refactor: upgrade aes-gcm to 0.11.0

Updates aes-gcm code to move from crate version 0.10.3 to 0.11.0.

Author: metalurgical

Cargo.lock

@@ -79,7 +79,7 @@ test-port-allocator = { path = "crates/test-port-allocator" }
 test-utils = { path = "crates/test-utils" }
 threshold-signatures = { path = "crates/threshold-signatures" }
 
-aes-gcm = "0.10.3"
+aes-gcm = "0.11.0"
 anyhow = "1.0.102"
 assert_matches = "1.5.0"
 async-trait = "0.1.89"

Cargo.toml

@@ -1,5 +1,5 @@
-use aes_gcm::aead::Aead;
-use aes_gcm::{AeadCore, Aes128Gcm, AesGcm, KeyInit};
+use aes_gcm::aead::{Aead, Generate, Nonce};
+use aes_gcm::{Aes128Gcm, AesGcm, KeyInit};
 use rocksdb::IteratorMode;
 use std::collections::BTreeSet;
 use std::fmt::Display;
@@ -67,7 +67,7 @@ impl Display for DBCol {
 
 /// Encrypts a single value with AES-GCM. This encryption is randomized.
 pub fn encrypt(cipher: &Aes128Gcm, plaintext: &[u8]) -> Vec<u8> {
-    let nonce = aes_gcm::Aes128Gcm::generate_nonce(&mut rand::thread_rng());
+    let nonce = Nonce::<Aes128Gcm>::generate();
     let ciphertext = cipher.encrypt(&nonce, plaintext).unwrap();
     [nonce.as_ref(), ciphertext.as_slice()].concat()
 }
@@ -78,10 +78,11 @@ pub fn decrypt(cipher: &Aes128Gcm, ciphertext: &[u8]) -> anyhow::Result<Vec<u8>>
     if ciphertext.len() < NONCE_LEN {
         return Err(anyhow::anyhow!("ciphertext is too short"));
     }
-    let nonce = &ciphertext[..NONCE_LEN];
+    let nonce = Nonce::<Aes128Gcm>::try_from(&ciphertext[..NONCE_LEN])
+        .map_err(|_| anyhow::anyhow!("invalid nonce length"))?;
     let ciphertext = &ciphertext[NONCE_LEN..];
     let data = cipher
-        .decrypt(nonce.into(), ciphertext)
+        .decrypt(&nonce, ciphertext)
         .map_err(|_| anyhow::anyhow!("decryption failed"))?;
     Ok(data)
 }

crates/node/src/db.rs

@@ -1,15 +1,14 @@
+use crate::config::AesKey256;
 use aes_gcm::{
-    AeadCore, Aes256Gcm, KeyInit,
-    aead::{Aead, OsRng},
+    Aes256Gcm, KeyInit,
+    aead::{Aead, Generate, Nonce},
 };
 
-use crate::config::AesKey256;
-
 const NONCE_LEN: usize = 12;
 
 pub(crate) fn encrypt_bytes(key: &AesKey256, plaintext: &[u8]) -> anyhow::Result<Vec<u8>> {
     let cipher = Aes256Gcm::new(key.into());
-    let nonce = Aes256Gcm::generate_nonce(&mut OsRng);
+    let nonce = Nonce::<Aes256Gcm>::generate();
     let ciphertext = cipher
         .encrypt(&nonce, plaintext)
         .map_err(|err| anyhow::anyhow!("encryption failed: {err}"))?;
@@ -25,10 +24,11 @@ pub(crate) fn decrypt_bytes(key: &AesKey256, nonce_and_cipher: &[u8]) -> anyhow:
     }
 
     let (nonce_bytes, ciphertext) = nonce_and_cipher.split_at(NONCE_LEN);
-
+    let nonce = Nonce::<Aes256Gcm>::try_from(nonce_bytes)
+        .map_err(|_| anyhow::anyhow!("invalid nonce length"))?;
     let cipher = Aes256Gcm::new(key.into());
     let plaintext_bytes = cipher
-        .decrypt(nonce_bytes.into(), ciphertext)
+        .decrypt(&nonce, ciphertext)
         .map_err(|err| anyhow::anyhow!("encryption failed: {err}"))?;
     Ok(plaintext_bytes)
 }

crates/node/src/migration_service/web/encryption.rs

@@ -3,7 +3,8 @@ use std::{
     sync::Arc,
 };
 
-use aes_gcm::{Aes256Gcm, KeyInit};
+use aes_gcm::aead::Generate;
+use aes_gcm::{Aes256Gcm, Key};
 use ed25519_dalek::SigningKey;
 use near_mpc_contract_interface::types::BackupServiceInfo;
 use rand::rngs::OsRng;
@@ -32,7 +33,7 @@ pub struct TestSetup {
 }
 
 pub async fn setup(port_seed: PortSeed) -> TestSetup {
-    let backup_encryption_key = Aes256Gcm::generate_key(OsRng);
+    let backup_encryption_key = Key::<Aes256Gcm>::generate();
     let client_key = SigningKey::generate(&mut OsRng);
     let server_key = SigningKey::generate(&mut OsRng);
 

crates/node/src/migration_service/web/test_utils.rs

@@ -1,4 +1,4 @@
-use aes_gcm::{Aes256Gcm, KeyInit};
+use aes_gcm::{Aes256Gcm, Key, KeyInit};
 use blstrs::{G1Projective, G2Projective, Scalar};
 use elliptic_curve::{Field as _, Group as _};
 use near_mpc_contract_interface::types::ProtocolContractState;
@@ -35,6 +35,7 @@ use crate::tests::common::MockTransactionSender;
 use crate::tracking::{self, AutoAbortTask, start_root_task};
 use crate::web::recent_transactions::SharedRecentTransactions;
 use crate::web::{start_web_server, static_web_data};
+use aes_gcm::aead::Generate;
 use assert_matches::assert_matches;
 use mpc_primitives::domain::{Curve, Protocol};
 use near_account_id::AccountId;
@@ -250,7 +251,7 @@ impl IntegrationTestSetup {
                     near_responder_keys: vec![ed25519_dalek::SigningKey::generate(&mut OsRng)],
                 },
                 local_storage_aes_key: rand::random(),
-                backup_encryption_key: Aes256Gcm::generate_key(OsRng).into(),
+                backup_encryption_key: Key::<Aes256Gcm>::generate().into(),
             };
             let (indexer_api, task, currently_running_job_name) = indexer_manager.add_indexer_node(
                 i.into(),