bitwarden_crypto/keys/
public_key_encryption.rs

1use std::{pin::Pin, str::FromStr};
2
3use bitwarden_encoding::{B64, FromStrVisitor};
4use rsa::{RsaPrivateKey, RsaPublicKey, pkcs8::DecodePublicKey};
5use serde::{Deserialize, Serialize};
6use serde_repr::{Deserialize_repr, Serialize_repr};
7use tracing::instrument;
8#[cfg(feature = "wasm")]
9use wasm_bindgen::convert::FromWasmAbi;
10
11use super::key_encryptable::CryptoKey;
12use crate::{
13    Pkcs8PrivateKeyBytes, SpkiPublicKeyBytes,
14    error::{CryptoError, Result},
15};
16
17#[cfg(feature = "wasm")]
18#[wasm_bindgen::prelude::wasm_bindgen(typescript_custom_section)]
19const TS_CUSTOM_TYPES: &'static str = r#"
20export type PublicKey = Tagged<string, "PublicKey">;
21"#;
22
23#[cfg(feature = "wasm")]
24impl wasm_bindgen::describe::WasmDescribe for PublicKey {
25    fn describe() {
26        <String as wasm_bindgen::describe::WasmDescribe>::describe();
27    }
28}
29
30#[cfg(feature = "wasm")]
31impl FromWasmAbi for PublicKey {
32    type Abi = <String as FromWasmAbi>::Abi;
33
34    unsafe fn from_abi(abi: Self::Abi) -> Self {
35        use wasm_bindgen::UnwrapThrowExt;
36
37        let s = unsafe { String::from_abi(abi) };
38        let bytes: Vec<u8> = s.parse::<bitwarden_encoding::B64>().unwrap_throw().into();
39        PublicKey::from_der(&SpkiPublicKeyBytes::from(bytes)).unwrap_throw()
40    }
41}
42
43/// Algorithm / public key encryption scheme used for encryption/decryption.
44#[derive(Serialize_repr, Deserialize_repr)]
45#[repr(u8)]
46pub enum PublicKeyEncryptionAlgorithm {
47    /// RSA with OAEP padding and SHA-1 hashing.
48    RsaOaepSha1 = 0,
49}
50
51#[derive(Clone, PartialEq)]
52pub(crate) enum RawPublicKey {
53    RsaOaepSha1(RsaPublicKey),
54}
55
56/// Public key of a key pair used in a public key encryption scheme. It is used for
57/// encrypting data.
58#[derive(Clone, PartialEq)]
59pub struct PublicKey {
60    inner: RawPublicKey,
61}
62
63impl PublicKey {
64    pub(crate) fn inner(&self) -> &RawPublicKey {
65        &self.inner
66    }
67
68    /// Build a public key from the SubjectPublicKeyInfo DER.
69    #[instrument(skip_all, err)]
70    pub fn from_der(der: &SpkiPublicKeyBytes) -> Result<Self> {
71        Ok(PublicKey {
72            inner: RawPublicKey::RsaOaepSha1(
73                RsaPublicKey::from_public_key_der(der.as_ref())
74                    .map_err(|_| CryptoError::InvalidKey)?,
75            ),
76        })
77    }
78
79    /// Makes a SubjectPublicKeyInfo DER serialized version of the public key.
80    #[instrument(skip_all, err)]
81    pub fn to_der(&self) -> Result<SpkiPublicKeyBytes> {
82        use rsa::pkcs8::EncodePublicKey;
83        match &self.inner {
84            RawPublicKey::RsaOaepSha1(public_key) => Ok(public_key
85                .to_public_key_der()
86                .map_err(|_| CryptoError::InvalidKey)?
