stop storing RegionWrappedCEK and RegionKeyVersion in DB

We will store keys in OpenBao.

Signed-off-by: Miroslav Bajtoš <oss@bajtos.net>

Author: bajtos

inmem/stores.go

@@ -172,23 +172,6 @@ func (m *MemStore) GetEncryptionParams(_ context.Context, space did.DID, digest
 	return &cp, nil
 }
 
-func (m *MemStore) RewrapEncryptionParams(_ context.Context, space did.DID, digest, wrappedCEK []byte, keyVersion string) error {
-	if err := registry.ValidateRewrap(wrappedCEK, keyVersion); err != nil {
-		return err
-	}
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	key := locKey{space, string(digest)}
-	params, ok := m.encParams[key]
-	if !ok {
-		return registry.ErrNotFound
-	}
-	params.RegionWrappedCEK = cloneBytes(wrappedCEK)
-	params.RegionKeyVersion = keyVersion
-	m.encParams[key] = params
-	return nil
-}
-
 func (m *MemStore) DeleteEncryptionParams(_ context.Context, space did.DID, digest []byte) error {
 	m.mu.Lock()
 	defer m.mu.Unlock()
@@ -439,12 +422,10 @@ func cloneLocation(loc registry.BlobLocation) registry.BlobLocation {
 	return loc
 }
 
-// cloneEncryptionParams deep-copies a BlobEncryptionParams' byte-slice fields —
-// the digest and the key material — so the stored copy and any returned copy
-// never alias the caller's slices.
+// cloneEncryptionParams deep-copies a BlobEncryptionParams' byte-slice fields
+// so the stored copy and any returned copy never alias the caller's slices.
 func cloneEncryptionParams(p registry.BlobEncryptionParams) registry.BlobEncryptionParams {
 	p.Digest = cloneBytes(p.Digest)
-	p.RegionWrappedCEK = cloneBytes(p.RegionWrappedCEK)
 	p.BaseNonce = cloneBytes(p.BaseNonce)
 	p.AAD = cloneBytes(p.AAD)
 	return p

inmem/stores_test.go

@@ -261,8 +261,6 @@ func feeParams(space did.DID, digest []byte) registry.BlobEncryptionParams {
 	return registry.BlobEncryptionParams{
 		Space:              space,
 		Digest:             digest,
-		RegionWrappedCEK:   []byte("wrapped-cek"),
-		RegionKeyVersion:   "region-v1",
 		TenantRecipientKID: "did:key:tenant#wrap",
 		HeaderLen:          212,
 		BaseNonce:          []byte("nonce07"),
@@ -302,7 +300,7 @@ func TestEncryptionParams_MissingIsNotFound(t *testing.T) {
 	}
 }
 
-func TestEncryptionParams_DeleteShreds(t *testing.T) {
+func TestEncryptionParams_DeleteRemovesRow(t *testing.T) {
 	ctx := context.Background()
 	m := NewMemStore()
 	space := testutil.RandomDID(t)
@@ -328,7 +326,7 @@ func TestEncryptionParams_DeleteIsIdempotent(t *testing.T) {
 	}
 }
 
-// The store must not alias the caller's key material, nor let a caller reach
+// The store must not alias the caller's byte slices, nor let a caller reach
 // back into it through a returned copy.
 func TestEncryptionParams_NoSliceAliasing(t *testing.T) {
 	ctx := context.Background()
@@ -340,15 +338,14 @@ func TestEncryptionParams_NoSliceAliasing(t *testing.T) {
 	if err := m.PutEncryptionParams(ctx, params); err != nil {
 		t.Fatalf("PutEncryptionParams: %v", err)
 	}
-	params.RegionWrappedCEK[0] = 'X'
 	params.BaseNonce[0] = 'X'
 	params.AAD[0] = 'X'
 
 	got, err := m.GetEncryptionParams(ctx, space, digest)
 	if err != nil {
 		t.Fatalf("GetEncryptionParams: %v", err)
 	}
-	got.RegionWrappedCEK[0] = 'Y'
+	got.BaseNonce[0] = 'Y'
 
 	again, err := m.GetEncryptionParams(ctx, space, digest)
 	if err != nil {
@@ -359,105 +356,6 @@ func TestEncryptionParams_NoSliceAliasing(t *testing.T) {
 	}
 }
 
