diff --git a/attestation-agent/deps/crypto/src/lib.rs b/attestation-agent/deps/crypto/src/lib.rs index ba677dcdd..d37d7c1b1 100644 --- a/attestation-agent/deps/crypto/src/lib.rs +++ b/attestation-agent/deps/crypto/src/lib.rs @@ -29,8 +29,5 @@ mod rust; mod symmetric; pub use symmetric::*; -mod teekey; -pub use teekey::*; - mod asymmetric; pub use asymmetric::*; diff --git a/attestation-agent/deps/crypto/src/teekey.rs b/attestation-agent/deps/crypto/src/teekey.rs deleted file mode 100644 index c9bf2c170..000000000 --- a/attestation-agent/deps/crypto/src/teekey.rs +++ /dev/null @@ -1,87 +0,0 @@ -// Copyright (c) 2023 Alibaba Cloud -// -// SPDX-License-Identifier: Apache-2.0 -// - -//! Implementations of the TeeKey - -use anyhow::*; -use base64::engine::general_purpose::STANDARD; -use base64::Engine; -use kbs_types::TeePubKey; -use rsa::pkcs1::DecodeRsaPublicKey; -use rsa::{traits::PublicKeyParts, Pkcs1v15Encrypt, RsaPrivateKey, RsaPublicKey}; -use sha2::{Digest, Sha384}; - -const RSA_PUBKEY_LENGTH: usize = 2048; - -pub const RSA_KEY_TYPE: &str = "RSA"; -pub const RSA_ALGORITHM: &str = "RSA1_5"; -pub const AES_256_GCM_ALGORITHM: &str = "A256GCM"; - -/// The key inside TEE to decrypt confidential data. -#[derive(Debug, Clone)] -pub struct TeeKey { - private_key: RsaPrivateKey, - public_key: RsaPublicKey, -} - -impl TeeKey { - pub fn new() -> Result { - let mut rng = rand::thread_rng(); - - let private_key = RsaPrivateKey::new(&mut rng, RSA_PUBKEY_LENGTH)?; - let public_key = RsaPublicKey::from(&private_key); - - Ok(TeeKey { - private_key, - public_key, - }) - } - - // Export TEE public key as JWK, as defined in RFC 7517. - pub fn export_pubkey(&self) -> Result { - let engine = base64::engine::general_purpose::URL_SAFE_NO_PAD; - let k_mod = engine.encode(self.public_key.n().to_bytes_be()); - let k_exp = engine.encode(self.public_key.e().to_bytes_be()); - - Ok(TeePubKey { - kty: RSA_KEY_TYPE.to_string(), - alg: RSA_ALGORITHM.to_string(), - k_mod, - k_exp, - }) - } - - // Use TEE private key to decrypt cipher text. - pub fn decrypt(&self, cipher_text: Vec) -> Result> { - self.private_key - .decrypt(Pkcs1v15Encrypt, &cipher_text) - .map_err(|e| anyhow!("TEE RSA key decrypt failed: {:?}", e)) - } -} - -// Returns a sha384 of all chunks. -pub fn hash_chunks(chunks: Vec>) -> Vec { - let mut hasher = Sha384::new(); - - for chunk in chunks.iter() { - hasher.update(chunk); - } - - hasher.finalize().to_vec() -} - -// Convert PKCS#1 PEM public key to TeePubKey -pub fn pkcs1_pem_to_teepubkey(pem: String) -> Result { - let public_key = RsaPublicKey::from_pkcs1_pem(&pem)?; - let k_mod = STANDARD.encode(public_key.n().to_bytes_be()); - let k_exp = STANDARD.encode(public_key.e().to_bytes_be()); - let tee_pubkey = TeePubKey { - kty: RSA_KEY_TYPE.to_string(), - alg: RSA_ALGORITHM.to_string(), - k_mod, - k_exp, - }; - Ok(tee_pubkey) -}