
@@ -29,6 +36,7 @@ import { TKmsKeyDALFactory } from "./kms-key-dal";
 import { TKmsRootConfigDALFactory } from "./kms-root-config-dal";
 import {
   KmsDataKey,
+  KmsKeyIntent,
   KmsType,
   RootKeyEncryptionStrategy,
   TDecryptWithKeyDTO,
@@ -38,8 +46,11 @@ import {
   TEncryptWithKmsDTO,
   TGenerateKMSDTO,
   TGetKeyMaterialDTO,
+  TGetPublicKeyDTO,
   TImportKeyMaterialDTO,
-  TUpdateProjectSecretManagerKmsKeyDTO
+  TSignWithKmsDTO,
+  TUpdateProjectSecretManagerKmsKeyDTO,
+  TVerifyWithKmsDTO
 } from "./kms-types";
 
 type TKmsServiceFactoryDep = {
@@ -83,19 +94,42 @@ export const kmsServiceFactory = ({
     tx,
     name,
     projectId,
-    encryptionAlgorithm = SymmetricEncryption.AES_GCM_256,
+    encryptionAlgorithm = SymmetricKeyEncryptDecrypt.AES_GCM_256,
+    type = KmsKeyIntent.ENCRYPT_DECRYPT,
     description
   }: TGenerateKMSDTO) => {
-    const cipher = symmetricCipherService(SymmetricEncryption.AES_GCM_256);
+    // daniel: ensure that the key type (sign/encrypt) and the encryption algorithm are compatible.
+    verifyKeyTypeAndAlgorithm(type, encryptionAlgorithm);
 
-    const kmsKeyMaterial = randomSecureBytes(getByteLengthForAlgorithm(encryptionAlgorithm));
+    let kmsKeyMaterial: Buffer | null = null;
+    if (type === KmsKeyIntent.ENCRYPT_DECRYPT) {
+      kmsKeyMaterial = randomSecureBytes(
+        getByteLengthForSymmetricEncryptionAlgorithm(encryptionAlgorithm as SymmetricKeyEncryptDecrypt)
+      );
+    } else if (type === KmsKeyIntent.SIGN_VERIFY) {
+      const { generateAsymmetricPrivateKey, getPublicKeyFromPrivateKey } = signingService(
+        encryptionAlgorithm as AsymmetricKeySignVerify
+      );
+      kmsKeyMaterial = await generateAsymmetricPrivateKey();
 
+      // daniel: safety check to ensure we're able to extract the public key from the private key before we proceed to key creation
+      getPublicKeyFromPrivateKey(kmsKeyMaterial);
+    }
+
+    if (!kmsKeyMaterial) {
+      throw new BadRequestError({
+        message: `Invalid KMS key type. No key material was created for key type '${type}' using algorithm '${encryptionAlgorithm}'`
+      });
+    }
+
+    const cipher = symmetricCipherService(SymmetricKeyEncryptDecrypt.AES_GCM_256);
     const encryptedKeyMaterial = cipher.encrypt(kmsKeyMaterial, ROOT_ENCRYPTION_KEY);
     const sanitizedName = name ? slugify(name) : slugify(alphaNumericNanoId(8).toLowerCase());
     const dbQuery = async (db: Knex) => {
       const kmsDoc = await kmsDAL.create(
         {
           name: sanitizedName,
+          type,
           orgId,
           isReserved,
           projectId,
@@ -115,6 +149,7 @@ export const kmsServiceFactory = ({
       );
       return kmsDoc;
     };
+
     if (tx) return dbQuery(tx);
     const doc = await kmsDAL.transaction(async (tx2) => dbQuery(tx2));
     return doc;
@@ -134,7 +169,7 @@ export const kmsServiceFactory = ({
    */
   const encryptWithInputKey = async ({ key }: Omit<TEncryptionWithKeyDTO, "plainText">) => {
     // akhilmhdh: as more encryption are added do a check here on kmsDoc.encryptionAlgorithm
-    const cipher = symmetricCipherService(SymmetricEncryption.AES_GCM_256);
+    const cipher = symmetricCipherService(SymmetricKeyEncryptDecrypt.AES_GCM_256);
     return ({ plainText }: Pick<TEncryptWithKmsDTO, "plainText">) => {
       const encryptedPlainTextBlob = cipher.encrypt(plainText, key);
       // Buffer#1 encrypted text + Buffer#2 version number
@@ -149,7 +184,7 @@ export const kmsServiceFactory = ({
    * This can be even later exposed directly as api for encryption as function
    */
   const decryptWithInputKey = async ({ key }: Omit<TDecryptWithKeyDTO, "cipherTextBlob">) => {
-    const cipher = symmetricCipherService(SymmetricEncryption.AES_GCM_256);
+    const cipher = symmetricCipherService(SymmetricKeyEncryptDecrypt.AES_GCM_256);
 
