add a test

mkleene · mkleene · commit 976b986d2bd9 · 2025-07-08T16:58:23.000+02:00
diff --git a/sdk/src/main/java/io/opentdf/platform/sdk/ECCMode.java b/sdk/src/main/java/io/opentdf/platform/sdk/ECCMode.java
@@ -44,7 +44,7 @@ public void setEllipticCurve(NanoTDFType.ECCurve curve) {
         }
     }
 
-    public NanoTDFType.ECCurve getEllipticCurveType() {
+    public NanoTDFType.ECCurve getCurve() {
         return NanoTDFType.ECCurve.values()[data.curveMode];
     }
 
diff --git a/sdk/src/main/java/io/opentdf/platform/sdk/ECKeyPair.java b/sdk/src/main/java/io/opentdf/platform/sdk/ECKeyPair.java
@@ -24,6 +24,7 @@
 import java.io.*;
 import java.security.*;
 import java.security.spec.*;
+import java.util.Objects;
 // https://www.bouncycastle.org/latest_releases.html
 
 public class ECKeyPair {
@@ -48,7 +49,7 @@ public ECKeyPair() {
     }
 
     public ECKeyPair(NanoTDFType.ECCurve curve, ECAlgorithm algorithm) {
-        this.curve = curve;
+        this.curve = Objects.requireNonNull(curve);
         KeyPairGenerator generator;
 
         try {
@@ -80,6 +81,10 @@ public ECPrivateKey getPrivateKey() {
         return (ECPrivateKey) this.keyPair.getPrivate();
     }
 
+    NanoTDFType.ECCurve getCurve() {
+        return this.curve;
+    }
+
     public String publicKeyInPEMFormat() {
         StringWriter writer = new StringWriter();
         PemWriter pemWriter = new PemWriter(writer);
diff --git a/sdk/src/main/java/io/opentdf/platform/sdk/Header.java b/sdk/src/main/java/io/opentdf/platform/sdk/Header.java
@@ -26,7 +26,7 @@ public Header(ByteBuffer buffer) {
         this.payloadConfig = new SymmetricAndPayloadConfig(buffer.get());
         this.policyInfo = new PolicyInfo(buffer, this.eccMode);
 
-        int compressedPubKeySize = this.eccMode.getEllipticCurveType().keySize;
+        int compressedPubKeySize = this.eccMode.getCurve().keySize;
         this.ephemeralKey = new byte[compressedPubKeySize];
         buffer.get(this.ephemeralKey);
     }
@@ -79,10 +79,10 @@ public PolicyInfo getPolicyInfo() {
     }
 
     public void setEphemeralKey(byte[] bytes) {
-        if (bytes.length < eccMode.getEllipticCurveType().keySize) {
+        if (bytes.length < eccMode.getCurve().keySize) {
             throw new IllegalArgumentException("Failed to read ephemeral key - invalid buffer size.");
         }
-        ephemeralKey = Arrays.copyOf(bytes, eccMode.getEllipticCurveType().keySize);
+        ephemeralKey = Arrays.copyOf(bytes, eccMode.getCurve().keySize);
     }
 
     public byte[] getEphemeralKey() {
diff --git a/sdk/src/main/java/io/opentdf/platform/sdk/NanoTDF.java b/sdk/src/main/java/io/opentdf/platform/sdk/NanoTDF.java
@@ -82,14 +82,20 @@ private Config.HeaderInfo getHeaderInfo(Config.NanoTDFConfig nanoTDFConfig) thro
         String url = kasInfo.URL;
         if (kasInfo.PublicKey == null || kasInfo.PublicKey.isEmpty()) {
             logger.info("no public key provided for KAS at {}, retrieving", url);
-            kasInfo = services.kas().getECPublicKey(kasInfo, nanoTDFConfig.eccMode.getEllipticCurveType());
+            kasInfo = services.kas().getECPublicKey(kasInfo, nanoTDFConfig.eccMode.getCurve());
         }
 
         // Kas url resource locator
         ResourceLocator kasURL = new ResourceLocator(nanoTDFConfig.kasInfoList.get(0).URL, kasInfo.KID);
         assert kasURL.getIdentifier() != null : "Identifier in ResourceLocator cannot be null";
 
