bitwarden_core/auth/
tde.rs

1use base64::{engine::general_purpose::STANDARD, Engine};
2use bitwarden_crypto::{
3    AsymmetricPublicCryptoKey, DeviceKey, EncString, Kdf, SymmetricCryptoKey, TrustDeviceResponse,
4    UnsignedSharedKey, UserKey,
5};
6
7use crate::{client::encryption_settings::EncryptionSettingsError, Client};
8
9/// This function generates a new user key and key pair, initializes the client's crypto with the
10/// generated user key, and encrypts the user key with the organization public key for admin
11/// password reset. If remember_device is true, it also generates a device key.
12pub(super) fn make_register_tde_keys(
13    client: &Client,
14    email: String,
15    org_public_key: String,
16    remember_device: bool,
17) -> Result<RegisterTdeKeyResponse, EncryptionSettingsError> {
18    let public_key = AsymmetricPublicCryptoKey::from_der(&STANDARD.decode(org_public_key)?)?;
19
20    let user_key = UserKey::new(SymmetricCryptoKey::make_aes256_cbc_hmac_key());
21    let key_pair = user_key.make_key_pair()?;
22
23    let admin_reset = UnsignedSharedKey::encapsulate_key_unsigned(&user_key.0, &public_key)?;
24
25    let device_key = if remember_device {
26        Some(DeviceKey::trust_device(&user_key.0)?)
27    } else {
28        None
29    };
30
31    client
32        .internal
33        .set_login_method(crate::client::LoginMethod::User(
34            crate::client::UserLoginMethod::Username {
35                client_id: "".to_owned(),
36                email,
37                kdf: Kdf::default(),
38            },
39        ));
40    client
41        .internal
42        .initialize_user_crypto_decrypted_key(user_key.0, key_pair.private.clone())?;
43
44    Ok(RegisterTdeKeyResponse {
45        private_key: key_pair.private,
46        public_key: key_pair.public,
47
48        admin_reset,
49        device_key,
50    })
51}
52
53#[cfg_attr(feature = "uniffi", derive(uniffi::Record))]
54pub struct RegisterTdeKeyResponse {
55    pub private_key: EncString,
56    pub public_key: String,
57
58    pub admin_reset: UnsignedSharedKey,
59    pub device_key: Option<TrustDeviceResponse>,
60}
bitwarden_core/auth/tde.rs

bitwarden_core/auth/
tde.rs