     return ({ cipherTextBlob: versionedCipherTextBlob }: Pick<TDecryptWithKeyDTO, "cipherTextBlob">) => {
       const cipherTextBlob = versionedCipherTextBlob.subarray(0, -KMS_VERSION_BLOB_LENGTH);
@@ -227,7 +262,7 @@ export const kmsServiceFactory = ({
   };
 
   const encryptWithRootKey = () => {
-    const cipher = symmetricCipherService(SymmetricEncryption.AES_GCM_256);
+    const cipher = symmetricCipherService(SymmetricKeyEncryptDecrypt.AES_GCM_256);
 
     return (plainTextBuffer: Buffer) => {
       const encryptedBuffer = cipher.encrypt(plainTextBuffer, ROOT_ENCRYPTION_KEY);
@@ -236,7 +271,7 @@ export const kmsServiceFactory = ({
   };
 
   const decryptWithRootKey = () => {
-    const cipher = symmetricCipherService(SymmetricEncryption.AES_GCM_256);
+    const cipher = symmetricCipherService(SymmetricKeyEncryptDecrypt.AES_GCM_256);
 
     return (cipherTextBuffer: Buffer) => {
       return cipher.decrypt(cipherTextBuffer, ROOT_ENCRYPTION_KEY);
@@ -255,6 +290,11 @@ export const kmsServiceFactory = ({
       throw new NotFoundError({ message: `KMS with ID '${kmsId}' not found` });
     }
 
+    const encryptionAlgorithm = kmsDoc.internalKms?.encryptionAlgorithm as SymmetricKeyEncryptDecrypt;
+    verifyKeyTypeAndAlgorithm(kmsDoc.type as KmsKeyIntent, encryptionAlgorithm, {
+      forceType: KmsKeyIntent.ENCRYPT_DECRYPT
+    });
+
     if (kmsDoc.externalKms) {
       let externalKms: TExternalKmsProviderFns;
 
@@ -316,8 +356,8 @@ export const kmsServiceFactory = ({
     }
 
     // internal KMS
-    const keyCipher = symmetricCipherService(SymmetricEncryption.AES_GCM_256);
-    const dataCipher = symmetricCipherService(kmsDoc.internalKms?.encryptionAlgorithm as SymmetricEncryption);
+    const keyCipher = symmetricCipherService(SymmetricKeyEncryptDecrypt.AES_GCM_256);
+    const dataCipher = symmetricCipherService(encryptionAlgorithm);
     const kmsKey = keyCipher.decrypt(kmsDoc.internalKms?.encryptedKey as Buffer, ROOT_ENCRYPTION_KEY);
 
     return ({ cipherTextBlob: versionedCipherTextBlob }: Pick<TDecryptWithKmsDTO, "cipherTextBlob">) => {
@@ -345,19 +385,22 @@ export const kmsServiceFactory = ({
       });
     }
 