-        ECKeyPair keyPair = new ECKeyPair(nanoTDFConfig.eccMode.getEllipticCurveType(), ECKeyPair.ECAlgorithm.ECDSA);
+        // it might be better to pull the curve from the OIDC in the PEM but it looks like we
+        // are just taking the Algorithm as correct
+        var ecCurve = NanoTDFType.ECCurve.fromAlgorithm(kasInfo.Algorithm);
+        if (ecCurve != nanoTDFConfig.eccMode.getCurve()) {
+            logger.warn("ECCurve in NanoTDFConfig [{}] does not match the curve in KASInfo, using KASInfo curve [{}]", nanoTDFConfig.eccMode.getCurve(), ecCurve);
+        }
+        ECKeyPair keyPair = new ECKeyPair(ecCurve, ECKeyPair.ECAlgorithm.ECDSA);
 
         // Generate symmetric key
         ECPublicKey kasPublicKey = ECKeyPair.publicKeyFromPem(kasInfo.PublicKey);
@@ -138,7 +144,14 @@ private Config.HeaderInfo getHeaderInfo(Config.NanoTDFConfig nanoTDFConfig) thro
         // Create header
         byte[] compressedPubKey = keyPair.compressECPublickey();
         Header header = new Header();
-        header.setECCMode(nanoTDFConfig.eccMode);
+        ECCMode mode;
+        if (nanoTDFConfig.eccMode.getCurve() != keyPair.getCurve()) {
+            mode = new ECCMode(nanoTDFConfig.eccMode.getECCModeAsByte());
+            mode.setEllipticCurve(keyPair.getCurve());
+        } else {
+            mode = nanoTDFConfig.eccMode;
+        }
+        header.setECCMode(mode);
         header.setPayloadConfig(nanoTDFConfig.config);
         header.setEphemeralKey(compressedPubKey);
         header.setKasLocator(kasURL);
@@ -276,7 +289,7 @@ public void readNanoTDF(ByteBuffer nanoTDF, OutputStream outputStream,
             }
 
 
-            key = services.kas().unwrapNanoTDF(header.getECCMode().getEllipticCurveType(),
+            key = services.kas().unwrapNanoTDF(header.getECCMode().getCurve(),
                     base64HeaderData,
                     kasUrl);
             collectionStore.store(header, new CollectionKey(key));
diff --git a/sdk/src/main/java/io/opentdf/platform/sdk/NanoTDFType.java b/sdk/src/main/java/io/opentdf/platform/sdk/NanoTDFType.java
@@ -1,6 +1,12 @@
 package io.opentdf.platform.sdk;
 
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.Arrays;
+
 public class NanoTDFType {
+    private static final Logger log = LoggerFactory.getLogger(NanoTDFType.class);
     enum ECCurve {
         SECP256R1("secp256r1", 32, 33, 0x00),
         SECP384R1("secp384r1", 48, 49, 0x01),
@@ -34,6 +40,20 @@ static ECCurve fromCurveMode(int curveMode) {
             }
             throw new IllegalArgumentException("No enum constant for curve mode: " + curveMode);
         }
+
+        public static ECCurve fromAlgorithm(String algorithm) {
+            if (algorithm == null) {
+                log.warn("got a null algorithm, returning SECP256R1 as default");
+                return SECP256R1;
+            }
+
+            assert algorithm.startsWith("ec:");
+            var searchKey = algorithm.substring("ec:".length());
+            return Arrays.stream(ECCurve.values())
+                    .filter(v -> v.curveName.equalsIgnoreCase(searchKey))
+                    .findAny()
+                    .orElseThrow(() -> new IllegalArgumentException(String.format("No enum constant for algorithm: %s", algorithm)));
+        }
     }
     // ResourceLocator Protocol
     public enum Protocol {
diff --git a/sdk/src/main/java/io/opentdf/platform/sdk/PolicyInfo.java b/sdk/src/main/java/io/opentdf/platform/sdk/PolicyInfo.java
@@ -47,7 +47,7 @@ public PolicyInfo(ByteBuffer buffer, ECCMode eccMode) {
 
