1 // Copyright 2019 Google LLC
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14 //
15 ////////////////////////////////////////////////////////////////////////////////
16
17 #include "tink/keyderivation/keyset_deriver_wrapper.h"
18
19 #include <memory>
20 #include <string>
21 #include <utility>
22 #include <vector>
23
24 #include "gmock/gmock.h"
25 #include "gtest/gtest.h"
26 #include "absl/status/status.h"
27 #include "tink/cleartext_keyset_handle.h"
28 #include "tink/keyderivation/keyset_deriver.h"
29 #include "tink/primitive_set.h"
30 #include "tink/util/test_matchers.h"
31 #include "proto/tink.pb.h"
32
33 namespace crypto {
34 namespace tink {
35 namespace {
36
37 using ::crypto::tink::test::IsOk;
38 using ::crypto::tink::test::StatusIs;
39 using ::google::crypto::tink::Keyset;
40 using ::google::crypto::tink::KeysetInfo;
41 using ::google::crypto::tink::KeyStatusType;
42 using ::google::crypto::tink::OutputPrefixType;
43 using ::testing::Eq;
44 using ::testing::HasSubstr;
45
46 // TODO(b/255828521): Move this to a shared location once KeysetDeriver is in
47 // the public API.
48 class DummyDeriver : public KeysetDeriver {
49 public:
DummyDeriver(absl::string_view name)50 explicit DummyDeriver(absl::string_view name) : name_(name) {}
DeriveKeyset(absl::string_view salt) const51 util::StatusOr<std::unique_ptr<KeysetHandle>> DeriveKeyset(
52 absl::string_view salt) const override {
53 Keyset::Key key;
54 key.mutable_key_data()->set_type_url(
55 absl::StrCat(name_.size(), ":", name_, salt));
56 key.set_status(KeyStatusType::UNKNOWN_STATUS);
57 key.set_key_id(0);
58 key.set_output_prefix_type(OutputPrefixType::UNKNOWN_PREFIX);
59
60 Keyset keyset;
61 *keyset.add_key() = key;
62 keyset.set_primary_key_id(0);
63 return CleartextKeysetHandle::GetKeysetHandle(keyset);
64 }
65
66 private:
67 std::string name_;
68 };
69
TEST(KeysetDeriverWrapperTest,WrapNullptr)70 TEST(KeysetDeriverWrapperTest, WrapNullptr) {
71 EXPECT_THAT(KeysetDeriverWrapper().Wrap(nullptr).status(),
72 StatusIs(absl::StatusCode::kInternal, HasSubstr("non-NULL")));
73 }
74
TEST(KeysetDeriverWrapperTest,WrapEmpty)75 TEST(KeysetDeriverWrapperTest, WrapEmpty) {
76 EXPECT_THAT(
77 KeysetDeriverWrapper()
78 .Wrap(absl::make_unique<PrimitiveSet<KeysetDeriver>>())
79 .status(),
80 StatusIs(absl::StatusCode::kInvalidArgument, HasSubstr("no primary")));
81 }
82
TEST(KeysetDeriverWrapperTest,WrapNoPrimary)83 TEST(KeysetDeriverWrapperTest, WrapNoPrimary) {
84 auto deriver_set = absl::make_unique<PrimitiveSet<KeysetDeriver>>();
85 KeysetInfo::KeyInfo key_info;
86 key_info.set_key_id(1234);
87 key_info.set_status(KeyStatusType::ENABLED);
88 key_info.set_output_prefix_type(OutputPrefixType::TINK);
89
90 EXPECT_THAT(
91 deriver_set->AddPrimitive(absl::make_unique<DummyDeriver>(""), key_info)
92 .status(),
93 IsOk());
94
95 EXPECT_THAT(
96 KeysetDeriverWrapper().Wrap(std::move(deriver_set)).status(),
97 StatusIs(absl::StatusCode::kInvalidArgument, HasSubstr("no primary")));
98 }
99
TEST(KeysetDeriverWrapperTest,WrapSingle)100 TEST(KeysetDeriverWrapperTest, WrapSingle) {
101 auto deriver_set = absl::make_unique<PrimitiveSet<KeysetDeriver>>();
102 KeysetInfo::KeyInfo key_info;
103 key_info.set_key_id(1234);
104 key_info.set_status(KeyStatusType::ENABLED);
105 key_info.set_output_prefix_type(OutputPrefixType::TINK);
106 key_info.set_type_url(
107 "type.googleapis.com/google.crypto.tink.PrfBasedDeriverKey");
108
109 auto entry_or = deriver_set->AddPrimitive(
