Use the vendored version of ring

Requires updating our code to accomodate API changes since the vendored version is newer

Author: Juliette Pretot

Cargo.lock

@@ -14,7 +14,7 @@ anyhow = { version = "*", default-features = false }
 bytes = { version = "*", default-features = false }
 log = "*"
 prost = { version = "*", default-features = false, features = ["prost-derive"] }
-ring = "*"
+ring = { path = "../../third_party/ring" }
 
 [build-dependencies]
 prost-build = "*"

oak_functions/loader/fuzz/Cargo.lock

@@ -86,13 +86,15 @@ impl aead::NonceSequence for OneNonceSequence {
     }
 }
 
+type Key = [u8; KEY_AGREEMENT_ALGORITHM_KEY_LENGTH];
+
 /// Convenience struct for passing an encryption key as an argument.
 #[derive(PartialEq)]
-pub(crate) struct EncryptionKey(pub(crate) [u8; KEY_AGREEMENT_ALGORITHM_KEY_LENGTH]);
+pub(crate) struct EncryptionKey(pub(crate) Key);
 
 /// Convenience struct for passing a decryption key as an argument.
 #[derive(PartialEq)]
-pub(crate) struct DecryptionKey(pub(crate) [u8; KEY_AGREEMENT_ALGORITHM_KEY_LENGTH]);
+pub(crate) struct DecryptionKey(pub(crate) Key);
 
 /// Implementation of Authenticated Encryption with Associated Data (AEAD).
 ///
@@ -234,57 +236,62 @@ impl KeyNegotiator {
     ) -> anyhow::Result<(EncryptionKey, DecryptionKey)> {
         let type_ = self.type_.clone();
         let self_public_key = self.public_key().context("Couldn't get self public key")?;
-        let (encryption_key, decryption_key) = agreement::agree_ephemeral(
-            self.private_key,
-            &agreement::UnparsedPublicKey::new(KEY_AGREEMENT_ALGORITHM, peer_public_key),
-            anyhow!("Couldn't derive session keys"),
-            |key_material| {
-                let key_material = key_material
-                    .try_into()
-                    .map_err(anyhow::Error::msg)
-                    .context(format!(
-                        "Incorrect key material length, expected {}, found {}",
-                        KEY_AGREEMENT_ALGORITHM_KEY_LENGTH,
-                        key_material.len()
-                    ))?;
-                let peer_public_key = *peer_public_key;
-                match type_ {
-                    // On the server side `self_public_key` is the server key.
-                    KeyNegotiatorType::Server => {
-                        let encryption_key = Self::key_derivation_function(
-                            key_material,
-                            SERVER_KEY_PURPOSE,
-                            &self_public_key,
-                            &peer_public_key,
-                        );
-                        let decryption_key = Self::key_derivation_function(
-                            key_material,
-                            CLIENT_KEY_PURPOSE,
-                            &self_public_key,
-                            &peer_public_key,
-                        );
-                        Ok((encryption_key, decryption_key))
-                    }
-                    // On the client side `peer_public_key` is the server key.
-                    KeyNegotiatorType::Client => {
-                        let encryption_key = Self::key_derivation_function(
-                            key_material,
-                            CLIENT_KEY_PURPOSE,
-                            &peer_public_key,
-                            &self_public_key,
-                        );
-                        let decryption_key = Self::key_derivation_function(
-                            key_material,
-                            SERVER_KEY_PURPOSE,
-                            &peer_public_key,
-                            &self_public_key,
-                        );
-                        Ok((encryption_key, decryption_key))
+        let (encryption_key, decryption_key) =
+            agreement::agree_ephemeral(
+                self.private_key,
+                &agreement::UnparsedPublicKey::new(KEY_AGREEMENT_ALGORITHM, peer_public_key),
+                |key_material| -> Result<
+                    (Result<Key, anyhow::Error>, Result<Key, anyhow::Error>),
+                    anyhow::Error,
+                > {
+                    let key_material = key_material
+                        .try_into()
+                        .map_err(anyhow::Error::msg)
+                        .context(format!(
+                            "Incorrect key material length, expected {}, found {}",
+                            KEY_AGREEMENT_ALGORITHM_KEY_LENGTH,
+                            key_material.len()
+                        ))?;
+                    let peer_public_key = *peer_public_key;
+                    match type_ {
+                        // On the server side `self_public_key` is the server key.
+                        KeyNegotiatorType::Server => {
+                            let encryption_key = Self::key_derivation_function(
+                                key_material,
+                                SERVER_KEY_PURPOSE,
+                                &self_public_key,
+                                &peer_public_key,
+                            );
+                            let decryption_key = Self::key_derivation_function(
+                                key_material,
+                                CLIENT_KEY_PURPOSE,
+                                &self_public_key,
+                                &peer_public_key,
+                            );
+                            Ok((encryption_key, decryption_key))
+                        }
+                        // On the client side `peer_public_key` is the server key.
+                        KeyNegotiatorType::Client => {
+                            let encryption_key = Self::key_derivation_function(
+                                key_material,
+                                CLIENT_KEY_PURPOSE,
+                                &peer_public_key,
+                                &self_public_key,
+                            );
+                            let decryption_key = Self::key_derivation_function(
+                                key_material,
+                                SERVER_KEY_PURPOSE,
+                                &peer_public_key,
+                                &self_public_key,
+                            );
+                            Ok((encryption_key, decryption_key))
+                        }
                     }
-                }
-            },
-        )
-        .context("Couldn't agree on session keys")?;
+                },
+            )
+            .map_err(anyhow::Error::msg)
+            .context("Couldn't derive session keys")?
+            .context("Couldn't agree on session keys")?;
         Ok((
             EncryptionKey(encryption_key.context("Couldn't derive encryption key")?),
             DecryptionKey(decryption_key.context("Couldn't derive decryption key")?),
@@ -351,8 +358,9 @@ impl Signer {
         let rng = ring::rand::SystemRandom::new();
         let key_pair_pkcs8 = EcdsaKeyPair::generate_pkcs8(SIGNING_ALGORITHM, &rng)
             .map_err(|error| anyhow!("Couldn't generate PKCS#8 key pair: {:?}", error))?;
-        let key_pair = EcdsaKeyPair::from_pkcs8(SIGNING_ALGORITHM, key_pair_pkcs8.as_ref())
-            .map_err(|error| anyhow!("Couldn't parse generated key pair: {:?}", error))?;
+        let key_pair =
+            EcdsaKeyPair::from_pkcs8(SIGNING_ALGORITHM, key_pair_pkcs8.as_ref(), &rng)
+                .map_err(|error| anyhow!("Couldn't parse generated key pair: {:?}", error))?;
 
         Ok(Self { key_pair })
     }