-// A region-key rotation re-wraps in place: same blob, new CEK + key version,
-// every other parameter untouched.
-func TestEncryptionParams_RewrapInPlace(t *testing.T) {
-	ctx := context.Background()
-	m := NewMemStore()
-	space := testutil.RandomDID(t)
-	digest := []byte("enc-digest")
-	if err := m.PutEncryptionParams(ctx, feeParams(space, digest)); err != nil {
-		t.Fatalf("PutEncryptionParams: %v", err)
-	}
-
-	want := feeParams(space, digest)
-	want.RegionWrappedCEK = []byte("wrapped-cek-v2")
-	want.RegionKeyVersion = "region-v2"
-	if err := m.RewrapEncryptionParams(ctx, space, digest, want.RegionWrappedCEK, want.RegionKeyVersion); err != nil {
-		t.Fatalf("RewrapEncryptionParams: %v", err)
-	}
-
-	got, err := m.GetEncryptionParams(ctx, space, digest)
-	if err != nil {
-		t.Fatalf("GetEncryptionParams: %v", err)
-	}
-	if !reflect.DeepEqual(*got, want) {
-		t.Fatalf("after re-wrap = %+v, want %+v", *got, want)
-	}
-}
-
-// Nothing to re-wrap means the blob is not encrypted (or was already shredded),
-// which a rotation must hear about rather than take for success.
-func TestEncryptionParams_RewrapMissingIsNotFound(t *testing.T) {
-	ctx := context.Background()
-	m := NewMemStore()
-
-	err := m.RewrapEncryptionParams(ctx, testutil.RandomDID(t), []byte("absent"), []byte("wrapped-cek-v2"), "region-v2")
-	if !errors.Is(err, registry.ErrNotFound) {
-		t.Fatalf("RewrapEncryptionParams(absent) err = %v, want ErrNotFound", err)
-	}
-}
-
-// A re-wrap may not blank out the key material the decrypt path needs.
-func TestEncryptionParams_RewrapIncompleteRejected(t *testing.T) {
-	space := testutil.RandomDID(t)
-	digest := []byte("enc-digest")
-
-	cases := map[string]struct {
-		wrappedCEK []byte
-		keyVersion string
-	}{
-		"no wrapped CEK":    {nil, "region-v2"},
-		"empty wrapped CEK": {[]byte{}, "region-v2"},
-		"no key version":    {[]byte("wrapped-cek-v2"), ""},
-	}
-	for name, tc := range cases {
-		t.Run(name, func(t *testing.T) {
-			ctx := context.Background()
-			m := NewMemStore()
-			if err := m.PutEncryptionParams(ctx, feeParams(space, digest)); err != nil {
-				t.Fatalf("PutEncryptionParams: %v", err)
-			}
-
-			err := m.RewrapEncryptionParams(ctx, space, digest, tc.wrappedCEK, tc.keyVersion)
-			if !errors.Is(err, registry.ErrInvalidEncryptionParams) {
-				t.Fatalf("RewrapEncryptionParams err = %v, want ErrInvalidEncryptionParams", err)
-			}
-			got, getErr := m.GetEncryptionParams(ctx, space, digest)
-			if getErr != nil {
-				t.Fatalf("GetEncryptionParams: %v", getErr)
-			}
-			if !reflect.DeepEqual(*got, feeParams(space, digest)) {
-				t.Fatalf("rejected re-wrap altered the row: %+v", *got)
-			}
-		})
-	}
-}
-
-// The re-wrap path must not alias the caller's key material either.
-func TestEncryptionParams_RewrapNoSliceAliasing(t *testing.T) {
-	ctx := context.Background()
-	m := NewMemStore()
-	space := testutil.RandomDID(t)
-	digest := []byte("enc-digest")
-	if err := m.PutEncryptionParams(ctx, feeParams(space, digest)); err != nil {
-		t.Fatalf("PutEncryptionParams: %v", err)
-	}
-	wrappedCEK := []byte("wrapped-cek-v2")
-	if err := m.RewrapEncryptionParams(ctx, space, digest, wrappedCEK, "region-v2"); err != nil {
-		t.Fatalf("RewrapEncryptionParams: %v", err)
-	}
-	wrappedCEK[0] = 'X'
-
-	got, err := m.GetEncryptionParams(ctx, space, digest)
-	if err != nil {
-		t.Fatalf("GetEncryptionParams: %v", err)
-	}
-	if !reflect.DeepEqual(got.RegionWrappedCEK, []byte("wrapped-cek-v2")) {
-		t.Fatalf("re-wrapped CEK was aliased: %q", got.RegionWrappedCEK)
-	}
-}
-
 // Every parameter is required: a row missing any one of them could not be
 // decrypted with, so PutEncryptionParams rejects it and stores nothing.
 func TestEncryptionParams_IncompleteRejected(t *testing.T) {
@@ -470,9 +368,6 @@ func TestEncryptionParams_IncompleteRejected(t *testing.T) {
 	}{
 		{"no space", func(p *registry.BlobEncryptionParams) { p.Space = did.Undef }},
 		{"no digest", func(p *registry.BlobEncryptionParams) { p.Digest = nil }},
-		{"no wrapped CEK", func(p *registry.BlobEncryptionParams) { p.RegionWrappedCEK = nil }},
-		{"empty wrapped CEK", func(p *registry.BlobEncryptionParams) { p.RegionWrappedCEK = []byte{} }},
-		{"no key version", func(p *registry.BlobEncryptionParams) { p.RegionKeyVersion = "" }},
 		{"no recipient kid", func(p *registry.BlobEncryptionParams) { p.TenantRecipientKID = "" }},
 		{"no header length", func(p *registry.BlobEncryptionParams) { p.HeaderLen = 0 }},
 		{"no base nonce", func(p *registry.BlobEncryptionParams) { p.BaseNonce = nil }},