-    const keyCipher = symmetricCipherService(SymmetricEncryption.AES_GCM_256);
+    const keyCipher = symmetricCipherService(SymmetricKeyEncryptDecrypt.AES_GCM_256);
     const kmsKey = keyCipher.decrypt(kmsDoc.internalKms?.encryptedKey as Buffer, ROOT_ENCRYPTION_KEY);
 
     return kmsKey;
   };
 
   const importKeyMaterial = async (
-    { key, algorithm, name, isReserved, projectId, orgId }: TImportKeyMaterialDTO,
+    { key, algorithm, name, isReserved, projectId, orgId, type }: TImportKeyMaterialDTO,
     tx?: Knex
   ) => {
-    const cipher = symmetricCipherService(SymmetricEncryption.AES_GCM_256);
+    // daniel: currently we only support imports for encrypt/decrypt keys
+    verifyKeyTypeAndAlgorithm(type, algorithm, { forceType: KmsKeyIntent.ENCRYPT_DECRYPT });
 
-    const expectedByteLength = getByteLengthForAlgorithm(algorithm);
+    const cipher = symmetricCipherService(SymmetricKeyEncryptDecrypt.AES_GCM_256);
+
+    const expectedByteLength = getByteLengthForSymmetricEncryptionAlgorithm(algorithm as SymmetricKeyEncryptDecrypt);
     if (key.byteLength !== expectedByteLength) {
       throw new BadRequestError({
         message: `Invalid key length for ${algorithm}. Expected ${expectedByteLength} bytes but got ${key.byteLength} bytes`
@@ -370,6 +413,7 @@ export const kmsServiceFactory = ({
       const kmsDoc = await kmsDAL.create(
         {
           name: sanitizedName,
+          type: KmsKeyIntent.ENCRYPT_DECRYPT,
           orgId,
           isReserved,
           projectId
@@ -393,12 +437,89 @@ export const kmsServiceFactory = ({
     return doc;
   };
 
+  const getPublicKey = async ({ kmsId }: TGetPublicKeyDTO) => {
+    const kmsDoc = await kmsDAL.findByIdWithAssociatedKms(kmsId);
+    if (!kmsDoc) {
+      throw new NotFoundError({ message: `KMS with ID '${kmsId}' not found` });
+    }
+
+    const encryptionAlgorithm = kmsDoc.internalKms?.encryptionAlgorithm as AsymmetricKeySignVerify;
+
+    verifyKeyTypeAndAlgorithm(kmsDoc.type as KmsKeyIntent, encryptionAlgorithm, {
+      forceType: KmsKeyIntent.SIGN_VERIFY
+    });
+
+    const keyCipher = symmetricCipherService(SymmetricKeyEncryptDecrypt.AES_GCM_256);
+    const kmsKey = keyCipher.decrypt(kmsDoc.internalKms?.encryptedKey as Buffer, ROOT_ENCRYPTION_KEY);
+
+    const publicKeyBuffer = signingService(encryptionAlgorithm).getPublicKeyFromPrivateKey(kmsKey);
+
+    return crypto
+      .createPublicKey({
+        key: publicKeyBuffer,
+        format: "pem",
+        type: "spki"
+      })
+      .export({ type: "spki", format: "pem" }) as string; // format 'pem' makes it a string
+  };
+
+  const signWithKmsKey = async ({ kmsId }: Pick<TSignWithKmsDTO, "kmsId">) => {
+    const kmsDoc = await kmsDAL.findByIdWithAssociatedKms(kmsId);
+    if (!kmsDoc) {
+      throw new NotFoundError({ message: `KMS with ID '${kmsId}' not found` });
+    }
+
+    const encryptionAlgorithm = kmsDoc.internalKms?.encryptionAlgorithm as AsymmetricKeySignVerify;
+    verifyKeyTypeAndAlgorithm(kmsDoc.type as KmsKeyIntent, encryptionAlgorithm, {
+      forceType: KmsKeyIntent.SIGN_VERIFY
+    });
+
+    const keyCipher = symmetricCipherService(SymmetricKeyEncryptDecrypt.AES_GCM_256);
+    const { sign } = signingService(encryptionAlgorithm);
+    return ({ data, signingAlgorithm }: Pick<TSignWithKmsDTO, "data" | "signingAlgorithm">) => {
+      const kmsKey = keyCipher.decrypt(kmsDoc.internalKms?.encryptedKey as Buffer, ROOT_ENCRYPTION_KEY);
+      const signature = sign(data, kmsKey, signingAlgorithm);
+
+      return Promise.resolve({ signature, algorithm: signingAlgorithm });
+    };
+  };
+
+  const verifyWithKmsKey = async ({
+    kmsId,
+    signingAlgorithm
+  }: Pick<TVerifyWithKmsDTO, "kmsId" | "signingAlgorithm">) => {
+    const kmsDoc = await kmsDAL.findByIdWithAssociatedKms(kmsId);
+    if (!kmsDoc) {
+      throw new NotFoundError({ message: `KMS with ID '${kmsId}' not found` });
+    }
+
+    const encryptionAlgorithm = kmsDoc.internalKms?.encryptionAlgorithm as AsymmetricKeySignVerify;
+    verifyKeyTypeAndAlgorithm(kmsDoc.type as KmsKeyIntent, encryptionAlgorithm, {
+      forceType: KmsKeyIntent.SIGN_VERIFY
+    });
+
+    const keyCipher = symmetricCipherService(SymmetricKeyEncryptDecrypt.AES_GCM_256);
+    const { verify, getPublicKeyFromPrivateKey } = signingService(encryptionAlgorithm);
+    return ({ data, signature }: Pick<TVerifyWithKmsDTO, "data" | "signature">) => {
+      const kmsKey = keyCipher.decrypt(kmsDoc.internalKms?.encryptedKey as Buffer, ROOT_ENCRYPTION_KEY);
+
+      const publicKey = getPublicKeyFromPrivateKey(kmsKey);
+      const signatureValid = verify(data, signature, publicKey, signingAlgorithm);
+      return Promise.resolve({ signatureValid, algorithm: signingAlgorithm });
+    };
+  };
+
   const encryptWithKmsKey = async ({ kmsId }: Omit<TEncryptWithKmsDTO, "plainText">, tx?: Knex) => {
     const kmsDoc = await kmsDAL.findByIdWithAssociatedKms(kmsId, tx);
     if (!kmsDoc) {
       throw new NotFoundError({ message: `KMS with ID '${kmsId}' not found` });
     }
 
