All notable changes to this project will be documented in this file.
- HSM support (#344)
- support for the Proteccio HSM that provides both
- the ability to perform the Create, Destroy, Export, Encrypt, and Decrypt operations on the HSM
- the ability to create keys in the KMS which are wrapped by a key in the HSM
- the database components are now in a separate crate
server_database. They are now split in 2 implementations: Objects store and Permissions store - a new
interfacescrate gathers interfaces to be implemented by new external components. Interfaces include:- Object Store
- Permissions Store
- Encryption Oracle
- key unique identifiers now support prefixes. Object Stores, Permissions stores, and Encryption Oracles can be registered against the prefixes.
- support for the
SensitiveAttribute in addition to the ability to wrap a key by another key has been added to all keys creations
- support for the Proteccio HSM that provides both
- Make keys non revocable on server (#341)
- Docker for Linux ARM and keep support for MacOS Intel (#343)
- The macOS-12 environment is now deprecated
- Better permissions checking on wrapping and unwrapping
- Add benchmarks on simultaneous encryptions/decryptions
- Maturin build on macos arm - force forward compatibility (#336)
- Launch encrypted GMeet through GCal (#334)
- MacOS-maturin: Upgrade python version from 3.12 to 3.13 (#333)
- Dont panic on indexing slicing (#331)
ckmsinstallation - specifically for Windows (#332)
- Client
ckms: merge attributes handling (set/get/delete) underattributessubcommand (#329)
- Guard on size of ciphertexts for BulkData (#330)
- KMIP Attributes: fix deletion on Links and Vendor Attributes (#329)
- Google Workspace Client-Side-Encryption (CSE)
updates (#319)
- Generate Google S/MIME key-pairs and identities and upload them to Gmail API from ckms CLI (#270)
- Server-side, export cert at PKCS7 format
- Implement missing CSE endpoints
- Wrap/unwrap CSE elements with authenticated encryption
- Export wrapped keys from KMS specifying the cipher mode
- Handle auth for guest users (#271)
- Add SetAttribute/DeleteAttribute KMIP operations (#303)
- Re-enable wrap/unwrap on ckms by linking statically on openssl (#317)
- Added AES GCM-SIV and AES XTS (#328)
- Added the ability to client side encrypt files with
ckmsand a hybrid scheme (#328) - Create Symmetric Key / Private keys with custom unique id (#326)
- Add bulk encrypt / decrypt facility (#318)
- Replace Debug derive trait of KMIP Object by a custom Display impl (#327)
- Documentation: Migrating emails to Gmail CSE (#316)
- Update CSE documentation (Gmail S/MIME) (#316)
- Update KMS build instructions (#320)
- Add test on database backends (#311)
- Reduce CI pipeline duration in debug (#315)
- Add CSE endpoints testing (#319)
- Clippy hardening in crate
kmip(#304)
- Add ReKey KMIP operation (#294)
- Add API token authentication between server and clients (#290)
- Build a generic database upgrade mechanism (#299)
- Export of certificates can now be performed using the certificate id (instead of just the private key id)
- More intuitive PKCS#12 import (#306)
- Support for export under legacy PKCS#12 format (#306)
- Documentation (S/MIME)
- KMIP Attributes:
- Certificates handling/tasks:
- Merge decrypt match in same function (#295)
- Fix Public RSA Key size in get attributes (#275)
- RUSTSEC:
- CLI doc fixes (certificates certify)
- Fix PKCS#12 export of self-signed cert (#305)
- Fix serialization of
Attributesinredis-findex(#307)
- clippy tasks:
- Rename MacOS artifacts giving CPU architecture
- Configure
ckmsto build reqwest with minimal idle connections reuse (#272) - Do not delete tags if none are provided (#276)
- De-activated Google CSE tests when tokens are not supplied through env. var.
- Cleaned-up and improved certificates import tests
- Made test DB backend selectable using env. var.