         int bindingBytesSize = 8; // GMAC length
         if (this.hasECDSABinding) { // ECDSA - The size of binding depends on the curve.
-            bindingBytesSize = ECCMode.getECDSASignatureStructSize(eccMode.getEllipticCurveType());
+            bindingBytesSize = ECCMode.getECDSASignatureStructSize(eccMode.getCurve());
         }
 
         this.binding = new byte[bindingBytesSize];
diff --git a/sdk/src/test/java/io/opentdf/platform/sdk/HeaderTest.java b/sdk/src/test/java/io/opentdf/platform/sdk/HeaderTest.java
@@ -47,7 +47,7 @@ void settingAndGettingEphemeralKey() {
         ECCMode mode = new ECCMode((byte) 1); // Initialize the ECCMode object
         header.setECCMode(mode); // Set the ECCMode object
 
-        int keySize = mode.getEllipticCurveType().keySize;
+        int keySize = mode.getCurve().keySize;
         byte[] key = new byte[keySize]; // Ensure the key size is correct
         header.setEphemeralKey(key);
         assertArrayEquals(key, header.getEphemeralKey());
diff --git a/sdk/src/test/java/io/opentdf/platform/sdk/NanoTDFHeaderTest.java b/sdk/src/test/java/io/opentdf/platform/sdk/NanoTDFHeaderTest.java
@@ -169,7 +169,7 @@ public void testNanoTDFReader()
                 header2.setPolicyInfo(policyInfo);
 
                 int sizeToRead = policyInfo.getTotalSize();
-                int compressedPubKeySize = header2.getECCMode().getEllipticCurveType().keySize;
+                int compressedPubKeySize = header2.getECCMode().getCurve().keySize;
                 byte[] ephemeralKey = new byte[compressedPubKeySize]; // size of compressed public key
                 System.arraycopy(remainingBytesArray, sizeToRead, ephemeralKey, 0, ephemeralKey.length);
                 header2.setEphemeralKey(ephemeralKey);
@@ -201,11 +201,11 @@ public void testNanoTDFEncryption()
                 byte[] tag = new byte[tagSize];
 
                 ECCMode eccMode = new ECCMode((byte) 0x0); // no ecdsa binding and 'secp256r1'
-                ECKeyPair sdkECKeyPair = new ECKeyPair(eccMode.getEllipticCurveType(), ECKeyPair.ECAlgorithm.ECDH);
+                ECKeyPair sdkECKeyPair = new ECKeyPair(eccMode.getCurve(), ECKeyPair.ECAlgorithm.ECDH);
                 String sdkPrivateKeyForEncrypt = sdkECKeyPair.privateKeyInPEMFormat();
                 String sdkPublicKeyForEncrypt = sdkECKeyPair.publicKeyInPEMFormat();
 
-                ECKeyPair kasECKeyPair = new ECKeyPair(eccMode.getEllipticCurveType(), ECKeyPair.ECAlgorithm.ECDH);
+                ECKeyPair kasECKeyPair = new ECKeyPair(eccMode.getCurve(), ECKeyPair.ECAlgorithm.ECDH);
                 String kasPublicKey = kasECKeyPair.publicKeyInPEMFormat();
                 // Encrypt
                 Header header = new Header();
diff --git a/sdk/src/test/java/io/opentdf/platform/sdk/NanoTDFTest.java b/sdk/src/test/java/io/opentdf/platform/sdk/NanoTDFTest.java
@@ -76,6 +76,7 @@ public KASInfo getECPublicKey(Config.KASInfo kasInfo, NanoTDFType.ECCurve curve)
             var k2 = kasInfo.clone();
             k2.KID = KID;
             k2.PublicKey = kasPublicKey;
+            k2.Algorithm = "ec:secp256r1";
             return k2;
         }
 
@@ -98,7 +99,7 @@ public byte[] unwrapNanoTDF(NanoTDFType.ECCurve curve, String header, String kas
             Header nTDFHeader = new Header(ByteBuffer.wrap(headerAsBytes));
             byte[] ephemeralKey = nTDFHeader.getEphemeralKey();
 
