DO NOT MERGE: only for test

Signed-off-by: Xynnn007 <[email protected]>

Cargo.toml

@@ -37,7 +37,9 @@ hmac = "0.12.1"
 jwt-simple = { version = "0.12", default-features = false, features = [
     "pure-rust",
 ] }
-kbs-types = { git = "https://github.com/virtee/kbs-types.git", rev = "a704036" }
+# TODO: change this rev to official repo
+# Once https://github.com/virtee/kbs-types/pull/53 gets merged
+kbs-types = { git = "https://github.com/Xynnn007/kbs-types.git", rev = "f56c565" }
 lazy_static = "1.5.0"
 log = "0.4.22"
 nix = "0.29"

attestation-agent/deps/crypto/Cargo.toml

@@ -7,11 +7,14 @@ edition = "2021"
 
 [dependencies]
 aes-gcm = { workspace = true, optional = true }
+aes-kw = "0.2.1"
 anyhow.workspace = true
 base64.workspace = true
+concat-kdf = "0.1.0"
 ctr = { workspace = true, optional = true }
 kbs-types.workspace = true
-openssl = { workspace = true, features = ["vendored"], optional = true}
+openssl = { workspace = true, features = ["vendored"], optional = true }
+p256 = { version = "0.13.1", features = ["ecdh"] }
 rand.workspace = true
 rsa = { workspace = true, optional = true }
 serde.workspace = true
@@ -26,4 +29,4 @@ rstest.workspace = true
 [features]
 default = ["rust-crypto"]
 rust-crypto = ["dep:aes-gcm", "ctr", "rsa"]
-openssl = ["dep:openssl"]
+openssl = ["dep:openssl"]

attestation-agent/deps/crypto/src/asymmetric.rs

@@ -15,9 +15,12 @@ pub mod rsa {
     /// more information.
     #[derive(EnumString, AsRefStr)]
     pub enum PaddingMode {
-        #[strum(serialize = "RSA-OAEP")]
+        /// RSAES OAEP using SHA-256 and MGF1 with SHA-256
+        #[strum(serialize = "RSA-OAEP-256")]
         OAEP,
 
+        /// RSA PKCS#1 v1.5
+        #[deprecated]
         #[strum(serialize = "RSA1_5")]
         PKCS1v15,
     }
@@ -26,3 +29,30 @@ pub mod rsa {
 
     pub const RSA_KTY: &str = "RSA";
 }
+
+pub mod ec {
+    #[cfg(feature = "openssl")]
+    pub use crate::native::ec::*;
+
+    #[cfg(all(feature = "rust-crypto", not(feature = "openssl")))]
+    pub use crate::rust::ec::*;
+
+    /// The elliptic curve key type
+    pub const EC_KTY: &str = "EC";
+
+    /// Definations of different key wrapping algorithms. Refer to
+    /// <https://datatracker.ietf.org/doc/html/rfc7518> for
+    /// more information.
+    #[derive(EnumString, AsRefStr)]
+    pub enum KeyWrapAlgorithm {
+        /// ECDH-ES using Concat KDF and CEK wrapped with "A256KW"
+        #[strum(serialize = "ECDH-ES+A256KW")]
+        EcdhEsA256Kw,
+    }
+
+    #[derive(EnumString, AsRefStr)]
+    pub enum Curve {
+        #[strum(serialize = "P-256")]
+        P256,
+    }
+}

attestation-agent/deps/crypto/src/native/mod.rs

@@ -8,4 +8,5 @@
 pub mod aes256ctr;
 pub mod aes256gcm;
 
+pub mod ec;
 pub mod rsa;

attestation-agent/deps/crypto/src/native/rsa.rs

@@ -30,6 +30,7 @@ impl RSAKeyPair {
                 .private_key
                 .private_decrypt(&cipher_text, &mut plaintext, Padding::PKCS1_OAEP)
                 .map_err(|e| anyhow!("RSA key decrypt OAEP failed: {:?}", e))?,
+            #[allow(deprecated)]
             PaddingMode::PKCS1v15 => self
                 .private_key
                 .private_decrypt(&cipher_text, &mut plaintext, Padding::PKCS1)

attestation-agent/deps/crypto/src/rust/mod.rs

@@ -8,4 +8,6 @@
 pub mod aes256ctr;
 pub mod aes256gcm;
 
+pub mod ec;
 pub mod rsa;
+

attestation-agent/deps/crypto/src/rust/rsa.rs

@@ -41,6 +41,7 @@ impl RSAKeyPair {
                 .private_key
                 .decrypt(Oaep::new::<sha2::Sha256>(), &cipher_text)
                 .map_err(|e| anyhow!("RSA key decrypt OAEP failed: {:?}", e)),
+            #[allow(deprecated)]
             PaddingMode::PKCS1v15 => self
                 .private_key
                 .decrypt(Pkcs1v15Encrypt, &cipher_text)

attestation-agent/deps/crypto/src/symmetric.rs

@@ -15,6 +15,8 @@ use crate::native::*;
 #[cfg(all(feature = "rust-crypto", not(feature = "openssl")))]
 use crate::rust::*;
 
+pub const AES_GCM_256_KEY_BITS: u32 = 256;
+
 /// Supported WrapType, s.t. encryption algorithm using to encrypt the
 /// [PLBCO](https://github.com/confidential-containers/guest-components/blob/main/attestation-agent/docs/IMPLEMENTATION.md#encryption-and-decryption-of-container-image).
 /// TODO: Support more kinds of en/decryption schemes.

attestation-agent/kbs_protocol/src/client/rcar_client.rs

@@ -406,28 +406,25 @@ mod test {
         kbs_config.push("test/kbs-config.toml");
         policy.push("test/policy.rego");
 
-        let image = GenericImage::new(
-            "ghcr.io/confidential-containers/staged-images/kbs",
-            "latest",
-        )
-        .with_exposed_port(8085)
-        .with_volume(
-            tmp.path().as_os_str().to_string_lossy(),
-            "/opt/confidential-containers/kbs/repository",
-        )
-        .with_volume(
-            start_kbs_script.into_os_string().to_string_lossy(),
-            "/usr/local/bin/start_kbs.sh",
-        )
-        .with_volume(
-            kbs_config.into_os_string().to_string_lossy(),
-            "/etc/kbs-config.toml",
-        )
-        .with_volume(
-            policy.into_os_string().to_string_lossy(),
-            "/opa/confidential-containers/kbs/policy.rego",
-        )
-        .with_entrypoint("/usr/local/bin/start_kbs.sh");
+        let image = GenericImage::new("xynnn007/kbs", "ec-aead")
+            .with_exposed_port(8085)
+            .with_volume(
+                tmp.path().as_os_str().to_string_lossy(),
+                "/opt/confidential-containers/kbs/repository",
+            )
+            .with_volume(
+                start_kbs_script.into_os_string().to_string_lossy(),
+                "/usr/local/bin/start_kbs.sh",
+            )
+            .with_volume(
+                kbs_config.into_os_string().to_string_lossy(),
+                "/etc/kbs-config.toml",
+            )
+            .with_volume(
+                policy.into_os_string().to_string_lossy(),
+                "/opa/confidential-containers/kbs/policy.rego",
+            )
+            .with_entrypoint("/usr/local/bin/start_kbs.sh");
         let kbs = docker.run(image);
 
         tokio::time::sleep(Duration::from_secs(10)).await;