87                .as_bytes()
88                .to_owned()
89                .into()),
90        }
91    }
92}
93
94impl FromStr for PublicKey {
95    type Err = ();
96
97    fn from_str(s: &str) -> Result<Self, Self::Err> {
98        let bytes: Vec<u8> = s.parse::<B64>().map_err(|_| ())?.into();
99        Self::from_der(&SpkiPublicKeyBytes::from(bytes)).map_err(|_| ())
100    }
101}
102
103impl<'de> Deserialize<'de> for PublicKey {
104    fn deserialize<D>(deserializer: D) -> std::result::Result<Self, D::Error>
105    where
106        D: serde::Deserializer<'de>,
107    {
108        deserializer.deserialize_str(FromStrVisitor::new())
109    }
110}
111
112impl Serialize for PublicKey {
113    fn serialize<S>(&self, serializer: S) -> std::result::Result<S::Ok, S::Error>
114    where
115        S: serde::Serializer,
116    {
117        let der = self.to_der().map_err(serde::ser::Error::custom)?;
118        serializer.serialize_str(&B64::from(der.as_ref()).to_string())
119    }
120}
121
122#[derive(Clone)]
123pub(crate) enum RawPrivateKey {
124    // RsaPrivateKey is not a Copy type so this isn't completely necessary, but
125    // to keep the compiler from making stack copies when moving this struct around,
126    // we use a Box to keep the values on the heap. We also pin the box to make sure
127    // that the contents can't be pulled out of the box and moved
128    RsaOaepSha1(Pin<Box<RsaPrivateKey>>),
129}
130
131/// Private key of a key pair used in a public key encryption scheme. It is used for
132/// decrypting data that was encrypted with the corresponding public key.
133#[derive(Clone)]
134pub struct PrivateKey {
135    inner: RawPrivateKey,
136}
137
138// Note that RsaPrivateKey already implements ZeroizeOnDrop, so we don't need to do anything
139// We add this assertion to make sure that this is still true in the future
140const _: fn() = || {
141    fn assert_zeroize_on_drop<T: zeroize::ZeroizeOnDrop>() {}
142    assert_zeroize_on_drop::<RsaPrivateKey>();
143};
144impl zeroize::ZeroizeOnDrop for PrivateKey {}
145impl CryptoKey for PrivateKey {}
146
147impl PrivateKey {
148    /// Generate a random PrivateKey (RSA-2048).
149    pub fn make(algorithm: PublicKeyEncryptionAlgorithm) -> Self {
150        Self::make_internal(algorithm, &mut rand::thread_rng())
151    }
152
153    fn make_internal<R: rand::CryptoRng + rand::RngCore>(
154        algorithm: PublicKeyEncryptionAlgorithm,
155        rng: &mut R,
156    ) -> Self {
157        match algorithm {
158            PublicKeyEncryptionAlgorithm::RsaOaepSha1 => Self {
159                inner: RawPrivateKey::RsaOaepSha1(Box::pin(
160                    RsaPrivateKey::new(rng, 2048).expect("failed to generate a key"),
161                )),
162            },
163        }
164    }
165
166    #[allow(missing_docs)]
167    #[cfg_attr(feature = "dangerous-crypto-debug", instrument(err))]
168    #[cfg_attr(not(feature = "dangerous-crypto-debug"), instrument(skip_all, err))]
169    pub fn from_pem(pem: &str) -> Result<Self> {
170        use rsa::pkcs8::DecodePrivateKey;
171        Ok(Self {
172            inner: RawPrivateKey::RsaOaepSha1(Box::pin(
173                RsaPrivateKey::from_pkcs8_pem(pem).map_err(|_| CryptoError::InvalidKey)?,
174            )),
175        })
176    }
177
178    #[allow(missing_docs)]
179    #[cfg_attr(feature = "dangerous-crypto-debug", instrument(err))]
180    #[cfg_attr(not(feature = "dangerous-crypto-debug"), instrument(skip_all, err))]
181    pub fn from_der(der: &Pkcs8PrivateKeyBytes) -> Result<Self> {
182        use rsa::pkcs8::DecodePrivateKey;
183        Ok(Self {
184            inner: RawPrivateKey::RsaOaepSha1(Box::pin(
185                RsaPrivateKey::from_pkcs8_der(der.as_ref()).map_err(|_| CryptoError::InvalidKey)?,
186            )),
187        })
188    }
189
190    #[allow(missing_docs)]
191    #[cfg_attr(feature = "dangerous-crypto-debug", instrument(err))]
192    #[cfg_attr(not(feature = "dangerous-crypto-debug"), instrument(skip_all, err))]
193    pub fn to_der(&self) -> Result<Pkcs8PrivateKeyBytes> {
194        match &self.inner {
195            RawPrivateKey::RsaOaepSha1(private_key) => {
196                use rsa::pkcs8::EncodePrivateKey;
197                Ok(private_key
198                    .to_pkcs8_der()
199                    .map_err(|_| CryptoError::InvalidKey)?