KMS_TEST_URL
- Add KMIP operation
Validatefor certificates (#247) - Added RSA benchmarks (#251)
- Add OpenTelemetry OTLP protocol support to KMS server (#253)
- Support for multiple certification scenarios and self-signing (#248)
- Create Debian/RPM packages for Ubuntu 2x.04 and RHEL 9 (#264)
- Drop Centos 7 support (#265)
- Replace
cargo auditwithcargo deny(#245) - Replace Linux cross-compiling for Windows with compiling on Windows Github runner (#249)
- Add support for build on MacOS ARM
- Fixed import of symmetric key tag to '_kk' from '_sk'
- Add support for LUKS via PKCS#11 module
- Add support for CKM_RSA_PKCS (PKCS#1 v1.5) for RSA encryption/decryption
- Create Gmail key pairs and identities with
ckmsvia Gmail API (#243)
- Comment out mermaid configuration
- Add Google Workspace CSE endpoints for **encrypted Gmail ** (#192)
- Oauth2 OIDC doc fixes
- Add license to KMS GCP image (#235)
- Re-enable the validation of JWT Issuer URI
- Fix CSE error status code, propagating the right status code instead of generic server code error
- Handle many identity providers in jwt authentication
- New command line argument
--key-usageto define key or certificate usage on import - Exhaustive verification that the key used to perform cryptographic operations is allowed to do them
- KMIP object creation can now precisely define the usage of the key it describes
- Add standalone workflow to test KMS in Cosmian VM (#233)
- Rebase KMS GCP image on Cosmian VM 1.1.0-rc.4
- Remove optimization RUSTFLAGS (#227)
- Rebase KMS GCP image on Cosmian VM 1.1.0-rc.3
- Fixed double quotes problem in cosmian vm test (CI)
- Fixed trailing null byte bug for biguint/bytes conversions (#224)
- Make the CLI compile on Windows and macOS (without openssl installed) (#209)
- Support Veracrypt PKCS11 provider library (#208)
- Update
test_kms.pyto use covercrypt14.0.0(#217)
- Add missing image_licenses in packer for GCP (#219)
- Push GCP images based on Cosmian VM 1.1.0-rc2
ckmsneedskmipdependency with featuresopenssl(#202)
- Push GCP images on cosmian-dev and cosmian-public only once (#203)
- Filter reboot test on GCP/RHEL instance.
- Add build of GCP images (ubuntu/redhat) #191.
- Save KMIP Attributes in a proper column of
Objectstable #166:- Remove all custom tags
_cert_spki,_cert_cn,_cert_issuerand_cert_sk
- Remove all custom tags
- Add support for CoverCrypt
rekey,prune, andPolicyediting methods #179:- Add CLI commands to perform these actions
- Accurate CryptographicUsageMask for KMIP creation (RSA and EC keys) #189 and #187.
- Rework utils/crypto #178.
- Fixing inconsistent crypto consts #190.
- Fix interpolation in error macros #184.
- Move internal KMIP Objects into
Boxto avoid stack memory overflow #200.
- Generalize the refresh of JWKS in the middleware #150.
- CI speed up #173.
- Add support for Microsoft Double Key Encryption (DKE) endpoints #170.
- Re-organized crypto package by algorithm, removed duplicated code #170.
- Add support for FIPS mode for the ckms client #170.
- Documented TOML configuration file for the KMS server #170.
- Overall improvements to the documentation on algorithms and FIPS mode #170.
- CLI: allow multiple operations to be supplied at once for access control #155.
- Business Source License 1.1
- Test and deliver in CI missing FIPS binary (fips.so and openssl.cnf for FIPS) #152
- Load correct openssl provider on run
- Pypi now requires a token to publish #148
- X509 v3 extensions support #120
- Dynamic salt for password derivation, resolving issue #124 #128
- Support Cosmian VM #129
- Make rsa oaep aes a generalized encryption system for use in all kms and not only for key wrapping #130
- ECIES implementation for Hybrid Encryption #134
- Add pyo3 methods for
symmetric
create_key,encrypt,decrypt#135 - Add RSA keys create key pair #137
- Upgrade Rust toolchain to 2024-01-09 #141
- Support keypair generation for curve448 Montgomery and edwards forms #143
- Fix mkdocs formatting
- Support for certificate generation using the Certify KMIP operation and a PKCS#10 or a public key
- Support for most standardized encoding formats on import.export: PKCS#8, PKCS#1, SEC1, X509, PKCS#12
- Improvements to the Locate functionality for attributes and tags
- Support for the Get Attributes KMIP operation
- Database: support for atomic operations
- Replaced part of Rust Crypto with openssl for more standardized module support
- Deactivated automatic certificate verification, which will be reallocated
for the future
ValidateKMIP operation support #102 - Deactivated the non KMIP compliant certificate "quick create feature",
which can now be achieved using the
CertifyKMIP operation #103
- Redis-Findex:
createnow checks for the pre-existence of the object - Better KMIP compliance:
- KMIP server operations only support DER format for certificates (#89)
- fix: migrate to num-bigint-dig for bigint (#85)
- Test KMS inside an SGX machine
- Update Covercrypt version to support Policy V2 ([#63])
- Generalize bulk operations using KMIP
Messagesstructure
- Save certs as DER instead of PEM for KMIP compliance
- Fix for #64
- Fix container build on tags
- Serialize the header for each chunk for Covercrypt bulk encryption (#59)
- KMS running inside TEE (SGX or SEV)
- review the
verifysubcommand - force checking the leaf TLS certificate when querying a KMS running inside a TEE
- verify RA-TLS certificate before querying the bootstrap server
- review the TLS certificate generation using the key tied to the TEE
- remove libsgx and create a new dependance to tee_attestation crate
- update KMS server argument regarding the TEE and certbot
- review documentation regarding the KMS usage inside a TEE
- review the
- Activate tracing in CLI tests when binary is instrumented ([#56])