-            String publicKeyAsPem = ECKeyPair.publicKeyFromECPoint(ephemeralKey, nTDFHeader.getECCMode().getEllipticCurveType().curveName);
+            String publicKeyAsPem = ECKeyPair.publicKeyFromECPoint(ephemeralKey, nTDFHeader.getECCMode().getCurve().curveName);
 
             // Generate symmetric key
             byte[] symmetricKey = ECKeyPair.computeECDHKey(ECKeyPair.publicKeyFromPem(publicKeyAsPem),
@@ -162,6 +163,7 @@ void encryptionAndDecryptionWithValidKey() throws Exception {
 
         Config.NanoTDFConfig config = Config.newNanoTDFConfig(
                 Config.withNanoKasInformation(kasInfos.toArray(new Config.KASInfo[0])),
+                Config.withEllipticCurve("secp384r1"),
                 Config.witDataAttributes("https://example.com/attr/Classification/value/S",
                         "https://example.com/attr/Classification/value/X")
         );
@@ -201,18 +203,36 @@ void encryptionAndDecryptionWithValidKey() throws Exception {
         }
     }
 
-    void runBasicTest(String kasUrl, boolean allowed, KeyAccessServerRegistryServiceClient kasReg, NanoTDFReaderConfig decryptConfig) throws Exception {
+    @Test
+    void testWithDifferentConfigAndKeyValues() throws Exception {
         var kasInfos = new ArrayList<>();
         var kasInfo = new Config.KASInfo();
-        kasInfo.URL = kasUrl;
+        kasInfo.URL = "https://api.example.com/kas";
         kasInfo.PublicKey = null;
         kasInfos.add(kasInfo);
-
-        Config.NanoTDFConfig config = Config.newNanoTDFConfig(
+        var config = Config.newNanoTDFConfig(
                 Config.withNanoKasInformation(kasInfos.toArray(new Config.KASInfo[0])),
-                Config.witDataAttributes("https://example.com/attr/Classification/value/S",
-                        "https://example.com/attr/Classification/value/X")
+                Config.withEllipticCurve("secp384r1"),
+                Config.witDataAttributes("https://example.com/attr/Classification/value/S", "https://example.com/attr/Classification/value/X")
         );
+        runBasicTest(null, true, kasRegistryService, null, config);
+    }
+
+    void runBasicTest(String kasUrl, boolean allowed, KeyAccessServerRegistryServiceClient kasReg, NanoTDFReaderConfig decryptConfig, Config.NanoTDFConfig writerConfig) throws Exception {
+        Config.NanoTDFConfig config;
+        if (writerConfig == null) {
+            var kasInfos = new ArrayList<>();
+            var kasInfo = new Config.KASInfo();
+            kasInfo.URL = kasUrl;
+            kasInfo.PublicKey = null;
+            kasInfos.add(kasInfo);
+            config = Config.newNanoTDFConfig(
+                    Config.withNanoKasInformation(kasInfos.toArray(new Config.KASInfo[0])),
+                    Config.witDataAttributes("https://example.com/attr/Classification/value/S", "https://example.com/attr/Classification/value/X")
+            );
+        } else {
+            config = writerConfig;
+        }
 
         String plainText = "Virtru!!";
         ByteBuffer byteBuffer = ByteBuffer.wrap(plainText.getBytes());
@@ -244,8 +264,6 @@ void runBasicTest(String kasUrl, boolean allowed, KeyAccessServerRegistryService
                 assertThat(e.getMessage()).contains("KasAllowlist");
             }
         }
-
-        
     }
 
     @Test
@@ -265,18 +283,18 @@ void kasAllowlistTests() throws Exception {
                 "https://localhost:8080/kas"
         );
         for (String kasUrl : kasUrlsSuccess) {
-            runBasicTest(kasUrl, true, kasRegistryService, null);
+            runBasicTest(kasUrl, true, kasRegistryService, null, null);
         }
         for (String kasUrl : kasUrlsFail) {
-            runBasicTest(kasUrl, false, kasRegistryService, null);
+            runBasicTest(kasUrl, false, kasRegistryService, null, null);
         } 
         
