implement EKM integration to load private keys during setup

[tomholub]

EKM = Email Key Manager https://flowcrypt.com/docs/technical/enterprise/email-deployment-overview.html

OrgRule definitions https://flowcrypt.com/docs/business/org-rules.html

As a part of #275 and after #276 and #277 , immediately after authentication when we receive the OIDC and OrgRules, we should check if orgRules.usesKeyManager() == true. If yes, we should:

• 7) call GET <ekm>/v1/keys/private. Into authorization header please put Bearer <ID_TOKEN>. On error, offer retry
• 8) if there are no private keys there (empty array), show an error to the user that there are no private keys configured for them and that they should ask their systems administrator or help desk. Offer retry
• 9) check that all of the received private keys are fully decrypted
• 10) if there is at least one private key, ask user to provide a passphrase (similar UI to creating a new key), then ask to confirm the pass phrase
• 11) encrypt the received keys with the pass phrase. Keep pass phrase in memory option to keep pass phrase only in memory #197 , store encrypted key in storage
• 12) finish setup without any further user interaction

The goal is that if user has keys already configured on EKM and appropriate OrgRules are in place, they only need to authenticate and choose a pass phrase, and everything will be done automatically. After authentication and successful automatic setup, they will be sent to their inbox.

In this flow, do not submit any public key to attester.

[tomholub]

Here a flow chart

[ekievsky]

I will split it to 2 PRs:
FIrst:

• if there are no private keys there (empty array), show an error to the user that there are no private keys configured for them and that they should ask their systems administrator or help desk. Offer retry
• check that all of the received private keys are fully decrypted

Second:

• if there is at least one private key, ask user to provide a passphrase (similar UI to creating a new key), then ask to confirm the pass phrase
• encrypt the received keys with the pass phrase. Keep pass phrase in memory option to keep pass phrase only in memory
• finish setup without any further user interaction

[tomholub]

sounds good

[ekievsky]

Here is the 2 questions popped up:

• how do we make sure that private keys are decrypted?
• What is the flow for encrypting the received keys with the pass phrase?

[tomholub]

how do we make sure that private keys are decrypted?

Parse each key armored string with Core.parseKeys. The result should always be exactly one OpenPGP key per armored string. It must be a private key and it must have isFullyDecrypted == true.

What is the flow for encrypting the received keys with the pass phrase?

Please add a method to Core that looks like this:

    func encryptKey(armoredPrv: String, passphrase: String) throws -> CoreRes.DecryptKey {
        let r = try call("encryptKey", jsonDict: ["armored": armoredPrv, "passphrase": passphrase], data: nil)
        return try r.json.decodeJson(as: CoreRes.EncryptKey.self)
    }

Core types:

    struct EncryptKey: Decodable {
        let encryptedKey: String
    }

Then use Core.encryptKey to encrypt the received keys.

[ekievsky]

Parse each key armored string with Core.parseKeys. The result should always be exactly one OpenPGP key per armored string. It must be a private key and it must have isFullyDecrypted == true.

These keys are received in following JSON:
"{\"privateKeys\":[{\"decryptedPrivateKey\":\"-----BEGIN PGP PRIVATE KEY BLOCK-----\\nVersion: BCPG v1.69\\n\\nlFgEYL/CoBYJKwYBBAHaRw8BAQdAY0jxarPi12nHs9wMHw1D4R......"}]}", so they are decrypted. Is there a case when keys are encrypted?

[tomholub]

Is there a case when keys are encrypted?

trust but verify. there isn’t any case when they would be not decrypted, but we don’t just assume. we check, and show error if the check ever fails. // edit: because the data comes from external source, you can't be 100% sure what it is until you verify

[ekievsky]

Should we show an alert warning that keys are not fully decrypted or what's the flow in that case?

[tomholub]

Show an alert and send user back to login screen. They can click Continue with Gmail again to retry.

[ekievsky]

When user creates a new key we call a method from Core generateKey(....) which returns CoreRes.GenerateKey and it contains a KeyDetails, but new method encryptKey(....) returns CoreRes.EncryptKey which has String is that a typo? Because to save a key in storage and update it we need KeyDetails.

[ekievsky]

also, while making a request to get private keys from EKM, we receive array of keys, should we use the first key from array?

[tomholub]

not a typo - you’ll need to parse the result again. some day we could streamline that and return it parsed, but not now

…

On Wednesday, August 4, 2021, Evgenii Kievsky ***@***.***> wrote: also, while making a request to get private keys from EKM, we receive array of keys, should we use the first key from array? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#279 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABQDZENQDQQYQYYOKIUFWWLT3E7KRANCNFSM4ZQ3DUXA> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&utm_campaign=notification-email> .

-- -- Tom James Holub <http://holub.me/>

[tomholub]

also, while making a request to get private keys from EKM, we receive

array of keys, should we use the first key from array? no - we have to save all of the keys. an account can have more than one private key saved. thats why when you go to settings -> keys, it will render a list.

…

On Wednesday, August 4, 2021, Evgenii Kievsky ***@***.***> wrote: also, while making a request to get private keys from EKM, we receive array of keys, should we use the first key from array? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#279 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABQDZENQDQQYQYYOKIUFWWLT3E7KRANCNFSM4ZQ3DUXA> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&utm_campaign=notification-email> .

-- -- Tom James Holub <http://holub.me/>

[ekievsky]

array of keys, should we use the first key from array? no - we have to save all of the keys. an account can have more than one private key saved. thats why when you go to settings -> keys, it will render a list.

our Passphrase entity creates with fingeprints for one key and there is updateKey and testWelcome requests on AttesterApi which takes 1 keys, how should I deal with it?
and which key should be encrypted/parsed?

[tomholub]

check the definition of the issue with regards to handling attester. for pass phrase, you’ll need to make one pass phrase entity per key, each with that key’s relevant fingerprint. all the pass phrases will have the same one string chosen by user, but different fingerprints.

…

On Wednesday, August 4, 2021, Evgenii Kievsky ***@***.***> wrote: array of keys, should we use the first key from array? no - we have to save all of the keys. an account can have more than one private key saved. thats why when you go to settings -> keys, it will render a list. our Passphrase entity creates with fingeprints for one key and there is updateKey and testWelcome requests on AttesterApi which takes 1 keys, how should I deal with it? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#279 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABQDZENN2IURDV3KO6ZREPDT3FE7TANCNFSM4ZQ3DUXA> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&utm_campaign=notification-email> .

-- -- Tom James Holub <http://holub.me/>