+    const encryptionAlgorithm = kmsDoc.internalKms?.encryptionAlgorithm as SymmetricKeyEncryptDecrypt;
+    verifyKeyTypeAndAlgorithm(kmsDoc.type as KmsKeyIntent, encryptionAlgorithm, {
+      forceType: KmsKeyIntent.ENCRYPT_DECRYPT
+    });
+
     if (kmsDoc.externalKms) {
       let externalKms: TExternalKmsProviderFns;
       if (!kmsDoc.orgKms.id || !kmsDoc.orgKms.encryptedDataKey) {
@@ -454,8 +575,8 @@ export const kmsServiceFactory = ({
     }
 
     // internal KMS
-    const keyCipher = symmetricCipherService(SymmetricEncryption.AES_GCM_256);
-    const dataCipher = symmetricCipherService(kmsDoc.internalKms?.encryptionAlgorithm as SymmetricEncryption);
+    const keyCipher = symmetricCipherService(SymmetricKeyEncryptDecrypt.AES_GCM_256);
+    const dataCipher = symmetricCipherService(encryptionAlgorithm);
     return ({ plainText }: Pick<TEncryptWithKmsDTO, "plainText">) => {
       const kmsKey = keyCipher.decrypt(kmsDoc.internalKms?.encryptedKey as Buffer, ROOT_ENCRYPTION_KEY);
       const encryptedPlainTextBlob = dataCipher.encrypt(plainText, kmsKey);
@@ -729,7 +850,7 @@ export const kmsServiceFactory = ({
 
     // case 2: root key is encrypted with software encryption
     if (kmsRootConfig.encryptionStrategy === RootKeyEncryptionStrategy.Software) {
-      const cipher = symmetricCipherService(SymmetricEncryption.AES_GCM_256);
+      const cipher = symmetricCipherService(SymmetricKeyEncryptDecrypt.AES_GCM_256);
       const encryptionKeyBuffer = $getBasicEncryptionKey();
 
       return cipher.decrypt(kmsRootConfig.encryptedRootKey, encryptionKeyBuffer);
@@ -749,7 +870,7 @@ export const kmsServiceFactory = ({
     }
 
