[#21] Implement Document Encryption that returns EDEKs #27

clintfred · 2019-08-01T20:12:28Z

Changelog

DocumentAdvancedOps::document_encrypt_unmanaged function added for advanced use cases where the calling application wants to manage both the encrypted data and the associated edeks instead of using the IronCore service for EDEK management.

TODO

- sync up with latest edek proto definition
- ~~fix android-64 build~~ (disabled for now)
- convert remaining TODOs to other issues

clintfred · 2019-08-01T22:05:05Z

Android 64 build is failing as it is cross compiled and doesn't allow writing to the src/ tree. This is problematic as our build.rs generates edeks.rs at build time.

cross-rs/cross#145 (comment) may contain some helpful information if we decide to continue generating proto -> rs at ironoxide build time. Deferring this until we decide on a general way to handle .proto files.

build.rs

src/internal/document_api/mod.rs

src/internal/document_api/requests.rs

src/proto/mod.rs

src/document.rs

src/internal/document_api/mod.rs

coltfred

Responding to some responses.

src/internal/document_api/mod.rs

src/document.rs

proto/transform.proto

src/internal/mod.rs

src/internal/rest.rs

src/internal/document_api/mod.rs

giarc3

Just comments on comments

src/document.rs

src/internal/document_api/mod.rs

…ants()

skeet70

Pending a bit more cleanup of TODO style comments into issues or actual changes, I think it looks good.

src/internal/mod.rs

coltfred

Besides the structure and creation of DocumentEncryptUnmanagedResult, I think we're close.

src/document/advanced.rs

proto/transform.proto

src/internal/document_api/mod.rs

src/lib.rs

coltfred · 2019-08-08T15:30:35Z

tests/document_ops.rs

@@ -211,32 +212,209 @@ fn doc_create_with_policy_grants() -> Result<(), IronOxideErr> {
 }

 #[test]
-fn doc_create_with_explicit_grants() {
-    let sdk = init_sdk();
+fn doc_edek_encrypt_with_policy_grants() -> Result<(), IronOxideErr> {


This test name should reflect the name changes.

tests/document_ops.rs

clintfred

responses

src/document/advanced.rs

proto/transform.proto

src/internal/document_api/mod.rs

src/lib.rs

coltfred

I'd still like to see that one test case with the policy simplified, but thanks for fixing up the creation of the Unmanaged result to make the java and scala bindings better.

…validation

…Bytes

- DocumentAdvancedOps::document_encrypt_unmanaged function added for advanced use cases where the calling application wants to manage both the encrypted data and the associated edeks instead of using the IronCore service for EDEK management.

clintfred and others added 14 commits July 23, 2019 13:46

#[21] initial try at proto integration

33fcec3

#[21] initial try at proto integration (2)

a929bff

#[21] WIP refactor checkpoint

feff9b1

#[21] first integration test that works end to end

b9779ab

#[21] WIP handle groups in resolve_keys_for_grants

8405562

#[21] handle protobuf errors; docs on document_edek_encrypt

720c353

#[21] additional integration tests

a72ede9

#[21] build and readme updates

b349350

#[21] restored DocumentEncryptResult type

7bb01ea

Delete Foo.rs

801c305

don't commit edeks.rs

f5c92b6

#[21] fixed integration test compilation

925bc9b

pre PR cleanups

443255a

check format after proto source gen

dc9033a

clintfred changed the title ~~[WIP] [#21] Implement Document Encryption that returns EDEKs.~~ [#21] Implement Document Encryption that returns EDEKs. Aug 1, 2019

clintfred changed the title ~~[#21] Implement Document Encryption that returns EDEKs.~~ [#21] Implement Document Encryption that returns EDEKs Aug 1, 2019

