feat(registry): add a dedicated re-wrap method

A region-key rotation replaces the wrapped CEK and its key version and
nothing else, but the only way to write that was PutEncryptionParams,
which rewrites every column. The ciphertext is unchanged across a
rotation, so a caller that got the nonce, chunk size, AAD or header
length wrong on the re-supplied set would corrupt a decryptable row.

RewrapEncryptionParams takes only the two parameters that change:

- Postgres issues a plain UPDATE of the two columns. Zero rows affected
  means the blob has no row — not encrypted, or already shredded — so it
  returns ErrNotFound instead of reporting success.
- ValidateRewrap rejects an empty CEK or key version, so a rotation
  cannot blank out the material the decrypt path needs.

PutEncryptionParams keeps its upsert semantics for re-encryption, which
does replace the whole set.

Assisted-by: Claude:claude-opus-5
Signed-off-by: Miroslav Bajtoš <oss@bajtos.net>

Author: bajtos

inmem/stores.go

@@ -172,6 +172,23 @@ func (m *MemStore) GetEncryptionParams(_ context.Context, space did.DID, digest
 	return &cp, nil
 }
 
+func (m *MemStore) RewrapEncryptionParams(_ context.Context, space did.DID, digest, wrappedCEK []byte, keyVersion string) error {
+	if err := registry.ValidateRewrap(wrappedCEK, keyVersion); err != nil {
+		return err
+	}
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	key := locKey{space, string(digest)}
+	params, ok := m.encParams[key]
+	if !ok {
+		return registry.ErrNotFound
+	}
+	params.RegionWrappedCEK = cloneBytes(wrappedCEK)
+	params.RegionKeyVersion = keyVersion
+	m.encParams[key] = params
+	return nil
+}
+
 func (m *MemStore) DeleteEncryptionParams(_ context.Context, space did.DID, digest []byte) error {
 	m.mu.Lock()
 	defer m.mu.Unlock()

inmem/stores_test.go

@@ -373,8 +373,8 @@ func TestEncryptionParams_RewrapInPlace(t *testing.T) {
 	want := feeParams(space, digest)
 	want.RegionWrappedCEK = []byte("wrapped-cek-v2")
 	want.RegionKeyVersion = "region-v2"
-	if err := m.PutEncryptionParams(ctx, want); err != nil {
-		t.Fatalf("PutEncryptionParams (re-wrap): %v", err)
+	if err := m.RewrapEncryptionParams(ctx, space, digest, want.RegionWrappedCEK, want.RegionKeyVersion); err != nil {
+		t.Fatalf("RewrapEncryptionParams: %v", err)
 	}
 
 	got, err := m.GetEncryptionParams(ctx, space, digest)
@@ -386,6 +386,78 @@ func TestEncryptionParams_RewrapInPlace(t *testing.T) {
 	}
 }
 