200                    .as_bytes()
201                    .to_owned()
202                    .into())
203            }
204        }
205    }
206
207    /// Derives the public key corresponding to this private key. This is deterministic
208    /// and always derives the same public key.
209    pub fn to_public_key(&self) -> PublicKey {
210        match &self.inner {
211            RawPrivateKey::RsaOaepSha1(private_key) => PublicKey {
212                inner: RawPublicKey::RsaOaepSha1(private_key.to_public_key()),
213            },
214        }
215    }
216
217    pub(crate) fn inner(&self) -> &RawPrivateKey {
218        &self.inner
219    }
220}
221
222// We manually implement these to make sure we don't print any sensitive data
223impl std::fmt::Debug for PrivateKey {
224    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
225        let mut debug_struct = f.debug_struct("PrivateKey");
226        #[cfg(feature = "dangerous-crypto-debug")]
227        match &self.inner {
228            RawPrivateKey::RsaOaepSha1(_key) => {
229                debug_struct.field("algorithm", &"RsaOaepSha1");
230                if let Ok(der) = self.to_der() {
231                    debug_struct.field("private_key_der", &der.as_ref());
232                }
233            }
234        }
235        debug_struct.finish()
236    }
237}
238
239#[cfg(test)]
240mod tests {
241
242    use bitwarden_encoding::B64;
243
244    use crate::{
245        Pkcs8PrivateKeyBytes, PrivateKey, PublicKey, SpkiPublicKeyBytes, SymmetricCryptoKey,
246        UnsignedSharedKey,
247        content_format::{Bytes, Pkcs8PrivateKeyDerContentFormat},
248    };
249
250    #[test]
251    fn test_asymmetric_crypto_key() {
252        let pem_key_str = "-----BEGIN PRIVATE KEY-----
253MIIEwAIBADANBgkqhkiG9w0BAQEFAASCBKowggSmAgEAAoIBAQDiTQVuzhdygFz5
254qv14i+XFDGTnDravzUQT1hPKPGUZOUSZ1gwdNgkWqOIaOnR65BHEnL0sp4bnuiYc
255afeK2JAW5Sc8Z7IxBNSuAwhQmuKx3RochMIiuCkI2/p+JvUQoJu6FBNm8OoJ4Cwm
256qqHGZESMfnpQDCuDrB3JdJEdXhtmnl0C48sGjOk3WaBMcgGqn8LbJDUlyu1zdqyv
257b0waJf0iV4PJm2fkUl7+57D/2TkpbCqURVnZK1FFIEg8mr6FzSN1F2pOfktkNYZw
258P7MSNR7o81CkRSCMr7EkIVa+MZYMBx106BMK7FXgWB7nbSpsWKxBk7ZDHkID2fam
259rEcVtrzDAgMBAAECggEBAKwq9OssGGKgjhvUnyrLJHAZ0dqIMyzk+dotkLjX4gKi
260szJmyqiep6N5sStLNbsZMPtoU/RZMCW0VbJgXFhiEp2YkZU/Py5UAoqw++53J+kx
2610d/IkPphKbb3xUec0+1mg5O6GljDCQuiZXS1dIa/WfeZcezclW6Dz9WovY6ePjJ+
2628vEBR1icbNKzyeINd6MtPtpcgQPHtDwHvhPyUDbKDYGbLvjh9nui8h4+ZUlXKuVR
263jB0ChxiKV1xJRjkrEVoulOOicd5r597WfB2ghax3pvRZ4MdXemCXm3gQYqPVKach
264vGU+1cPQR/MBJZpxT+EZA97xwtFS3gqwbxJaNFcoE8ECgYEA9OaeYZhQPDo485tI
