fix(kas): Fix EC P-521 typo by pflynn-virtru · Pull Request #3075 · opentdf/platform

pflynn-virtru · 2026-02-12T18:37:13Z

Summary

FormatAlg in service/pkg/db/marshalHelpers.go:159 returns "ec:secp512r1" for ALGORITHM_EC_P521 — should be "ec:secp521r1"
This causes the SDK to receive ALGORITHM_UNSPECIFIED when reading EC-521 base keys from the well-known config, failing with "unsupported algorithm: ALGORITHM_UNSPECIFIED" at encrypt time
Test compares FormatAlg output against canonical ocrypto.KeyType constants for all supported algorithms

P-521 subtest fails as expected. Fix is a one-character change: 512 → 521.

Test plan

EC-P521 subtest fails: expected "ec:secp521r1", actual "ec:secp512r1"
All other algorithm subtests pass
Apply fix and verify all subtests pass

See failure: https://github.com/opentdf/platform/actions/runs/21959964503/job/63434443522?pr=3075

🤖 Generated with Claude Code

FormatAlg returns "ec:secp512r1" for ALGORITHM_EC_P521 instead of "ec:secp521r1". This causes the SDK's getKasKeyAlg to return ALGORITHM_UNSPECIFIED, making EC-521 base key encryption fail with "unsupported algorithm: ALGORITHM_UNSPECIFIED". The test compares FormatAlg output against the canonical ocrypto.KeyType constants to catch string mismatches. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Paul Flynn <pflynn@virtru.com>

gemini-code-assist · 2026-02-12T18:37:29Z

Summary of Changes

Hello @pflynn-virtru, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses a critical bug where a typo in the FormatAlg function prevents the SDK from correctly recognizing EC-P521 cryptographic algorithms. The primary change introduces a comprehensive test suite to validate algorithm string formatting against expected ocrypto.KeyType constants, thereby exposing the existing EC-P521 typo and ensuring future consistency.

Highlights

Algorithm Formatting Typo: Identified a typo in the FormatAlg function for ALGORITHM_EC_P521, which incorrectly returns "ec:secp512r1" instead of the correct "ec:secp521r1".
SDK Impact: This typo causes the SDK to receive ALGORITHM_UNSPECIFIED when attempting to read EC-521 base keys from the well-known configuration, leading to encryption failures.
Test Coverage Added: A new test, TestFormatAlg_MatchesOcryptoKeyTypes, was added to verify FormatAlg output against canonical ocrypto.KeyType constants for all supported algorithms, specifically exposing the P-521 typo.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Changelog

service/pkg/db/marshalHelpers_test.go
- Added TestFormatAlg_MatchesOcryptoKeyTypes to validate algorithm string formatting and TestFormatAlg_Unspecified to handle unspecified algorithms.

Activity

A new test file, service/pkg/db/marshalHelpers_test.go, was added to the codebase.
The EC-P521 subtest within the newly added TestFormatAlg_MatchesOcryptoKeyTypes is currently failing as expected, confirming the presence of the identified typo.
The author has outlined a plan to apply a one-character fix ("512" to "521") and verify that all tests pass, indicating the next steps for resolution.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Test finds small typo, Five-two-one, not five-one-two, Code now runs so true.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

github-actions · 2026-02-12T18:42:07Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	185.282266ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	97.937004ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	369.358959ms
Throughput	270.74 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.326552748s
Average Latency	401.34784ms
Throughput	123.99 requests/second

gemini-code-assist

Code Review

This pull request adds a new test file to expose a typo in the FormatAlg function for the EC P-521 algorithm. The new tests are well-structured and effectively highlight the existing bug. I've added one comment regarding a common Go pitfall in table-driven tests with subtests to improve the robustness of the test code against future changes.

github-actions · 2026-02-12T18:49:11Z

X-Test Results

opentdf~~platform~~GIXQ7Y.dockerbuild
cukes-report
✅ js-v0.9.0
✅ js-pull-3075
✅ java-v0.9.0
✅ java-pull-3075
✅ go-pull-3075
bats-test-results
test-cases-mapping-report
✅ go-v0.9.0

Add round-trip tests that prove FormatAlg and getKasKeyAlg share the same ocrypto.KeyType contract: - service/pkg/db: FormatAlg(enum) → reverse-map lookup → assert original enum. EC-P521 subtest fails (typo: "ec:secp512r1" vs "ec:secp521r1"). - sdk: formatAlg(enum) → getKasKeyAlg(result) → assert original enum. All pass (SDK formatAlg is correct). Refs: #3070 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Paul Flynn <pflynn@virtru.com>

github-actions · 2026-02-12T18:56:47Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	181.917613ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	112.461363ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	353.486904ms
Throughput	282.90 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	41.201321379s
Average Latency	410.453443ms
Throughput	121.36 requests/second

Refs: #3070 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Paul Flynn <pflynn@virtru.com>

github-actions · 2026-02-12T18:59:46Z

X-Test Failure Report

opentdf~~platform~~UI2Z4Z.dockerbuild
cukes-report

github-actions · 2026-02-12T19:03:34Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	192.213152ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	101.397808ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	374.964486ms
Throughput	266.69 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.48377497s
Average Latency	392.570075ms
Throughput	126.63 requests/second

github-actions · 2026-02-12T19:12:21Z

X-Test Results

opentdf~~platform~~UNHKCR.dockerbuild
cukes-report
✅ js-pull-3075
✅ js-v0.9.0
bats-test-results
✅ java-v0.9.0
✅ java-pull-3075
test-cases-mapping-report
✅ go-pull-3075
✅ go-v0.9.0