         // test with kasAllowlist
-        runBasicTest("http://api.example.com/kas", true, null, Config.newNanoTDFReaderConfig(Config.WithNanoKasAllowlist("http://api.example.com/kas")));
-        runBasicTest(platformUrl+"/kas", false, null, Config.newNanoTDFReaderConfig(Config.WithNanoKasAllowlist("http://api.example.com/kas")));
+        runBasicTest("http://api.example.com/kas", true, null, Config.newNanoTDFReaderConfig(Config.WithNanoKasAllowlist("http://api.example.com/kas")), null);
+        runBasicTest(platformUrl+"/kas", false, null, Config.newNanoTDFReaderConfig(Config.WithNanoKasAllowlist("http://api.example.com/kas")), null);
 
         // test ignore kasAllowlist
-        runBasicTest(platformUrl+"/kas", true, null, Config.newNanoTDFReaderConfig(Config.WithNanoKasAllowlist("http://api.example.com/kas"), Config.WithNanoIgnoreKasAllowlist(true)));
+        runBasicTest(platformUrl+"/kas", true, null, Config.newNanoTDFReaderConfig(Config.WithNanoKasAllowlist("http://api.example.com/kas"), Config.WithNanoIgnoreKasAllowlist(true)), null);
     }
 
     @Test

Original file line number	Diff line number	Diff line change
`@@ -44,7 +44,7 @@ public void setEllipticCurve(NanoTDFType.ECCurve curve) {`
`44`	`44`	`}`
`45`	`45`	`}`
`46`	`46`
`47`		`- public NanoTDFType.ECCurve getEllipticCurveType() {`
	`47`	`+ public NanoTDFType.ECCurve getCurve() {`
`48`	`48`	`return NanoTDFType.ECCurve.values()[data.curveMode];`
`49`	`49`	`}`
`50`	`50`
Original file line number	Diff line number	Diff line change
`@@ -26,7 +26,7 @@ public Header(ByteBuffer buffer) {`
`26`	`26`	`this.payloadConfig = new SymmetricAndPayloadConfig(buffer.get());`
`27`	`27`	`this.policyInfo = new PolicyInfo(buffer, this.eccMode);`
`28`	`28`
`29`		`- int compressedPubKeySize = this.eccMode.getEllipticCurveType().keySize;`
	`29`	`+ int compressedPubKeySize = this.eccMode.getCurve().keySize;`
`30`	`30`	`this.ephemeralKey = new byte[compressedPubKeySize];`
`31`	`31`	`buffer.get(this.ephemeralKey);`
`32`	`32`	`}`
`@@ -79,10 +79,10 @@ public PolicyInfo getPolicyInfo() {`
`79`	`79`	`}`
`80`	`80`
`81`	`81`	`public void setEphemeralKey(byte[] bytes) {`
`82`		`- if (bytes.length < eccMode.getEllipticCurveType().keySize) {`
	`82`	`+ if (bytes.length < eccMode.getCurve().keySize) {`
`83`	`83`	`throw new IllegalArgumentException("Failed to read ephemeral key - invalid buffer size.");`
`84`	`84`	`}`
`85`		`- ephemeralKey = Arrays.copyOf(bytes, eccMode.getEllipticCurveType().keySize);`
	`85`	`+ ephemeralKey = Arrays.copyOf(bytes, eccMode.getCurve().keySize);`
`86`	`86`	`}`
`87`	`87`
`88`	`88`	`public byte[] getEphemeralKey() {`
Original file line number	Diff line number	Diff line change
`@@ -47,7 +47,7 @@ public PolicyInfo(ByteBuffer buffer, ECCMode eccMode) {`
`47`	`47`
`48`	`48`	`int bindingBytesSize = 8; // GMAC length`
`49`	`49`	`if (this.hasECDSABinding) { // ECDSA - The size of binding depends on the curve.`
`50`		`- bindingBytesSize = ECCMode.getECDSASignatureStructSize(eccMode.getEllipticCurveType());`
	`50`	`+ bindingBytesSize = ECCMode.getECDSASignatureStructSize(eccMode.getCurve());`
`51`	`51`	`}`
`52`	`52`
`53`	`53`	`this.binding = new byte[bindingBytesSize];`