feat: Secure atKeys with pass-phrase #703

sitaram-kalluri · 2024-10-30T10:22:39Z

- What I did
Support the password protected of atKeys file.

- How I did it

Add pass phrase to the AtOnboardingPreference to capture the pass phrase and propagate it the at_auth and at_chops package to decrypt the atKeys.
In auth_cli_args, add parser options to capture "pass phrase" and "hashing algo type"
In at_onboarding_service_impl.dart, in "_generateAtKeysFile", check if the passPhrase is supplied. If supplied, encrypt the keys with the passphrase.
Removed the at_cli_commons dependency from at_onboarding_cli to prevent from cyclic dependency.

- How to verify it

Added a test to verify the encryption and decryption of atKeys using a passphrase with the argon2id algorithm
A functional test to verify password protected of atKeys file

- Description for the changelog

feat: Support password protected of atKeys

packages/at_cli_commons/lib/src/cli_base.dart

packages/at_chops/lib/src/algorithm/algo_type.dart

packages/at_chops/lib/src/at_keys_crypto.dart

sitaram-kalluri · 2024-11-06T10:41:33Z

Verified backward compatibility of at_auth and at_chops packages with at_client_sdk and looks fine.

Added dependency overrides for at_chops and at_auth packages in at_functional, E2E and unit tests in at_client_sdk. Refer to the PR: <DO NOT MERGE>test: Add dependency overrides for at_chops and at_auth packages at_client_sdk#1426

packages/at_chops/lib/src/algorithm/at_hashing_algo_factory.dart

gkc

LGTM - will leave final approval to Murali

…-protected-encryption-ofatkeys-files # Conflicts: # packages/at_chops/lib/at_chops.dart # packages/at_chops/lib/src/algorithm/aes_encryption_algo.dart # packages/at_chops/lib/src/at_keys_crypto.dart

…-protected-encryption-ofatkeys-files

sitaram-kalluri · 2024-11-25T03:43:10Z

The changes in

at_chops package are merged with PR: feat: at_chops : Support for password protected atKeys file #708 and are published in v2.2.0
at_auth package are merged with PR: feat: at_auth : Add "passPhrase" in "AtAuthRequest" to support password protected atKeys file #715 and are published in v2.0.8.

At this point, this PR contains changes in at_onboarding_cli. The changes are at_cli_commons are moved to a different branch.

gkc · 2024-11-25T07:53:20Z

packages/at_onboarding_cli/lib/src/cli/auth_cli.dart

+  String? commitLogStoragePathToUse =
+      ('${storageDir?.path}/commit').replaceAll('/', Platform.pathSeparator);
+  String downloadPathToUse = ('$homeDir!/.atsign/downloads/$atSign/$nameSpace')
+      .replaceAll('/', Platform.pathSeparator);



Can you extract the code below into its own file as a function which will return an AtClient given some args (similar to what we have in the noports repo here)

This change in implemented in 5be8bf9

gkc · 2024-11-25T07:57:21Z

packages/at_onboarding_cli/lib/src/util/home_directory_util.dart

@@ -50,4 +53,62 @@ class HomeDirectoryUtil {
            enrollmentId: enrollmentId),
        'hive');
  }
+
+  /// Generate a path like this:


I really don't like that we are duplicating this code, again. I think instead we should move these functions to at_utils from at_cli_commons. Rather than delay this PR further, please create another ticket to take care of this.

Created the following ticket: #720

…t_client_cli.dart" and use it in auth_cli.dart

murali-shris · 2024-11-29T09:59:32Z

packages/at_onboarding_cli/lib/src/util/create_at_client_cli.dart

+    stderr.writeln();
+    var msg = 'Failed to connect after $attempts attempts';
+    stderr.writeln(chalk.brightRed(msg));
+    throw SecondaryServerConnectivityException(msg);


This may not be connectivity error always. Auth can fail for other reasons.
Can you replace with UnAuthenticatedException

This is addressed in 0bdb5e5

murali-shris · 2024-11-29T10:01:38Z

tests/at_onboarding_cli_functional_tests/test/enrollment_cli_commands_test.dart

+            '${Platform.environment['HOME']}/.atsign/keys/${atSign}_key.atKeys')
+          // Fetched cram key from the at_demos repo.
+          ..cramSecret =
+              '15cdce8f92bcf7e742d5b75dc51ec06d798952f8bf7e8ff4c2b6448e5f7c2c12b570fe945f04011455fdc49cacdf9393d9c1ac4609ec71c1a0b0c213578e7ec7');


can we add dependency to at_demos and remove this hard coded cram key

This is addressed in 0bdb5e5

gkc

Please address Murali's comments

feat: Secure atKeys with pass-phrase

0ee953a

sitaram-kalluri requested review from gkc, murali-shris and VJag October 30, 2024 10:25