🤖 I have created a release *beep* *boop* --- ## [0.13.0](sdk/v0.12.0...sdk/v0.13.0) (2026-02-17) ### ⚠ BREAKING CHANGES * **policy:** remove namespace certificate feature ([#3051](#3051)) ### Bug Fixes * **deps:** bump github.com/opentdf/platform/lib/ocrypto from 0.9.0 to 0.10.0 in /sdk ([#3078](#3078)) ([527c34d](527c34d)) * **deps:** bump github.com/opentdf/platform/protocol/go from 0.15.0 to 0.16.0 in /sdk ([#3081](#3081)) ([3d4ce33](3d4ce33)) * **docs:** DSPX-2409 replace SDK README code example with working code ([#3055](#3055)) ([566cb6f](566cb6f)) * Go 1.25 ([#3053](#3053)) ([65eb7c3](65eb7c3)) * **kas:** Fix EC P-521 typo ([#3075](#3075)) ([abc088d](abc088d)) * **sdk:** conditionally set client_id based on auth method ([#2968](#2968)) ([abdeb69](abdeb69)) ### Code Refactoring * **policy:** remove namespace certificate feature ([#3051](#3051)) ([48abb81](48abb81)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>

🤖 I have created a release *beep* *boop* --- ## [0.13.0](service/v0.12.0...service/v0.13.0) (2026-02-18) ### ⚠ BREAKING CHANGES * **policy:** remove namespace certificate feature ([#3051](#3051)) ### Features * **authz:** add casbin roleprovider interface ([#3069](#3069)) ([9d6b3f3](9d6b3f3)) * **core:** add interceptors to start options ([#3031](#3031)) ([e0b4e93](e0b4e93)) ### Bug Fixes * **deps:** bump github.com/opentdf/platform/lib/fixtures from 0.4.0 to 0.5.0 in /service ([#3034](#3034)) ([66b61b1](66b61b1)) * **deps:** bump github.com/opentdf/platform/lib/ocrypto from 0.9.0 to 0.10.0 in /service ([#3080](#3080)) ([49582f0](49582f0)) * **deps:** bump github.com/opentdf/platform/protocol/go from 0.15.0 to 0.16.0 in /service ([#3083](#3083)) ([a332f95](a332f95)) * **deps:** vulnerability fix in connect-rpc validate and ristretto ([#3065](#3065)) ([8860fed](8860fed)) * Go 1.25 ([#3053](#3053)) ([65eb7c3](65eb7c3)) * **kas:** dont hardcode P-256 curve ([#3073](#3073)) ([826d857](826d857)) * **kas:** Fix EC P-521 typo ([#3075](#3075)) ([abc088d](abc088d)) * **policy:** reject unencrypted private keys for modes 1/2 ([#3072](#3072)) ([e2dc6d8](e2dc6d8)) ### Code Refactoring * **policy:** remove namespace certificate feature ([#3051](#3051)) ([48abb81](48abb81)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>

github-actions Bot added the size/xs label Feb 12, 2026

pflynn-virtru changed the title ~~test(db): add FormatAlg test exposing EC P-521 typo~~ test(service): FormatAlg test exposing EC P-521 typo Feb 12, 2026

pflynn-virtru changed the title ~~test(service): FormatAlg test exposing EC P-521 typo~~ fix(service): FormatAlg test exposing EC P-521 typo Feb 12, 2026

pflynn-virtru changed the title ~~fix(service): FormatAlg test exposing EC P-521 typo~~ fix(kas): FormatAlg test exposing EC P-521 typo Feb 12, 2026

gemini-code-assist Bot reviewed Feb 12, 2026

View reviewed changes

Comment thread service/pkg/db/marshalHelpers_test.go Outdated

fix(db): correct EC P-521 typo in FormatAlg ("secp512r1" → "secp521r1")

3be7854

Refs: #3070 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Paul Flynn <pflynn@virtru.com>

pflynn-virtru marked this pull request as ready for review February 12, 2026 18:59

pflynn-virtru requested review from a team as code owners February 12, 2026 18:59

pflynn-virtru changed the title ~~fix(kas): FormatAlg test exposing EC P-521 typo~~ fix(kas): Fix EC P-521 typo Feb 12, 2026

dmihalcik-virtru self-requested a review February 12, 2026 19:16

dmihalcik-virtru approved these changes Feb 12, 2026

View reviewed changes

pflynn-virtru added this pull request to the merge queue Feb 12, 2026

Merged via the queue into main with commit abc088d Feb 12, 2026
40 checks passed

pflynn-virtru deleted the fix/ec521-format-alg-typo branch February 12, 2026 21:11

This was referenced Feb 11, 2026

chore(main): release sdk 0.13.0 #3061

Merged

chore(main): release service 0.13.0 #3058

Merged

Uh oh!

Conversation

pflynn-virtru commented Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

gemini-code-assist Bot commented Feb 12, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

github-actions Bot commented Feb 12, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

github-actions Bot commented Feb 12, 2026

X-Test Results

Uh oh!

github-actions Bot commented Feb 12, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Feb 12, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Feb 12, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Feb 12, 2026

X-Test Results

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

pflynn-virtru commented Feb 12, 2026 •

edited

Loading