fix(policy): reject unencrypted private keys for modes 1/2

[strantalis]

Summary

• add ocrypto.IsPEMOrDERPrivateKey to detect PEM/DER private keys
• reject unencrypted private keys in KAS CreateKey/RotateKey for modes 1/2
• add integration coverage for Create/Rotate; add ocrypto unit tests

Testing

• gofumpt -w lib/ocrypto/key_material.go lib/ocrypto/key_material_test.go service/pkg/db/errors.go service/policy/db/key_access_server_registry.go service/integration/kas_registry_key_unencrypted_test.go
• cd lib/ocrypto && golangci-lint run ./...
• cd lib/ocrypto && go test ./...
• cd service && go test ./policy/db

Notes

• cd service && golangci-lint run ./policy/db ./integration fails due to existing funcorder/staticcheck findings in integration and deprecated usage (pre-existing).
• cd service && go test ./integration -run Test_CreateKasKey_PEMPrivateKey_Fail failed due to Testcontainers/Docker socket (/Users/strantalis/.colima/default/docker.sock) not available in this environment.

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	185.740766ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	103.151857ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	365.572611ms
Throughput	273.54 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.043735897s
Average Latency	388.885081ms
Throughput	128.06 requests/second

[gemini-code-assist]

Summary of Changes

Hello @strantalis, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly improves the security posture of the Key Access Server by enforcing a policy against the use of unencrypted private keys for critical root key configurations. By introducing a dedicated utility for private key format detection and integrating it into the key creation and rotation workflows, the system now proactively prevents a common security vulnerability, ensuring that sensitive cryptographic material is always handled securely.

Highlights

• Security Enhancement: Introduced a new validation step to reject unencrypted private keys during CreateKey and RotateKey operations within the Key Access Server (KAS) for CONFIG_ROOT_KEY and PROVIDER_ROOT_KEY modes, enhancing security by preventing the storage of sensitive keys in an unencrypted state.
• New Cryptographic Utility: Added a new utility function, ocrypto.IsPEMOrDERPrivateKey, to reliably detect if a given byte array represents an unencrypted private key in either PEM or DER format.
• Error Handling and Testing: Implemented a new error type, ErrUnencryptedPrivateKey, and added comprehensive unit tests for the new cryptographic utility, along with integration tests to ensure the KAS CreateKey and RotateKey functions correctly reject unencrypted private keys.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Changelog

• lib/ocrypto/key_material.go
  • Added IsPEMOrDERPrivateKey function to identify unencrypted private keys in PEM or DER format.
  • Implemented logic to parse PEM blocks and check for 'PRIVATE KEY' type strings.
  • Included checks for DER-encoded PKCS8, PKCS1, and EC private keys using x509 package functions.
• lib/ocrypto/key_material_test.go
  • Created TestIsPEMOrDERPrivateKey to validate the new key detection utility.
  • Added test cases for various PEM-encoded private keys (RSA, EC).
  • Included tests for PEM-encoded public keys and random byte sequences to ensure correct negative results.
  • Added a test case for DER-encoded private keys extracted from PEM.
• service/integration/kas_registry_key_unencrypted_test.go
  • Added Test_CreateKasKey_PEMPrivateKey_Fail to verify that CreateKey requests with unencrypted PEM private keys are rejected.
  • Added Test_RotateKey_PEMPrivateKey_Fail to verify that RotateKey requests with unencrypted PEM private keys are rejected.
• service/pkg/db/errors.go
  • Defined a new error variable ErrUnencryptedPrivateKey.
  • Defined a new string constant ErrorTextUnencryptedPrivateKey.
  • Updated the StatusifyError function to map ErrUnencryptedPrivateKey to a connect.CodeInvalidArgument.
• service/policy/db/key_access_server_registry.go
  • Imported the new github.com/opentdf/platform/lib/ocrypto package.
  • Modified the CreateKey function to include validation for private keys when KeyMode is CONFIG_ROOT_KEY or PROVIDER_ROOT_KEY.
  • Added logic to decode the WrappedKey from base64 and check if it's an unencrypted private key using ocrypto.IsPEMOrDERPrivateKey.
  • Returned db.ErrUnencryptedPrivateKey if an unencrypted private key is detected during CreateKey.

Activity

• Code formatted using gofumpt for lib/ocrypto/key_material.go, lib/ocrypto/key_material_test.go, service/pkg/db/errors.go, service/policy/db/key_access_server_registry.go, and service/integration/kas_registry_key_unencrypted_test.go.
• Linting (golangci-lint) was run on lib/ocrypto.
• Unit tests (go test) were executed for lib/ocrypto and service/policy/db.
• Noted that golangci-lint for service/policy/db and service/integration failed due to pre-existing funcorder/staticcheck findings and deprecated usage.
• Noted that an integration test (Test_CreateKasKey_PEMPrivateKey_Fail) failed due to Testcontainers/Docker socket not being available in the environment.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

---

A key, unencrypted, a secret laid bare, No lock on the door, no one to care. This code now stands guard, with purpose so true, To keep all your secrets, safe and brand new.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request introduces a security enhancement by rejecting unencrypted private keys for KAS key creation and rotation in modes 1 and 2. This is achieved by adding a new function ocrypto.IsPEMOrDERPrivateKey to detect PEM or DER formatted private keys. The changes include the new detection logic, its integration into the key creation workflow, and corresponding unit and integration tests to ensure correctness. Overall, the changes are well-implemented and improve the security posture of the service. I have one suggestion to improve code efficiency and readability.

[github-actions]

X-Test Results

opentdfplatformU176VV.dockerbuild
cukes-report
✅ js-pull-3072
✅ js-v0.9.0
✅ java-v0.9.0
✅ java-pull-3072
bats-test-results
✅ go-v0.9.0
test-cases-mapping-report
✅ go-pull-3072

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	202.137586ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	92.402023ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	358.633761ms
Throughput	278.84 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.578233023s
Average Latency	394.43985ms
Throughput	126.33 requests/second

[github-actions]

X-Test Results

opentdfplatform8IB03E.dockerbuild
cukes-report
✅ js-pull-3072
✅ js-v0.9.0
✅ java-v0.9.0
✅ java-pull-3072
bats-test-results
test-cases-mapping-report
✅ go-pull-3072
✅ go-v0.9.0

[c-r33d]

Can we reuse https://github.com/opentdf/platform/blob/main/lib/ocrypto/asym_decryption.go#L32? For the x509 parsing