+// Nothing to re-wrap means the blob is not encrypted (or was already shredded),
+// which a rotation must hear about rather than take for success.
+func TestEncryptionParams_RewrapMissingIsNotFound(t *testing.T) {
+	ctx := context.Background()
+	m := NewMemStore()
+
+	err := m.RewrapEncryptionParams(ctx, testutil.RandomDID(t), []byte("absent"), []byte("wrapped-cek-v2"), "region-v2")
+	if !errors.Is(err, registry.ErrNotFound) {
+		t.Fatalf("RewrapEncryptionParams(absent) err = %v, want ErrNotFound", err)
+	}
+}
+
+// A re-wrap may not blank out the key material the decrypt path needs.
+func TestEncryptionParams_RewrapIncompleteRejected(t *testing.T) {
+	space := testutil.RandomDID(t)
+	digest := []byte("enc-digest")
+
+	cases := map[string]struct {
+		wrappedCEK []byte
+		keyVersion string
+	}{
+		"no wrapped CEK":    {nil, "region-v2"},
+		"empty wrapped CEK": {[]byte{}, "region-v2"},
+		"no key version":    {[]byte("wrapped-cek-v2"), ""},
+	}
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			ctx := context.Background()
+			m := NewMemStore()
+			if err := m.PutEncryptionParams(ctx, feeParams(space, digest)); err != nil {
+				t.Fatalf("PutEncryptionParams: %v", err)
+			}
+
+			err := m.RewrapEncryptionParams(ctx, space, digest, tc.wrappedCEK, tc.keyVersion)
+			if !errors.Is(err, registry.ErrInvalidEncryptionParams) {
+				t.Fatalf("RewrapEncryptionParams err = %v, want ErrInvalidEncryptionParams", err)
+			}
+			got, getErr := m.GetEncryptionParams(ctx, space, digest)
+			if getErr != nil {
+				t.Fatalf("GetEncryptionParams: %v", getErr)
+			}
+			if !reflect.DeepEqual(*got, feeParams(space, digest)) {
+				t.Fatalf("rejected re-wrap altered the row: %+v", *got)
+			}
+		})
+	}
+}
+
+// The re-wrap path must not alias the caller's key material either.
+func TestEncryptionParams_RewrapNoSliceAliasing(t *testing.T) {
+	ctx := context.Background()
+	m := NewMemStore()
+	space := testutil.RandomDID(t)
+	digest := []byte("enc-digest")
+	if err := m.PutEncryptionParams(ctx, feeParams(space, digest)); err != nil {
+		t.Fatalf("PutEncryptionParams: %v", err)
+	}
+	wrappedCEK := []byte("wrapped-cek-v2")
+	if err := m.RewrapEncryptionParams(ctx, space, digest, wrappedCEK, "region-v2"); err != nil {
+		t.Fatalf("RewrapEncryptionParams: %v", err)
+	}
+	wrappedCEK[0] = 'X'
+
+	got, err := m.GetEncryptionParams(ctx, space, digest)
+	if err != nil {
+		t.Fatalf("GetEncryptionParams: %v", err)
+	}
+	if !reflect.DeepEqual(got.RegionWrappedCEK, []byte("wrapped-cek-v2")) {
+		t.Fatalf("re-wrapped CEK was aliased: %q", got.RegionWrappedCEK)
+	}
+}
+
 // Every parameter is required: a row missing any one of them could not be
 // decrypted with, so PutEncryptionParams rejects it and stores nothing.
 func TestEncryptionParams_IncompleteRejected(t *testing.T) {

registry/postgres_live_test.go

@@ -196,8 +196,8 @@ func TestPostgresStores_Live(t *testing.T) {
 		want := liveFEEParams(space, encDigest)
 		want.RegionWrappedCEK = []byte{0x11, 0x22, 0x33}
 		want.RegionKeyVersion = "region-v2"
-		if err := r.PutEncryptionParams(ctx, want); err != nil {
-			t.Fatalf("PutEncryptionParams (re-wrap): %v", err)
+		if err := r.RewrapEncryptionParams(ctx, space, encDigest, want.RegionWrappedCEK, want.RegionKeyVersion); err != nil {
+			t.Fatalf("RewrapEncryptionParams: %v", err)
 		}
 		got, err := r.GetEncryptionParams(ctx, space, encDigest)
 		if err != nil {
@@ -208,6 +208,34 @@ func TestPostgresStores_Live(t *testing.T) {
 		}
 	})
 
+	t.Run("re-wrap of an absent row is not found", func(t *testing.T) {
+		// The UPDATE matches nothing, which RowsAffected turns into ErrNotFound.
+		space := testutil.RandomDID(t)
+		err := r.RewrapEncryptionParams(ctx, space, []byte{0x0a, 0x0b}, []byte{0x11}, "region-v2")
+		if !errors.Is(err, registry.ErrNotFound) {
+			t.Fatalf("RewrapEncryptionParams(absent) = %v, want ErrNotFound", err)
+		}
+	})
+
+	t.Run("incomplete re-wrap rejected", func(t *testing.T) {
+		space := testutil.RandomDID(t)
+		encDigest := []byte{0x0c, 0x0d}
+		want := liveFEEParams(space, encDigest)
+		if err := r.PutEncryptionParams(ctx, want); err != nil {
+			t.Fatalf("PutEncryptionParams: %v", err)
+		}
+		if err := r.RewrapEncryptionParams(ctx, space, encDigest, nil, "region-v2"); !errors.Is(err, registry.ErrInvalidEncryptionParams) {
+			t.Fatalf("RewrapEncryptionParams(no CEK) = %v, want ErrInvalidEncryptionParams", err)
+		}
+		got, err := r.GetEncryptionParams(ctx, space, encDigest)
+		if err != nil {
+			t.Fatalf("GetEncryptionParams: %v", err)
+		}
+		if !reflect.DeepEqual(*got, want) {
+			t.Fatalf("rejected re-wrap altered the row: %+v", *got)
+		}
+	})
+
 	t.Run("encryption params delete shreds", func(t *testing.T) {
 		space := testutil.RandomDID(t)
 		encDigest := []byte{0x05, 0x06}

registry/stores.go

@@ -163,6 +163,23 @@ func (p BlobEncryptionParams) Validate() error {
 	return nil
 }
 