migrations/sql/00013_blob_encryption.sql

@@ -4,8 +4,8 @@
 -- COSE/STREAM ciphertext envelope; a range GET must be able to decrypt any byte
 -- span of that envelope WITHOUT first fetching and parsing its header. A row
 -- here caches exactly the inputs the read path's decryptor needs, so a read
--- unwraps the CEK (under the region KEK) and goes straight to a body-range
--- fetch — no envelope-header round-trip.
+-- unwraps the CEK (held in OpenBao, under the region KEK) and goes straight to
+-- a body-range fetch — no envelope-header round-trip.
 --
 -- The existence of a row is what marks a blob as encrypted, so every column is
 -- NOT NULL: there is no such thing as a half-populated parameter set the
@@ -15,29 +15,22 @@
 -- WITHOUT a foreign key to it. blob_locations is a reconstructible cache of the
 -- indexing-service contract — every row can be re-derived from the indexer or
 -- the accept receipt, and the table goes away when the topology moves to a real
--- indexer. A wrapped CEK is not reconstructible: lose the row and the
--- ciphertext is permanently unreadable. The two therefore have independent
--- lifecycles, and an FK would additionally force location-before-parameters
--- write ordering.
+-- indexer. A row here is instead the marker that a blob is encrypted, so the
+-- two have independent lifecycles, and an FK would additionally force
+-- location-before-parameters write ordering.
 --
 -- aad holds the whole COSE Enc_structure rather than just the protected header,
 -- because the structure's context string differs between a COSE_Encrypt and a
 -- COSE_Encrypt0 and a bare row cannot record which form was used. The protected
 -- header stays recoverable from it as element 1.
 --
--- Raw CEK bytes are never stored — only the CEK wrapped under the region KEK
--- (region_wrapped_cek) plus the opaque key-version / recipient identifiers
--- needed to unwrap it. Per-blob crypto-shred is deleting the row; because there
--- is no cascade, a caller removing a blob must delete here as well as from
--- blob_locations. Re-wrap under a rotated region key is an upsert that replaces
--- region_wrapped_cek and region_key_version in place.
+-- No key material is stored here: the region-KEK-wrapped CEK and its key
+-- version live in OpenBao. Per-blob crypto-shred is deleting the key there;
+-- deleting this row only drops the cached decrypt parameters. Because there is no cascade, a caller removing a
+-- blob must delete here as well as from blob_locations.
 CREATE TABLE ingot.blob_encryption_params (
     space                text   NOT NULL,
     digest               bytea  NOT NULL,                 -- ciphertext blob multihash, as in blob_locations
-    region_wrapped_cek   bytea  NOT NULL                  -- CEK wrapped under the region KEK (A256KW)
-                             CHECK (octet_length(region_wrapped_cek) > 0),
-    region_key_version   text   NOT NULL                  -- opaque id of the region KEK version used (rotation re-wrap)
-                             CHECK (region_key_version <> ''),
     tenant_recipient_kid text   NOT NULL                  -- opaque id of the Hilt wrap key (insurance-recovery unwrap)
                              CHECK (tenant_recipient_kid <> ''),
     header_len           bigint NOT NULL                  -- encoded envelope length; the ciphertext starts at this offset