- Trigger public_documentation build on tags
- Added the wildcard user
*to grant access rights to all users on an object - About certificates:
- add validation of the complete chain instead of the leaf and parent certificates
- add verifications before using a certificate:
- check that each certificate is not expired (both chain and leaf certificates)
- check that no certificate is revoked (both chain and leaf certificates)
- check that each certificate has a valid signature (both chain and leaf certificates)
- check that certificate CRL signature is valid
- add RSA X509 certificate support
- add Covercrypt bulk encryption
- KMS CLI
ckms:- can import the Mozilla Common CA Database (CCADB)
- can import a PKCS12 certificate (splitting in 2 KMIP objects: X509 certificate and private key)
- Improved database data structures using Maps and Sets instead of Vectors where uniqueness is required
- Enable bootstrap server for non "enclaves" servers
- Filter Locate request by object type
- Remove merge leftovers
- bootstrap: the KMS server now supports bootstrap mode to facilitate the secure input of secret components, including the database encryption secret and the HTTPS certificate key, directly into the encrypted machine memory, through a secure connection
- Add certificate support:
- in cosmian_kms_server:
- implement
CertifyKMIP operation - in addition, the KMS server will automatically add:
- the system tag
_certonCertificateobject - the system tag
_cert_uid=<certificate_uid>wherecertificate_uidis used as the link between public/private key objects and the related certificate object - the system tag
_cert_spki=<Subject Public Key Info>onCertificateobject where SPKI refers to RFC 5280. The SPKI value identifies uniquely the underlying certificate - the system tag
_cert_ca=<Subject Common Name>on CACertificateobject
- the system tag
- import X509 certificate as PEM and also import private key as PEM
- export generic KMIP key
wrappedby X509 certificate - import a wrapped key with unwrapping on the fly
- encrypt with X509 certificate and decrypt with PKCS8 private key
- implement
- in
ckms, add:- create/destroy certificate
- export/import certificate
- revoke certificate
- in cosmian_kms_server:
- Add the export wrapping with X509 certificate encryption
- Documentation
- tagging: the KMS server now supports user tagging of objects to facilitate their management. Specify as many user tags as needed when creating and importing objects.
In addition, the user server will automatically add a system tag based on the object type:
_sk: for a private key_pk: for a public key_kk: for a symmetric key_uk: for a Covercrypt user decryption key
Use the tags to export objects, locate them, or request data encryption and decryption.
- Added
locateto theckmsclient - Added
Redis-Findexbackend support so that the KMS can encrypt the KMS server data and indexes at the application level. - Added JWE support
- Remove RUSTFLAGS for docker container and python package
- Update sqlx to 0.7 + bitflags and base64-url to version 2
- Support glibc v2.17 when building ckms and cosmian_kms_server
- Incorrect docker tag
- Add description on docker usage
- Added the ability to manipulate EC and Symmetric Keys
- Added ECIES encryption (using Curve 25519) and AES GCM encryption
- Added support for policy specifications
- Reworked Revoke and Destroy to be closer to KMIP definitions
- Revoking and Destroying a public/private key, revokes or destroy all the related keys
- Upgrading of SQLX
- Upgrading of PKCS12 support
- Removal of Eyre in the CLI
- Use of cloudproof_rust as a dependency rather than Covercrypt and Crypto Core directly to avoid version conflicts
- Authentication:
- support for more JWT providers
- support for certificate authentication
- Removal of global static conf and use of proper injection (was hindering testing)
- Authorization: re-factor of endpoints and fix delegation issues around revoke and destroy
- Add link to package.cosmian.com
- Add github ci
- Publish python kms packages
- Refactored the server to simplify traits and separate the operations into smaller files
- Python KMS client (pyo3): export
database_secretandinsecureas parameters
- Update cover crypt in python tests
- Use CoverCrypt v11
- Removed
mysqlcrate used for EdgelessDB (compatible with client SSL connection) - Use workspace dependencies to ease maintenance
- mkdocs-merge could not run with
emoji_indexurl
- Remove unused docker builds
- Improves the installation doc and details the important options
- Makes wording coherent between doc and code
- adds native HTTP/S support by providing certificates
- improves encrypted SQLite support
- removes multiple features on the KMS server and makes them command-line options.
- There is now a single docker (115MB) that covers all cases (except SGX, which will come later)
- removes the use of crypto_base and makes use of cover-crypt 10.0
- Use CoverCrypt v9.0 (post-quantum cryptography) and AbePolicy v3.0
- Write
Policyas bytes andAccessPolicyas string in Vendor Attributes
- Write
- Fix tag matching in
python_publish
- add python interface
- CoverCrypt v9 / CryptoCore v5 / AbePolicy v3.0
- CLI Policy interface (format changed with AbePolicy v2.1)
- add authentication data in header too in encrypt operation
- data to encrypt with CoverCrypt is not a JSON anymore but a custom binary format (
see
DataToEncryptstruct) - decrypted data with CoverCrypt is now a custom binary format (see
DecryptedDatastruct)
- Support
cover_crypt7.1.0
- Rename KMS URL
- Remove AVX flag
- Update
cover_cryptto 7.0.1 - Update crates dependencies
- GPSW support
- TFHE support
- DMCFE support
- Handle CORS request
- Update installation documentation