fix: re-enable aes_gcm_192 (#1143)

Author: ajewellamz

AwsCryptographicMaterialProviders/runtimes/rust/Cargo.toml

@@ -15,7 +15,7 @@ readme = "README.md"
 [dependencies]
 aws-config = "1.5.11"
 aws-lc-rs = "1.12.0"
-aws-lc-sys = "0.22.0"
+aws-lc-sys = "0.24.0"
 aws-sdk-dynamodb = "1.55.0"
 aws-sdk-kms = "1.51.0"
 aws-smithy-runtime-api = {version = "1.7.3", features = ["client"] }

AwsCryptographicMaterialProviders/runtimes/rust/src/aes_gcm.rs

@@ -52,11 +52,13 @@ impl AES_GCM {
             ))
         } else if *self.keyLength() == 32i32 {
             Ok(&aws_lc_rs::aead::AES_256_GCM)
+        } else if *self.keyLength() == 24i32 {
+            Ok(&aws_lc_rs::aead::AES_192_GCM)
         } else if *self.keyLength() == 16i32 {
             Ok(&aws_lc_rs::aead::AES_128_GCM)
         } else {
             Err(format!(
-                "Key length of {} not supported in Rust. Key length must be 16 or 32.",
+                "Key length of {} not supported in Rust. Key length must be 16, 24 or 32.",
                 self.keyLength()
             ))
         }

AwsCryptographicMaterialProviders/runtimes/rust/src/ecdh.rs

@@ -74,6 +74,9 @@ pub mod ECDH {
         const ELEM_MAX_BYTES: usize = (ELEM_MAX_BITS + 7) / 8;
         const PUBLIC_KEY_MAX_LEN: usize = 1 + (2 * ELEM_MAX_BYTES);
 
+        // This is the value checked in the Dafny test
+        const INVALID_KEY: &str = "Invalid X509 Public Key.";
+
         pub(crate) fn X509_to_X962(
             public_key: &[u8],
             compress: bool,
@@ -86,7 +89,7 @@ pub mod ECDH {
 
             let evp_pkey = unsafe { EVP_parse_public_key(&mut cbs) };
             if evp_pkey.is_null() {
-                return Err("Invalid X509 Public Key.".to_string());
+                return Err(INVALID_KEY.to_string());
             }
             let ec_key = unsafe { EVP_PKEY_get0_EC_KEY(evp_pkey) };
 
@@ -326,7 +329,29 @@ pub mod ECDH {
 
         // for the moment, it's valid if we can use it to generate a shared secret
         fn valid_public_key(alg: &ECDHCurveSpec, public_key: &[u8]) -> Result<(), String> {
-            X509_to_X962(public_key, false, Some(get_nid(alg)))?;
+            let mut cbs = CBS {
+                data: public_key.as_ptr(),
+                len: public_key.len(),
+            };
+
+            let evp_pkey = unsafe { EVP_parse_public_key(&mut cbs) };
+            if evp_pkey.is_null() {
+                return Err(INVALID_KEY.to_string());
+            }
+            let ec_key = unsafe { EVP_PKEY_get0_EC_KEY(evp_pkey) };
+
+            if unsafe {aws_lc_sys::EC_KEY_check_fips(ec_key)} != 1 {
+                return Err(INVALID_KEY.to_string());
+            }
+            let ec_group = unsafe { EC_KEY_get0_group(ec_key) };
+            if ec_group.is_null() {
+                return Err(INVALID_KEY.to_string());
+            }
+            if get_nid(alg) != unsafe { EC_GROUP_get_curve_name(ec_group) } {
+                return Err(INVALID_KEY.to_string());
+            }
+            unsafe { EVP_PKEY_free(evp_pkey) };
+
             Ok(())
         }
 

AwsCryptographyPrimitives/runtimes/rust/Cargo.toml

@@ -9,7 +9,7 @@ rust-version = "1.80.0"
 [dependencies]
 aws-config = "1.5.11"
 aws-lc-rs = "1.12.0"
-aws-lc-sys = "0.22.0"
+aws-lc-sys = "0.24.0"
 aws-smithy-runtime-api = "1.7.3"
 aws-smithy-types = "1.2.10"
 chrono = "0.4.39"

TestVectorsAwsCryptographicMaterialProviders/dafny/TestVectorsAwsCryptographicMaterialProviders/src/VectorsComposition/AllAlgorithmSuites.dfy

@@ -21,35 +21,16 @@ module {:options "-functionSyntax:4"} AllAlgorithmSuites {
       Types.CommitmentPolicy.DBE(Types.DBECommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT)
   }
 
-  // TODO: Add aes-192 after aws-lc-rs adds support
-  // To add AES192 tests, uncomment next line and remove the current value of ESDKAlgorithmSuites
-  //   const ESDKAlgorithmSuites := set id: Types.ESDKAlgorithmSuiteId :: AlgorithmSuites.GetESDKSuite(id)
-  const ESDKAlgorithmSuites := set id: Types.ESDKAlgorithmSuiteId |
-                                 id != Types.ALG_AES_192_GCM_IV12_TAG16_NO_KDF &&
-                                 id != Types.ALG_AES_192_GCM_IV12_TAG16_HKDF_SHA256 &&
-                                 id != Types.ALG_AES_192_GCM_IV12_TAG16_HKDF_SHA384_ECDSA_P384 ::
-                                 AlgorithmSuites.GetESDKSuite(id)
+  const ESDKAlgorithmSuites := set id: Types.ESDKAlgorithmSuiteId :: AlgorithmSuites.GetESDKSuite(id)
+
   const DBEAlgorithmSuites := set id: Types.DBEAlgorithmSuiteId :: AlgorithmSuites.GetDBESuite(id)
 
   const AllAlgorithmSuites := ESDKAlgorithmSuites + DBEAlgorithmSuites
 
-  // TODO: Add aes-192 after aws-lc-rs adds support
-  // To add AES192 tests, comment out AllAlgorithmSuitesIsCompleteExceptAES192
-  // and uncomment AllAlgorithmSuitesIsComplete
-  lemma AllAlgorithmSuitesIsCompleteExceptAES192(id: Types.AlgorithmSuiteId)
-    requires match id
-             case ESDK(e) =>
-               e != Types.ALG_AES_192_GCM_IV12_TAG16_NO_KDF &&
-               e != Types.ALG_AES_192_GCM_IV12_TAG16_HKDF_SHA256 &&
-               e != Types.ALG_AES_192_GCM_IV12_TAG16_HKDF_SHA384_ECDSA_P384
-             case DBE(_) => true
+  lemma AllAlgorithmSuitesIsComplete(id: Types.AlgorithmSuiteId)
     ensures AlgorithmSuites.GetSuite(id) in AllAlgorithmSuites
   {}
 
-  // lemma AllAlgorithmSuitesIsComplete(id: Types.AlgorithmSuiteId)
-  //   ensures AlgorithmSuites.GetSuite(id) in AllAlgorithmSuites
-  // {}
-
   function ToHex(algorithmSuite: Types.AlgorithmSuiteInfo)
     : string
   {

TestVectorsAwsCryptographicMaterialProviders/runtimes/rust/Cargo.toml

@@ -12,7 +12,7 @@ wrapped-client = []
 [dependencies]
 aws-config = "1.5.11"
 aws-lc-rs = "1.12.0"
-aws-lc-sys = "0.22.0"
+aws-lc-sys = "0.24.0"
 aws-sdk-dynamodb = "1.55.0"
 aws-sdk-kms = "1.51.0"
 aws-smithy-runtime-api = {version = "1.7.3", features = ["client"] }