Deleted KeyMaterial::concatenate

Author: ounsworth

crypto/core/src/key_material.rs

@@ -202,18 +202,6 @@ pub trait KeyMaterialTrait: KeyMaterialInternalTrait {
     /// hold a different key, potentially of a different length.
     fn zeroize(&mut self);
 
-    /// Adds the other KeyMaterial into this one, assuming there is space.
-    ///
-    /// Throws [KeyMaterialError::InvalidLength] if this object does not have enough space to add the other one.
-    ///
-    /// The resulting [KeyType] and security strength will be the lesser of the two keys.
-    /// In other words, concatenating two 128-bit full entropy keys generated at a 128-bit DRBG security level
-    /// will result in a 256-bit full entropy key still at the 128-bit DRBG security level.
-    /// Concatenating a full entropy key with a low entropy key will result in a low entropy key.
-    ///
-    /// Returns the new key_len.
-    fn concatenate(&mut self, other: &dyn KeyMaterialTrait) -> Result<usize, KeyMaterialError>;
-
     /// Perform a constant-time comparison between the two key material buffers,
     /// ignoring differences in capacity, [KeyType], [SecurityStrength], etc.
     fn equals(&self, other: &dyn KeyMaterialTrait) -> bool;
@@ -546,18 +534,6 @@ impl<const KEY_LEN: usize> KeyMaterialTrait for KeyMaterial<KEY_LEN> {
         self.key_type = KeyType::Zeroized;
     }
 
-    fn concatenate(&mut self, other: &dyn KeyMaterialTrait) -> Result<usize, KeyMaterialError> {
-        let new_key_len = self.key_len() + other.key_len();
-        if self.key_len() + other.key_len() > KEY_LEN {
-            return Err(KeyMaterialError::InputDataLongerThanKeyCapacity);
-        }
-        self.buf[self.key_len..new_key_len].copy_from_slice(other.ref_to_bytes());
-        self.key_len += other.key_len();
-        self.key_type = min(&self.key_type, &other.key_type()).clone();
-        self.security_strength = min(&self.security_strength, &other.security_strength()).clone();
-        Ok(self.key_len())
-    }
-
     fn equals(&self, other: &dyn KeyMaterialTrait) -> bool {
         if self.key_len() != other.key_len() {
             return false;

crypto/core/tests/key_material_tests.rs

@@ -655,86 +655,6 @@ mod test_key_material {
         .unwrap();
     }
 
-    #[test]
-    fn test_concatenate() {
-        // intentionally half-full
-        let mut key1 = KeyMaterial256::from_bytes(&[1u8; 16]).unwrap();
-        let key2 = KeyMaterial256::from_bytes(&[2u8; 16]).unwrap();
-        assert_eq!(key1.key_len(), 16);
-        assert_eq!(key2.key_len(), 16);
-
-        key1.concatenate(&key2).unwrap();
-        assert_eq!(key1.key_len(), 32);
-        assert_eq!(key1.ref_to_bytes()[..16], [1u8; 16]);
-        assert_eq!(key1.ref_to_bytes()[16..], [2u8; 16]);
-
-        let mut zeroized_key = KeyMaterial256::default();
-        do_hazardous_operations(&mut zeroized_key, |zeroized_key| {
-            zeroized_key.set_key_len(8).unwrap();
-            Ok(())
-        })
-        .unwrap();
-        assert_eq!(zeroized_key.key_type(), KeyType::Zeroized);
-        assert_eq!(zeroized_key.key_len(), 8);
-        zeroized_key.concatenate(&key2).unwrap();
-        assert_eq!(zeroized_key.key_len(), 24);
-        // The result takes the lesser (min) of the two key types: min(Zeroized, BytesLowEntropy).
-        // Folding in zeroized (uninitialized) bytes taints the whole buffer as Zeroized.
-        assert_eq!(zeroized_key.key_type(), KeyType::Zeroized);
-        assert_eq!(zeroized_key.security_strength(), SecurityStrength::None);
-
-        // This should be symmetric, so test it in the other direction too.
-        let mut zeroized_key = KeyMaterial256::default();
-        do_hazardous_operations(&mut zeroized_key, |zeroized_key| {
-            zeroized_key.set_key_len(8).unwrap();
-            Ok(())
-        })
-        .unwrap();
-        assert_eq!(zeroized_key.key_type(), KeyType::Zeroized);
-        assert_eq!(zeroized_key.key_len(), 8);
-        let mut key2 = KeyMaterial256::from_bytes(&[1u8; 16]).unwrap();
-        key2.concatenate(&zeroized_key).unwrap();
-        assert_eq!(key2.key_len(), 24);
-        // The result takes the lesser (min) of the two key types: min(BytesLowEntropy, Zeroized).
-        assert_eq!(key2.key_type(), KeyType::Zeroized);
-        assert_eq!(key2.security_strength(), SecurityStrength::None);
-
-        // now try it with keys of different key types
-        let mut low_entropy_key =
-            KeyMaterial256::from_bytes_as_type(&[1u8; 16], KeyType::Unknown).unwrap();
-        let full_entropy_key =
-            KeyMaterial256::from_bytes_as_type(&[2u8; 16], KeyType::CryptographicRandom).unwrap();
-        low_entropy_key.concatenate(&full_entropy_key).unwrap();
-        // Conservative model: concatenating a full-entropy key with a low-entropy key yields a
-        // low-entropy key. min(BytesLowEntropy, BytesFullEntropy) == BytesLowEntropy.
-        assert_eq!(low_entropy_key.key_type(), KeyType::Unknown);
-        // min(None, _128bit) == None (and BytesLowEntropy keys must have strength None anyway).
-        assert_eq!(low_entropy_key.security_strength(), SecurityStrength::None);
-
-        // and in the other direction too
-        let low_entropy_key =
-            KeyMaterial256::from_bytes_as_type(&[1u8; 16], KeyType::Unknown).unwrap();
-        let mut full_entropy_key =
-            KeyMaterial256::from_bytes_as_type(&[2u8; 16], KeyType::CryptographicRandom).unwrap();
-        full_entropy_key.concatenate(&low_entropy_key).unwrap();
-        // min(BytesFullEntropy, BytesLowEntropy) == BytesLowEntropy.
-        assert_eq!(full_entropy_key.key_type(), KeyType::Unknown);
-        // min(_128bit, None) == None.
-        assert_eq!(full_entropy_key.security_strength(), SecurityStrength::None);
-
-        // now with full entropy keys at different security levels
-        let mut full_entropy_key_112 =
-            KeyMaterial512::from_bytes_as_type(&[1u8; 16], KeyType::CryptographicRandom).unwrap();
-        // Now we're gonna explictly tag it at the 112bit security level -- does not require allow_hazardous_operations().
-        full_entropy_key_112.set_security_strength(SecurityStrength::_112bit).unwrap();
-        let full_entropy_key =
-            KeyMaterial256::from_bytes_as_type(&[2u8; 32], KeyType::CryptographicRandom).unwrap();
-        full_entropy_key_112.concatenate(&full_entropy_key).unwrap();
-        assert_eq!(full_entropy_key_112.key_type(), KeyType::CryptographicRandom);
-        // The combined key keeps the lower of the two security strengths: min(_112bit, _256bit).
-        assert_eq!(full_entropy_key_112.security_strength(), SecurityStrength::_112bit);
-    }
-
     #[test]
     fn eq() {
         // For context: