fix(kms): gate Encrypt on key usage + real RSA-OAEP for asymmetric keys

[vieiralucas]

Summary

Encrypt ignored the key's usage and spec entirely: it always built a symmetric AES blob and hardcoded EncryptionAlgorithm=SYMMETRIC_DEFAULT. Consequences:

• a SIGN_VERIFY / GENERATE_VERIFY_MAC / KEY_AGREEMENT key wrongly "encrypted" (AWS returns InvalidKeyUsageException),
• a symmetric key accepted a bogus EncryptionAlgorithm, and
• an RSA ENCRYPT_DECRYPT key returned a symmetric blob no external RSA tool could decrypt — the asymmetric encrypt path was non-functional end-to-end.

Fix:

• Reject Encrypt on any key whose usage isn't ENCRYPT_DECRYPT.
• Symmetric keys: validate the requested EncryptionAlgorithm is SYMMETRIC_DEFAULT and echo it.
• Asymmetric RSA keys: encrypt with real RSA-OAEP under the key's public half (new asym::rsa_oaep_wrap), echo the requested RSAES_OAEP_SHA_1/_256, and add a fakecloud-rsa: ciphertext envelope that Decrypt reverses with the private half. The ciphertext now round-trips through external RSA tooling and KMS Decrypt.
• Decrypt echoes the real EncryptionAlgorithm (threaded through DecodedCiphertext) instead of a hardcoded SYMMETRIC_DEFAULT.

Found by the 2026-06-20 bug-hunt audit (finding 1.11).

Test plan

• encrypt_rejects_non_encrypt_decrypt_key — SIGN_VERIFY key → InvalidKeyUsageException.
• encrypt_symmetric_rejects_asymmetric_algorithm — symmetric key + RSAES_OAEP_SHA_256 → InvalidKeyUsageException.
• encrypt_rsa_key_uses_real_oaep_and_roundtrips — RSA key encrypts with the fakecloud-rsa: envelope, echoes the algorithm, and Decrypt recovers the plaintext.
• Full KMS suite: 184 passed.
• cargo clippy -p fakecloud-kms --all-targets -- -D warnings clean.

---

Summary by cubic

Gate KMS Encrypt by key usage and implement real RSA‑OAEP for asymmetric keys. This fixes incorrect encryption behavior and ensures Decrypt echoes the correct algorithm.

• Bug Fixes
  • Reject Encrypt for keys not using ENCRYPT_DECRYPT (returns InvalidKeyUsageException).
  • Symmetric keys only accept SYMMETRIC_DEFAULT and now echo it.
  • RSA ENCRYPT_DECRYPT keys use true RSA‑OAEP with RSAES_OAEP_SHA_1 or RSAES_OAEP_SHA_256, producing a fakecloud-rsa:<key_id>:<algorithm>:<b64> envelope that Decrypt reverses with the private key.
  • Decrypt now returns the real EncryptionAlgorithm instead of hardcoding SYMMETRIC_DEFAULT.

^{Written for commit 72ddf52. Summary will update on new commits.}

[codecov]

Codecov Report

❌ Patch coverage is 78.26087% with 20 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/fakecloud-kms/src/service_crypto.rs	71.42%	14 Missing ⚠️
crates/fakecloud-kms/src/helpers.rs	81.48%	5 Missing ⚠️
crates/fakecloud-kms/src/asym.rs	93.75%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!