clintfred added 4 commits August 2, 2019 14:15

#[21] updated to newer proto definition

5ba7f1b

#[21] fixed test

01e8841

Merge remote-tracking branch 'origin/master' into 21-edek-encrypt

dbe4d07

#[21] disable Android x64 build for now

8013e7f

BobWall23 reviewed Aug 5, 2019

View reviewed changes

build.rs Show resolved Hide resolved

coltfred requested changes Aug 5, 2019

View reviewed changes

BobWall23 requested changes Aug 5, 2019

View reviewed changes

#[21] renamed edek.proto to transform.proto

a6ef265

coltfred reviewed Aug 5, 2019

View reviewed changes

src/internal/document_api/mod.rs Outdated Show resolved Hide resolved

src/internal/document_api/mod.rs Outdated Show resolved Hide resolved

src/internal/document_api/mod.rs Outdated Show resolved Hide resolved

src/internal/document_api/mod.rs Outdated Show resolved Hide resolved

clintfred added 2 commits August 5, 2019 18:08

#[21] address a round of PR feedback

fcf6d59

#[21] renamed document_encrypt_core to recrypt_document

8c8127d

skeet70 reviewed Aug 6, 2019

View reviewed changes

#[21] reorganize and rename advanced document operations

79f7ed0

giarc3 reviewed Aug 6, 2019

View reviewed changes

src/document.rs Outdated Show resolved Hide resolved

src/internal/document_api/mod.rs Outdated Show resolved Hide resolved

src/internal/document_api/mod.rs Outdated Show resolved Hide resolved

clintfred requested a review from skeet70 August 6, 2019 22:27

clintfred added 4 commits August 6, 2019 16:30

#[21] better error handling for deserialization of edek proto into gr…

ff3b715

…ants()

#[21] name and doc cleanups

dd4a7ee

#[21] fix integration test; smaller clone()

898fa7f

#[21] fix public key serialization bug

b13cfeb

skeet70 approved these changes Aug 7, 2019

View reviewed changes

src/internal/mod.rs Show resolved Hide resolved

#[21] unit test for internal EncryptedDek to proto

dab643a

This was referenced Aug 8, 2019

Replace (WithKey<UserOrGroup>, EncryptedValue) with EncryptedDek #28

Open

Bad error in the case of encrypt to users who don't exist. #18

Open

Refactor document_grant_access to use shared code for resolving public keys #29

Open

clintfred added 2 commits August 7, 2019 22:08

#[21] removed TODOs now that appropriate issues exist

10c0002

[#21] removing generated file

38c2901

coltfred requested changes Aug 8, 2019

View reviewed changes

clintfred commented Aug 8, 2019

View reviewed changes

#[21] WIP DocumentEncryptUnmanagedResult::grants() infallible

a884f81

coltfred approved these changes Aug 9, 2019

View reviewed changes

clintfred added 2 commits August 9, 2019 08:26

#[21] removed an integration test; make a unit test for grants/proto …

bef30c6

…validation

#[21] EncryptedDekData.encryptedMessage -> EncryptedDekData.encrypted…

06e82e8

…Bytes

clintfred merged commit 448920f into master Aug 9, 2019

clintfred deleted the 21-edek-encrypt branch August 9, 2019 14:51

clintfred mentioned this pull request Sep 4, 2019

Support unmanaged encryption IronCoreLabs/ironweb#33

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[#21] Implement Document Encryption that returns EDEKs #27

[#21] Implement Document Encryption that returns EDEKs #27

clintfred commented Aug 1, 2019 •

edited

clintfred commented Aug 1, 2019

coltfred left a comment

giarc3 left a comment

skeet70 left a comment

coltfred left a comment

coltfred Aug 8, 2019

clintfred left a comment

coltfred left a comment

[#21] Implement Document Encryption that returns EDEKs #27

[#21] Implement Document Encryption that returns EDEKs #27

Conversation

clintfred commented Aug 1, 2019 • edited

Changelog

TODO

clintfred commented Aug 1, 2019

coltfred left a comment

Choose a reason for hiding this comment

giarc3 left a comment

Choose a reason for hiding this comment

skeet70 left a comment

Choose a reason for hiding this comment

coltfred left a comment

Choose a reason for hiding this comment

coltfred Aug 8, 2019

Choose a reason for hiding this comment

clintfred left a comment

Choose a reason for hiding this comment

coltfred left a comment

Choose a reason for hiding this comment

clintfred commented Aug 1, 2019 •

edited