     if (strategy === RootKeyEncryptionStrategy.Software) {
-      const cipher = symmetricCipherService(SymmetricEncryption.AES_GCM_256);
+      const cipher = symmetricCipherService(SymmetricKeyEncryptDecrypt.AES_GCM_256);
       const encryptionKeyBuffer = $getBasicEncryptionKey();
 
       return cipher.encrypt(plainKeyBuffer, encryptionKeyBuffer);
@@ -765,7 +886,7 @@ export const kmsServiceFactory = ({
   const createCipherPairWithDataKey = async (encryptionContext: TEncryptWithKmsDataKeyDTO, trx?: Knex) => {
     const dataKey = await $getDataKey(encryptionContext, trx);
 
-    const cipher = symmetricCipherService(SymmetricEncryption.AES_GCM_256);
+    const cipher = symmetricCipherService(SymmetricKeyEncryptDecrypt.AES_GCM_256);
 
     return {
       encryptor: ({ plainText }: Pick<TEncryptWithKmsDTO, "plainText">) => {
@@ -966,6 +1087,7 @@ export const kmsServiceFactory = ({
     const decryptedRootKey = await $decryptRootKey(kmsRootConfig);
 
     logger.info("KMS: Loading ROOT Key into Memory.");
+
     ROOT_ENCRYPTION_KEY = decryptedRootKey;
   };
 
@@ -1014,6 +1136,9 @@ export const kmsServiceFactory = ({
     getKmsById,
     createCipherPairWithDataKey,
     getKeyMaterial,
-    importKeyMaterial
+    importKeyMaterial,
+    signWithKmsKey,
+    verifyWithKmsKey,
+    getPublicKey
   };
 };

backend/src/services/kms/kms-types.ts

@@ -1,6 +1,7 @@
 import { Knex } from "knex";
 
-import { SymmetricEncryption } from "@app/lib/crypto/cipher";
+import { SymmetricKeyEncryptDecrypt } from "@app/lib/crypto/cipher";
+import { AsymmetricKeySignVerify, SigningAlgorithm } from "@app/lib/crypto/sign/types";
 
 export enum KmsDataKey {
   Organization,
@@ -13,6 +14,11 @@ export enum KmsType {
   Internal = "internal"
 }
 
+export enum KmsKeyIntent {
+  ENCRYPT_DECRYPT = "encrypt-decrypt",
+  SIGN_VERIFY = "sign-verify"
+}
+
 export type TEncryptWithKmsDataKeyDTO =
   | { type: KmsDataKey.Organization; orgId: string }
   | { type: KmsDataKey.SecretManager; projectId: string };
@@ -25,7 +31,8 @@ export type TEncryptWithKmsDataKeyDTO =
 export type TGenerateKMSDTO = {
   orgId: string;
   projectId?: string;
-  encryptionAlgorithm?: SymmetricEncryption;
+  encryptionAlgorithm?: SymmetricKeyEncryptDecrypt | AsymmetricKeySignVerify;
+  type?: KmsKeyIntent;
   isReserved?: boolean;
   name?: string;
   description?: string;
@@ -37,6 +44,23 @@ export type TEncryptWithKmsDTO = {
   plainText: Buffer;
 };
 
+export type TGetPublicKeyDTO = {
+  kmsId: string;
+};
+
+export type TSignWithKmsDTO = {
+  kmsId: string;
+  data: Buffer;
+  signingAlgorithm: SigningAlgorithm;
+};
+
+export type TVerifyWithKmsDTO = {
+  kmsId: string;
+  data: Buffer;
+  signature: Buffer;
+  signingAlgorithm: SigningAlgorithm;
+};
+
 export type TEncryptionWithKeyDTO = {
   key: Buffer;
   plainText: Buffer;
@@ -67,9 +91,10 @@ export type TGetKeyMaterialDTO = {
 
 export type TImportKeyMaterialDTO = {
   key: Buffer;
-  algorithm: SymmetricEncryption;
+  algorithm: SymmetricKeyEncryptDecrypt;
   name?: string;
   isReserved: boolean;
   projectId: string;
   orgId: string;
+  type: KmsKeyIntent;
 };