2651u/Z7L/3PNape9hBQIXoW7+MgcQ5NiWqYh8Jnj43EIYa0wM/ECQINr1Za8Q5e6KR
266J30FcU+kfyjuQ0jeXdNELGU/fx5XXNg/vV8GevHwxRlwzqZTCg6UExUZzbYEQqd7
267l+wPyETGeua5xCEywA1nX/D101kCgYEA7I6aMFjhEjO71RmzNhqjKJt6DOghoOfQ
268TjhaaanNEhLYSbenFz1mlb21mW67ulmz162saKdIYLxQNJIP8ZPmxh4ummOJI8w9
269ClHfo8WuCI2hCjJ19xbQJocSbTA5aJg6lA1IDVZMDbQwsnAByPRGpaLHBT/Q9Bye
270KvCMB+9amXsCgYEAx65yXSkP4sumPBrVHUub6MntERIGRxBgw/drKcPZEMWp0FiN
271wEuGUBxyUWrG3F69QK/gcqGZE6F/LSu0JvptQaKqgXQiMYJsrRvhbkFvsHpQyUcZ
272UZL1ebFjm5HOxPAgrQaN/bEqxOwwNRjSUWEMzUImg3c06JIZCzbinvudtKECgYEA
273kY3JF/iIPI/yglP27lKDlCfeeHSYxI3+oTKRhzSAxx8rUGidenJAXeDGDauR/T7W
274pt3pGNfddBBK9Z3uC4Iq3DqUCFE4f/taj7ADAJ1Q0Vh7/28/IJM77ojr8J1cpZwN
275Zy2o6PPxhfkagaDjqEeN9Lrs5LD4nEvDkr5CG1vOjmMCgYEAvIBFKRm31NyF8jLi
276CVuPwC5PzrW5iThDmsWTaXFpB3esUsbICO2pEz872oeQS+Em4GO5vXUlpbbFPzup
277PFhA8iMJ8TAvemhvc7oM0OZqpU6p3K4seHf6BkwLxumoA3vDJfovu9RuXVcJVOnf
278DnqOsltgPomWZ7xVfMkm9niL2OA=
279-----END PRIVATE KEY-----";
280
281        let der_key: B64 = "MIIEwAIBADANBgkqhkiG9w0BAQEFAASCBKowggSmAgEAAoIBAQDiTQVuzhdygFz5qv14i+XFDGTnDravzUQT1hPKPGUZOUSZ1gwdNgkWqOIaOnR65BHEnL0sp4bnuiYcafeK2JAW5Sc8Z7IxBNSuAwhQmuKx3RochMIiuCkI2/p+JvUQoJu6FBNm8OoJ4CwmqqHGZESMfnpQDCuDrB3JdJEdXhtmnl0C48sGjOk3WaBMcgGqn8LbJDUlyu1zdqyvb0waJf0iV4PJm2fkUl7+57D/2TkpbCqURVnZK1FFIEg8mr6FzSN1F2pOfktkNYZwP7MSNR7o81CkRSCMr7EkIVa+MZYMBx106BMK7FXgWB7nbSpsWKxBk7ZDHkID2famrEcVtrzDAgMBAAECggEBAKwq9OssGGKgjhvUnyrLJHAZ0dqIMyzk+dotkLjX4gKiszJmyqiep6N5sStLNbsZMPtoU/RZMCW0VbJgXFhiEp2YkZU/Py5UAoqw++53J+kx0d/IkPphKbb3xUec0+1mg5O6GljDCQuiZXS1dIa/WfeZcezclW6Dz9WovY6ePjJ+8vEBR1icbNKzyeINd6MtPtpcgQPHtDwHvhPyUDbKDYGbLvjh9nui8h4+ZUlXKuVRjB0ChxiKV1xJRjkrEVoulOOicd5r597WfB2ghax3pvRZ4MdXemCXm3gQYqPVKachvGU+1cPQR/MBJZpxT+EZA97xwtFS3gqwbxJaNFcoE8ECgYEA9OaeYZhQPDo485tI1u/Z7L/3PNape9hBQIXoW7+MgcQ5NiWqYh8Jnj43EIYa0wM/ECQINr1Za8Q5e6KRJ30FcU+kfyjuQ0jeXdNELGU/fx5XXNg/vV8GevHwxRlwzqZTCg6UExUZzbYEQqd7l+wPyETGeua5xCEywA1nX/D101kCgYEA7I6aMFjhEjO71RmzNhqjKJt6DOghoOfQTjhaaanNEhLYSbenFz1mlb21mW67ulmz162saKdIYLxQNJIP8ZPmxh4ummOJI8w9ClHfo8WuCI2hCjJ19xbQJocSbTA5aJg6lA1IDVZMDbQwsnAByPRGpaLHBT/Q9ByeKvCMB+9amXsCgYEAx65yXSkP4sumPBrVHUub6MntERIGRxBgw/drKcPZEMWp0FiNwEuGUBxyUWrG3F69QK/gcqGZE6F/LSu0JvptQaKqgXQiMYJsrRvhbkFvsHpQyUcZUZL1ebFjm5HOxPAgrQaN/bEqxOwwNRjSUWEMzUImg3c06JIZCzbinvudtKECgYEAkY3JF/iIPI/yglP27lKDlCfeeHSYxI3+oTKRhzSAxx8rUGidenJAXeDGDauR/T7Wpt3pGNfddBBK9Z3uC4Iq3DqUCFE4f/taj7ADAJ1Q0Vh7/28/IJM77ojr8J1cpZwNZy2o6PPxhfkagaDjqEeN9Lrs5LD4nEvDkr5CG1vOjmMCgYEAvIBFKRm31NyF8jLiCVuPwC5PzrW5iThDmsWTaXFpB3esUsbICO2pEz872oeQS+Em4GO5vXUlpbbFPzupPFhA8iMJ8TAvemhvc7oM0OZqpU6p3K4seHf6BkwLxumoA3vDJfovu9RuXVcJVOnfDnqOsltgPomWZ7xVfMkm9niL2OA=".parse().unwrap();
