bitwarden_importers/importers/keeper/crypto/mod.rs
1//! Keeper "direct" importer cryptography.
2//!
3//! This is a byte-for-byte port of the Keeper access layer's `crypto.ts`. It implements
4//! **Keeper's** wire formats, not Bitwarden's, so it deliberately does **not** live in
5//! `bitwarden-crypto`: the formats are unauthenticated AES-CBC ("aes-v1"), AES-GCM with a prepended
6//! nonce ("aes-v2"), RSA PKCS#1 v1.5 (unsupported), an ECDH-P256 → SHA-256 → AES-GCM scheme, and
7//! Keeper's custom `encryptionParams` blob. Where a primitive is standard we reuse
8//! `bitwarden_crypto` (`pbkdf2`) and otherwise use the RustCrypto crates directly.
9//!
10//! Every function here must stay compatible with data produced by Keeper's clients; do not change
11//! the formats.
12
13#![allow(dead_code)] // Ported ahead of the Keeper access layer that will consume it; see PM-38816.
14
15use aes::cipher::{
16 BlockModeDecrypt, KeyIvInit,
17 block_padding::{NoPadding, Pkcs7},
18};
19use aes_gcm::{Aes256Gcm, KeyInit, Nonce, aead::Aead};
20use p256::{
21 PublicKey, SecretKey,
22 elliptic_curve::{Generate, sec1::ToSec1Point},
23 pkcs8::{DecodePrivateKey, EncodePrivateKey},
24};
25use pbkdf2::pbkdf2_hmac_array;
26use sha2::{Digest, Sha256};
27use subtle::ConstantTimeEq;
28use zeroize::Zeroizing;
29
30mod error;
31pub(crate) use error::*;
32mod types;
33mod utils;