[Key Vault] Add local crypto support for AES-CBCPAD #17762
Conversation
mccoyp
added
KeyVault
Client
sdk/keyvault/azure-keyvault-keys/azure/keyvault/keys/crypto/_providers/local_provider.py
Outdated
Show resolved
Hide resolved
| encryptor = algorithm.create_encryptor(key=self._key, iv=iv) | ||
| return encryptor.transform(plain_text, **kwargs) | ||
| raise_if_incorrect_key_size(algorithm, len(self._key)) | ||
| encryptor = algorithm.create_encryptor(key=self._key, iv=kwargs.pop("iv", None)) |
There was a problem hiding this comment.
Won't this just raise when iv is None?
There was a problem hiding this comment.
An error will raise from a check in aes_cbc.py, yes. I didn't enforce that check here partially because there are some symmetric algorithms (AES-GCM) that don't accept an IV for encryption. This could be a case of planning for functionality we don't yet have, but I think it makes sense to validate that while validating the key and IV size. Is that what you were asking about?
There was a problem hiding this comment.
I thought it was odd to use a default value that always gets an error. If AES-GCM is the only such algorithm supported by Key Vault, I'd forego the flexibility because we won't ever do AES-GCM locally.
sdk/keyvault/azure-keyvault-keys/azure/keyvault/keys/crypto/aio/_client.py
Outdated
Show resolved
Hide resolved
sdk/keyvault/azure-keyvault-keys/azure/keyvault/keys/crypto/_internal/algorithms/aes_cbc.py
Outdated
Show resolved
Hide resolved
| supported_key_wrap_algorithms.append(AesKw192.name()) | ||
| if key_size >= key_size_256: | ||
| supported_encryption_algorithms.append(Aes256Cbc.name()) | ||
| supported_encryption_algorithms.append(Aes256CbcPad.name()) | ||
| supported_encryption_algorithms.append(Aes128CbcHmacSha256.name()) |
There was a problem hiding this comment.
This makes me nervous: we don't intend to support HMAC algorithms locally but may now do so in an undocumented way.
Resolves #17425, at least to achieve parity with Javascript.
This adds local crypto support for encryption and decryption with AES-CBCPAD algorithms. AES-CBC support is on hold until we find a way to perform zero-padding -- the closest thing in
cryptographyis ANSIX923 padding, but the final byte in that padding is nonzero.This also fixes a bug that I had accidentally introduced in async tests by removing preparers: async test cases weren't being awaited due to the preparer's absence, and green test runs greatly exaggerated their success. This decorates affected tests with a dummy
PowerShellPreparerthat gets them noticed by the test runner without affecting execution otherwise.