282        let der_key_vec: Vec<u8> = der_key.into();
283
284        // Load the two different formats and check they are the same key
285        let pem_key = PrivateKey::from_pem(pem_key_str).unwrap();
286        let der_key = PrivateKey::from_der(&Bytes::<Pkcs8PrivateKeyDerContentFormat>::from(
287            der_key_vec.clone(),
288        ))
289        .unwrap();
290        assert_eq!(pem_key.to_der().unwrap(), der_key.to_der().unwrap());
291
292        // Check that the keys can be converted back to DER
293
294        assert_eq!(der_key.to_der().unwrap().to_vec(), der_key_vec.clone());
295        assert_eq!(pem_key.to_der().unwrap().to_vec(), der_key_vec);
296    }
297
298    #[test]
299    fn test_encrypt_public_decrypt_private() {
300        let private_key: B64 = concat!(
301            "MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCu9xd+vmkIPoqH",
302            "NejsFZzkd1xuCn1TqGTT7ANhAEnbI/yaVt3caI30kwUC2WIToFpNgu7Ej0x2TteY",
303            "OgrLrdcC4jy1SifmKYv/v3ZZxrd/eqttmH2k588panseRwHK3LVk7xA+URhQ/bjL",
304            "gPM59V0uR1l+z1fmooeJPFz5WSXNObc9Jqnh45FND+U/UYHXTLSomTn7jgZFxJBK",
305            "veS7q6Lat7wAnYZCF2dnPmhZoJv+SKPltA8HAGsgQGWBF1p5qxV1HrAUk8kBBnG2",
306            "paj0w8p5UM6RpDdCuvKH7j1LiuWffn3b9Z4dgzmE7jsMmvzoQtypzIKaSxhqzvFO",
307            "od9V8dJdAgMBAAECggEAGGIYjOIB1rOKkDHP4ljXutI0mCRPl3FMDemiBeppoIfZ",
308            "G/Q3qpAKmndDt0Quwh/yfcNdvZhf1kwCCTWri/uPz5fSUIyDV3TaTRu0ZWoHaBVj",
309            "Hxylg+4HRZUQj+Vi50/PWr/jQmAAVMcrMfcoTl82q2ynmP/R1vM3EsXOCjTliv5B",
310            "XlMPRjj/9PDBH0dnnVcAPDOpflzOTL2f4HTFEMlmg9/tZBnd96J/cmfhjAv9XpFL",
311            "FBAFZzs5pz0rwCNSR8QZNonnK7pngVUlGDLORK58y84tGmxZhGdne3CtCWey/sJ4",
312            "7QF0Pe8YqWBU56926IY6DcSVBuQGZ6vMCNlU7J8D2QKBgQDXyh3t2TicM/n1QBLk",
313            "zLoGmVUmxUGziHgl2dnJiGDtyOAU3+yCorPgFaCie29s5qm4b0YEGxUxPIrRrEro",
314            "h0FfKn9xmr8CdmTPTcjJW1+M7bxxq7oBoU/QzKXgIHlpeCjjnvPJt0PcNkNTjCXv",
315            "shsrINh2rENoe/x79eEfM/N5eQKBgQDPkYSmYyALoNq8zq0A4BdR+F5lb5Fj5jBH",
316            "Jk68l6Uti+0hRbJ2d1tQTLkU+eCPQLGBl6fuc1i4K5FV7v14jWtRPdD7wxrkRi3j",
317            "ilqQwLBOU6Bj3FK4DvlLF+iYTuBWj2/KcxflXECmsjitKHLK6H7kFEiuJql+NAHU",
318            "U9EFXepLBQKBgQDQ+HCnZ1bFHiiP8m7Zl9EGlvK5SwlnPV9s+F1KJ4IGhCNM09UM",
319            "ZVfgR9F5yCONyIrPiyK40ylgtwqQJlOcf281I8irUXpsfg7+Gou5Q31y0r9NLUpC",
320            "Td8niyePtqMdGjouxD2+OHXFCd+FRxFt4IMi7vnxYr0csAVAXkqWlw7PsQKBgH/G",
321            "/PnQm7GM3BrOwAGB8dksJDAddkshMScblezTDYP0V43b8firkTLliCo5iNum357/",
322            "VQmdSEhXyag07yR/Kklg3H2fpbZQ3X7tdMMXW3FcWagfwWw9C4oGtdDM/Z1Lv23J",