sitaram-kalluri added 2 commits October 30, 2024 16:22

fix: Add dependency overrides for build to pass

2fb5481

fix: Add dependency overrides to at_cli_commons

de9bfee

gkc requested changes Nov 1, 2024

View reviewed changes

packages/at_cli_commons/lib/src/cli_base.dart Outdated Show resolved Hide resolved

fix: Add pass-phrase to cli arg parser and run dart formatter

d3b8dbe

sitaram-kalluri requested a review from gkc November 4, 2024 02:09

murali-shris requested changes Nov 5, 2024

View reviewed changes

packages/at_chops/lib/src/algorithm/algo_type.dart Outdated Show resolved Hide resolved

packages/at_chops/lib/src/at_keys_crypto.dart Outdated Show resolved Hide resolved

packages/at_chops/lib/src/at_keys_crypto.dart Outdated Show resolved Hide resolved

fix: Introduce AtHashingAlgorithmFactory and minor code changes

6877c41

sitaram-kalluri requested a review from murali-shris November 6, 2024 10:35

sitaram-kalluri mentioned this pull request Nov 6, 2024

<DO NOT MERGE>test: Add dependency overrides for at_chops and at_auth packages atsign-foundation/at_client_sdk#1426

Closed

murali-shris requested changes Nov 7, 2024

View reviewed changes

packages/at_chops/lib/src/algorithm/at_hashing_algo_factory.dart Outdated Show resolved Hide resolved

fix: Remove DefaultHash from the at_hashing_algo_factory.dart

6f3f785

sitaram-kalluri requested a review from murali-shris November 8, 2024 01:42

gkc reviewed Nov 11, 2024

View reviewed changes

sitaram-kalluri linked an issue Nov 11, 2024 that may be closed by this pull request

Add Encryption Password Option to CLI Commands in at_onboarding_cli for Onboard/Enroll** #691

Closed

sitaram-kalluri mentioned this pull request Nov 13, 2024

feat: at_chops : Support for password protected atKeys file #708

Merged

sitaram-kalluri mentioned this pull request Nov 20, 2024

feat: at_auth : Add "passPhrase" in "AtAuthRequest" to support password protected atKeys file #715

Merged

sitaram-kalluri added 4 commits November 20, 2024 20:15

Merge remote-tracking branch 'origin/trunk' into 604-support-password…

2aeb924

…-protected-encryption-ofatkeys-files # Conflicts: # packages/at_chops/lib/at_chops.dart # packages/at_chops/lib/src/algorithm/aes_encryption_algo.dart # packages/at_chops/lib/src/at_keys_crypto.dart

fix: Remove at_cli_commons from the dependencies

055dd66

Merge remote-tracking branch 'origin/trunk' into 604-support-password…

514f53f

…-protected-encryption-ofatkeys-files

fix: Remove at_cli_commons from the dependencies

a00fea5

sitaram-kalluri requested a review from gkc November 25, 2024 04:23

gkc requested changes Nov 25, 2024

View reviewed changes

fix: Move at_client instance creation to a different file - "create_a…

5be8bf9

…t_client_cli.dart" and use it in auth_cli.dart

sitaram-kalluri requested a review from gkc November 25, 2024 08:56

murali-shris requested changes Nov 29, 2024

View reviewed changes

gkc previously approved these changes Nov 29, 2024

View reviewed changes

fix: Add at_demo_data dependency to remove hard coded cram keys

0bdb5e5

sitaram-kalluri dismissed gkc’s stale review via 0bdb5e5 November 30, 2024 01:52

sitaram-kalluri requested a review from murali-shris November 30, 2024 01:59

murali-shris approved these changes Dec 2, 2024

View reviewed changes

sitaram-kalluri merged commit b80419a into trunk Dec 2, 2024
12 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Secure atKeys with pass-phrase #703

feat: Secure atKeys with pass-phrase #703

sitaram-kalluri commented Oct 30, 2024 •

edited

Loading

sitaram-kalluri commented Nov 6, 2024

gkc left a comment

sitaram-kalluri commented Nov 25, 2024

gkc Nov 25, 2024

sitaram-kalluri Nov 25, 2024

gkc Nov 25, 2024

sitaram-kalluri Nov 25, 2024

murali-shris Nov 29, 2024

sitaram-kalluri Nov 30, 2024

murali-shris Nov 29, 2024

sitaram-kalluri Nov 30, 2024

gkc left a comment

feat: Secure atKeys with pass-phrase #703

feat: Secure atKeys with pass-phrase #703

Conversation

sitaram-kalluri commented Oct 30, 2024 • edited Loading

sitaram-kalluri commented Nov 6, 2024

gkc left a comment

Choose a reason for hiding this comment

sitaram-kalluri commented Nov 25, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

gkc left a comment

Choose a reason for hiding this comment

sitaram-kalluri commented Oct 30, 2024 •

edited

Loading