migrations/up_live_test.go

@@ -76,9 +76,8 @@ func TestUp_Live(t *testing.T) {
 	// presence of a row is what marks a blob as encrypted, so there is no such
 	// thing as a half-populated parameter set.
 	for _, col := range []string{
-		"space", "digest", "region_wrapped_cek", "region_key_version",
-		"tenant_recipient_kid", "header_len", "base_nonce", "chunk_size", "aad",
-		"created_at",
+		"space", "digest", "tenant_recipient_kid", "header_len", "base_nonce",
+		"chunk_size", "aad", "created_at",
 	} {
 		var nullable string
 		err := pool.QueryRow(ctx,

registry/postgres_live_test.go

@@ -164,8 +164,6 @@ func TestPostgresStores_Live(t *testing.T) {
 		return registry.BlobEncryptionParams{
 			Space:              space,
 			Digest:             d,
-			RegionWrappedCEK:   []byte{0x00, 0xde, 0xad, 0xbe, 0xef},
-			RegionKeyVersion:   "region-v1",
 			TenantRecipientKID: "did:key:tenant#wrap",
 			HeaderLen:          212,
 			BaseNonce:          []byte{0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07},
@@ -190,56 +188,7 @@ func TestPostgresStores_Live(t *testing.T) {
 		}
 	})
 
-	t.Run("encryption params re-wrap in place", func(t *testing.T) {
-		space := testutil.RandomDID(t)
-		encDigest := []byte{0x03, 0x04}
-		if err := r.PutEncryptionParams(ctx, liveFEEParams(space, encDigest)); err != nil {
-			t.Fatalf("PutEncryptionParams: %v", err)
-		}
-		want := liveFEEParams(space, encDigest)
-		want.RegionWrappedCEK = []byte{0x11, 0x22, 0x33}
-		want.RegionKeyVersion = "region-v2"
-		if err := r.RewrapEncryptionParams(ctx, space, encDigest, want.RegionWrappedCEK, want.RegionKeyVersion); err != nil {
-			t.Fatalf("RewrapEncryptionParams: %v", err)
-		}
-		got, err := r.GetEncryptionParams(ctx, space, encDigest)
-		if err != nil {
-			t.Fatalf("GetEncryptionParams: %v", err)
-		}
-		if !reflect.DeepEqual(*got, want) {
-			t.Fatalf("after re-wrap = %+v, want %+v", *got, want)
-		}
-	})
-
-	t.Run("re-wrap of an absent row is not found", func(t *testing.T) {
-		// The UPDATE matches nothing, which RowsAffected turns into ErrNotFound.
-		space := testutil.RandomDID(t)
-		err := r.RewrapEncryptionParams(ctx, space, []byte{0x0a, 0x0b}, []byte{0x11}, "region-v2")
-		if !errors.Is(err, registry.ErrNotFound) {
-			t.Fatalf("RewrapEncryptionParams(absent) = %v, want ErrNotFound", err)
-		}
-	})
-
-	t.Run("incomplete re-wrap rejected", func(t *testing.T) {
-		space := testutil.RandomDID(t)
-		encDigest := []byte{0x0c, 0x0d}
-		want := liveFEEParams(space, encDigest)
-		if err := r.PutEncryptionParams(ctx, want); err != nil {
-			t.Fatalf("PutEncryptionParams: %v", err)
-		}
-		if err := r.RewrapEncryptionParams(ctx, space, encDigest, nil, "region-v2"); !errors.Is(err, registry.ErrInvalidEncryptionParams) {
-			t.Fatalf("RewrapEncryptionParams(no CEK) = %v, want ErrInvalidEncryptionParams", err)
-		}
-		got, err := r.GetEncryptionParams(ctx, space, encDigest)
-		if err != nil {
-			t.Fatalf("GetEncryptionParams: %v", err)
-		}
-		if !reflect.DeepEqual(*got, want) {
-			t.Fatalf("rejected re-wrap altered the row: %+v", *got)
-		}
-	})
-
-	t.Run("encryption params delete shreds", func(t *testing.T) {
+	t.Run("encryption params delete removes the row", func(t *testing.T) {
 		space := testutil.RandomDID(t)
 		encDigest := []byte{0x05, 0x06}
 		if err := r.PutEncryptionParams(ctx, liveFEEParams(space, encDigest)); err != nil {