323            "XDR9je8QV4OBGul+Jl8RfYx3kG94ZIfo8Qt0vP5hAoGARjAzdCGYz42NwaUk8n94",
324            "W2RuKHtTV9vtjaAbfPFbZoGkT7sXNJVlrA0C+9f+H9rOTM3mX59KrjmLVzde4Vhs",
325            "avWMShuK4vpAiDQLU7GyABvi5CR6Ld+AT+LSzxHhVe0ASOQPNCA2SOz3RQvgPi7R",
326            "GDgRMUB6cL3IRVzcR0dC6cY=",
327        )
328        .parse()
329        .unwrap();
330
331        let public_key: B64 = concat!(
332            "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArvcXfr5pCD6KhzXo7BWc",
333            "5Hdcbgp9U6hk0+wDYQBJ2yP8mlbd3GiN9JMFAtliE6BaTYLuxI9Mdk7XmDoKy63X",
334            "AuI8tUon5imL/792Wca3f3qrbZh9pOfPKWp7HkcByty1ZO8QPlEYUP24y4DzOfVd",
335            "LkdZfs9X5qKHiTxc+VklzTm3PSap4eORTQ/lP1GB10y0qJk5+44GRcSQSr3ku6ui",
336            "2re8AJ2GQhdnZz5oWaCb/kij5bQPBwBrIEBlgRdaeasVdR6wFJPJAQZxtqWo9MPK",
337            "eVDOkaQ3Qrryh+49S4rln3592/WeHYM5hO47DJr86ELcqcyCmksYas7xTqHfVfHS",
338            "XQIDAQAB",
339        )
340        .parse()
341        .unwrap();
342
343        let private_key = Pkcs8PrivateKeyBytes::from(private_key.as_bytes());
344        let private_key = PrivateKey::from_der(&private_key).unwrap();
345        let public_key = PublicKey::from_der(&SpkiPublicKeyBytes::from(&public_key)).unwrap();
346
347        let raw_key = SymmetricCryptoKey::make_aes256_cbc_hmac_key();
348        #[expect(deprecated)]
349        let encrypted = UnsignedSharedKey::encapsulate_key_unsigned(&raw_key, &public_key).unwrap();
350        #[expect(deprecated)]
351        let decrypted = encrypted.decapsulate_key_unsigned(&private_key).unwrap();
352
353        assert_eq!(raw_key, decrypted);
354    }
355
356    #[test]
357    fn test_asymmetric_public_crypto_key_from_str() {
358        let public_key_b64 = concat!(
359            "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArvcXfr5pCD6KhzXo7BWc",
360            "5Hdcbgp9U6hk0+wDYQBJ2yP8mlbd3GiN9JMFAtliE6BaTYLuxI9Mdk7XmDoKy63X",
361            "AuI8tUon5imL/792Wca3f3qrbZh9pOfPKWp7HkcByty1ZO8QPlEYUP24y4DzOfVd",
362            "LkdZfs9X5qKHiTxc+VklzTm3PSap4eORTQ/lP1GB10y0qJk5+44GRcSQSr3ku6ui",
363            "2re8AJ2GQhdnZz5oWaCb/kij5bQPBwBrIEBlgRdaeasVdR6wFJPJAQZxtqWo9MPK",
364            "eVDOkaQ3Qrryh+49S4rln3592/WeHYM5hO47DJr86ELcqcyCmksYas7xTqHfVfHS",
365            "XQIDAQAB",
366        );
367
368        // Test FromStr
369        let parsed_key: PublicKey = public_key_b64.parse().expect("should parse");
370
371        // Verify the key can be converted back to DER and then to B64
372        let der = parsed_key.to_der().expect("should convert to DER");
373        let b64_str = B64::from(der.as_ref()).to_string();
374        assert_eq!(b64_str, public_key_b64);
375    }
376
377    #[test]
378    fn test_asymmetric_public_crypto_key_from_str_invalid() {
379        // Invalid base64
380        let result: Result<PublicKey, _> = "not-valid-base64!!!".parse();
381        assert!(result.is_err());
382
383        // Valid base64 but invalid key data
384        let result: Result<PublicKey, _> = "aGVsbG8gd29ybGQ=".parse();
385        assert!(result.is_err());
386    }
387
388    #[test]
389    fn test_asymmetric_public_crypto_key_serialize_deserialize() {
390        let public_key_b64 = concat!(
391            "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArvcXfr5pCD6KhzXo7BWc",
392            "5Hdcbgp9U6hk0+wDYQBJ2yP8mlbd3GiN9JMFAtliE6BaTYLuxI9Mdk7XmDoKy63X",
393            "AuI8tUon5imL/792Wca3f3qrbZh9pOfPKWp7HkcByty1ZO8QPlEYUP24y4DzOfVd",
394            "LkdZfs9X5qKHiTxc+VklzTm3PSap4eORTQ/lP1GB10y0qJk5+44GRcSQSr3ku6ui",
395            "2re8AJ2GQhdnZz5oWaCb/kij5bQPBwBrIEBlgRdaeasVdR6wFJPJAQZxtqWo9MPK",
396            "eVDOkaQ3Qrryh+49S4rln3592/WeHYM5hO47DJr86ELcqcyCmksYas7xTqHfVfHS",
397            "XQIDAQAB",
398        );
399
400        // Parse the key
401        let key: PublicKey = public_key_b64.parse().expect("should parse");
402
403        // Serialize to JSON
404        let serialized = serde_json::to_string(&key).expect("should serialize");
405        assert_eq!(serialized, format!("\"{}\"", public_key_b64));
406
407        // Deserialize from JSON
408        let deserialized: PublicKey =
409            serde_json::from_str(&serialized).expect("should deserialize");
410
411        // Verify the keys are equal by comparing their DER representations
412        assert_eq!(
413            key.to_der().expect("should convert to DER"),
414            deserialized.to_der().expect("should convert to DER")
415        );
416    }
417
418    #[test]
419    fn test_asymmetric_public_crypto_key_deserialize_invalid() {
420        // Invalid base64
421        let result: Result<PublicKey, _> = serde_json::from_str("\"not-valid-base64!!!\"");
422        assert!(result.is_err());
423
424        // Valid base64 but invalid key data
425        let result: Result<PublicKey, _> = serde_json::from_str("\"aGVsbG8gd29ybGQ=\"");
426        assert!(result.is_err());
427
428        // Not a string
429        let result: Result<PublicKey, _> = serde_json::from_str("123");
430        assert!(result.is_err());
431    }
432}
bitwarden_crypto/keys/public_key_encryption.rs

bitwarden_crypto/keys/
public_key_encryption.rs