110 absl::make_unique<DummyDeriver>("wrap_single_key"), key_info);
111 ASSERT_THAT(entry_or, IsOk());
112 EXPECT_THAT(deriver_set->set_primary(entry_or.value()), IsOk());
113
114 auto wrapper_deriver_or = KeysetDeriverWrapper().Wrap(std::move(deriver_set));
115
116 ASSERT_THAT(wrapper_deriver_or, IsOk());
117
118 auto derived_keyset_or =
119 wrapper_deriver_or.value()->DeriveKeyset("wrap_single_salt");
120
121 ASSERT_THAT(derived_keyset_or, IsOk());
122
123 Keyset keyset = CleartextKeysetHandle::GetKeyset(*derived_keyset_or.value());
124
125 EXPECT_THAT(keyset.primary_key_id(), Eq(1234));
126 ASSERT_THAT(keyset.key_size(), Eq(1));
127 EXPECT_THAT(keyset.key(0).key_data().type_url(),
128 Eq("15:wrap_single_keywrap_single_salt"));
129 EXPECT_THAT(keyset.key(0).status(), Eq(KeyStatusType::ENABLED));
130 EXPECT_THAT(keyset.key(0).key_id(), Eq(1234));
131 EXPECT_THAT(keyset.key(0).output_prefix_type(), Eq(OutputPrefixType::TINK));
132 }
133
TEST(KeysetDeriverWrapperTest,WrapMultiple)134 TEST(KeysetDeriverWrapperTest, WrapMultiple) {
135 auto pset = absl::make_unique<PrimitiveSet<KeysetDeriver>>();
136 std::vector<KeysetInfo::KeyInfo> key_infos;
137
138 KeysetInfo::KeyInfo key_info;
139 key_info.set_key_id(1010101);
140 key_info.set_status(KeyStatusType::ENABLED);
141 key_info.set_output_prefix_type(OutputPrefixType::RAW);
142 key_info.set_type_url(
143 "type.googleapis.com/google.crypto.tink.PrfBasedDeriverKey");
144 ASSERT_THAT(
145 pset->AddPrimitive(absl::make_unique<DummyDeriver>("k1"), key_info)
146 .status(),
147 IsOk());
148 key_infos.push_back(key_info);
149
150 key_info.set_key_id(2020202);
151 key_info.set_status(KeyStatusType::ENABLED);
152 key_info.set_output_prefix_type(OutputPrefixType::LEGACY);
153 key_info.set_type_url(
154 "type.googleapis.com/google.crypto.tink.PrfBasedDeriverKey");
155 util::StatusOr<PrimitiveSet<KeysetDeriver>::Entry<KeysetDeriver>*> entry =
156 pset->AddPrimitive(absl::make_unique<DummyDeriver>("k2"), key_info);
157 ASSERT_THAT(entry, IsOk());
158 ASSERT_THAT(pset->set_primary(*entry), IsOk());
159 key_infos.push_back(key_info);
160
161 key_info.set_key_id(3030303);
162 key_info.set_status(KeyStatusType::ENABLED);
163 key_info.set_output_prefix_type(OutputPrefixType::TINK);
164 key_info.set_type_url(
165 "type.googleapis.com/google.crypto.tink.PrfBasedDeriverKey");
166 ASSERT_THAT(
167 pset->AddPrimitive(absl::make_unique<DummyDeriver>("k3"), key_info),
168 IsOk());
169 key_infos.push_back(key_info);
170
171 util::StatusOr<std::unique_ptr<KeysetDeriver>> wrapper_deriver =
172 KeysetDeriverWrapper().Wrap(std::move(pset));
173 ASSERT_THAT(wrapper_deriver, IsOk());
174
175 util::StatusOr<std::unique_ptr<KeysetHandle>> derived_keyset =
176 (*wrapper_deriver)->DeriveKeyset("salt");
177 ASSERT_THAT(derived_keyset, IsOk());
178 Keyset keyset = CleartextKeysetHandle::GetKeyset(**derived_keyset);
179
180 EXPECT_THAT(keyset.primary_key_id(), Eq(2020202));
181 ASSERT_THAT(keyset.key_size(), Eq(3));
182
183 for (int i = 0; i < keyset.key().size(); i++) {
184 std::string type_url = absl::StrCat("2:k", i + 1, "salt");
185 EXPECT_THAT(keyset.key(i).key_data().type_url(), Eq(type_url));
186
187 Keyset::Key key = keyset.key(i);
188 key_info = key_infos[i];
189 EXPECT_THAT(key.status(), Eq(key_info.status()));
190 EXPECT_THAT(key.key_id(), Eq(key_info.key_id()));
191 EXPECT_THAT(key.output_prefix_type(), Eq(key_info.output_prefix_type()));
192 }
193 }
194
195 } // namespace
196 } // namespace tink
197 } // namespace crypto
198