+// ValidateRewrap enforces the two parameters a re-wrap replaces, so a rotation
+// cannot blank out the material the decrypt path needs. Every
+// EncryptionParamsStore implementation calls it from RewrapEncryptionParams.
+func ValidateRewrap(wrappedCEK []byte, keyVersion string) error {
+	var missing []string
+	if len(wrappedCEK) == 0 {
+		missing = append(missing, "region_wrapped_cek")
+	}
+	if keyVersion == "" {
+		missing = append(missing, "region_key_version")
+	}
+	if len(missing) > 0 {
+		return fmt.Errorf("%w: missing %s", ErrInvalidEncryptionParams, strings.Join(missing, ", "))
+	}
+	return nil
+}
+
 // BlobInclusion is one row of ingot.shard_inclusions: block Digest lives at
 // the inclusive byte range [RangeStart, RangeEnd] inside the shard CAR whose
 // own location is the (Space, ShardDigest) row of blob_locations. It is the
@@ -272,14 +289,23 @@ type LocationStore interface {
 //
 // It is deliberately separate from LocationStore, with no foreign key between
 // the tables: a location is reconstructible from the indexer or the accept
-// receipt, a wrapped CEK is not. Put is an upsert, so a rotation re-wrap
-// replaces the material in place. Delete is the per-blob crypto-shred and is
-// idempotent — and because nothing cascades, DeleteLocation does NOT shred: a
-// caller removing a blob must call both.
+// receipt, a wrapped CEK is not. Put is an upsert, so re-encrypting a blob
+// replaces its whole parameter set; a region-key rotation instead calls
+// RewrapEncryptionParams, which touches only the key material. Delete is the
+// per-blob crypto-shred and is idempotent — and because nothing cascades,
+// DeleteLocation does NOT shred: a caller removing a blob must call both.
 type EncryptionParamsStore interface {
 	PutEncryptionParams(ctx context.Context, params BlobEncryptionParams) error
 	GetEncryptionParams(ctx context.Context, space did.DID, digest []byte) (*BlobEncryptionParams, error)
 	DeleteEncryptionParams(ctx context.Context, space did.DID, digest []byte) error
+	// RewrapEncryptionParams replaces the wrapped CEK and its key version for an
+	// already-encrypted blob, leaving every other parameter untouched — the write
+	// a region-key rotation performs. The ciphertext is unchanged, so the nonce,
+	// chunk size, AAD and header length must survive the rotation, and a rotation
+	// that rewrote them would corrupt the row. Returns ErrNotFound when the blob
+	// has no row (nothing to re-wrap) and ErrInvalidEncryptionParams when either
+	// argument is empty.
+	RewrapEncryptionParams(ctx context.Context, space did.DID, digest, wrappedCEK []byte, keyVersion string) error
 }
 
 // BlobPark is one row of ingot.blob_parks: the persistable state of a blob

registry/stores_postgres.go

@@ -231,6 +231,26 @@ func (r *Postgres) GetEncryptionParams(ctx context.Context, space did.DID, diges
 	return params, nil
 }
 
+func (r *Postgres) RewrapEncryptionParams(ctx context.Context, space did.DID, digest, wrappedCEK []byte, keyVersion string) error {
+	if err := ValidateRewrap(wrappedCEK, keyVersion); err != nil {
+		return err
+	}
+	tag, err := r.pool.Exec(ctx,
+		`UPDATE ingot.blob_encryption_params
+		    SET region_wrapped_cek = $3, region_key_version = $4
+		  WHERE space = $1 AND digest = $2`,
+		space, digest, wrappedCEK, keyVersion)
+	if err != nil {
+		return fmt.Errorf("registry: rewrap encryption params: %w", err)
+	}
+	// An UPDATE of no rows is a rotation aimed at a blob that is not encrypted (or
+	// was already shredded); surface it rather than reporting success.
+	if tag.RowsAffected() == 0 {
+		return ErrNotFound
+	}
+	return nil
+}
+
 func (r *Postgres) DeleteEncryptionParams(ctx context.Context, space did.DID, digest []byte) error {
 	_, err := r.pool.Exec(ctx,
 		`DELETE FROM ingot.blob_encryption_params WHERE space = $1 AND digest = $2`, space, digest)