AES encryption pkcs11

[JimmyTab]

Is it possible to encrypt layers via AES symmetric secret keys stored in a pkcs11 interface?

[stefanberger]

Is it possible to encrypt layers via AES symmetric secret keys stored in a pkcs11 interface?

You would need a public key stored in a pkcs11 device that is used to unwrap an AES key. It doesn't work with an AES symmetric key directly.

[JimmyTab]

does OCIcrypt provide that implementation or is that additional commands to implement myself.

[stefanberger]

does OCIcrypt provide that implementation or is that additional commands to implement myself.

You would have to implement this particular unwrapping method yourself.

Does the Pkcs11 device release the AES key and pass it to you so you can decrypt/encrypt the layers on the host or do you intend to possibly stream GB of data back and forth between the ocicrypt host and the device (AES key protected inside the device)? For key-wrapping with asymmetric keys we already have the pkcs11 support, but as I said, it requires for example an RSA key in the HSM and it can unwrap an AES key.

The OCIcrypto keyprovider support interface is defined here: https://github.com/containers/ocicrypt/tree/main/keywrap/keyprovider

An external keyprovider would be able to unwrap the key. An example of such a key provider GRPC server is here (use by imgcrypt for test cases): https://github.com/lumjjb/simple-ocicrypt-keyprovider

[JimmyTab]

the pkcs11 device would ideally not be extracting the key and encrypting/decrypting the image layers between the ocicrypt host and the device. To clarify, you are saying this is possible but would be have to be implemented through a key provider ?

[stefanberger]

To clarify, you are saying this is possible but would be have to be implemented through a key provider ?

I think so, yes.

The current pkcs11 support wraps/unwraps an AES key with an RSA key using OAEP. Maybe it could be extended to detect what kind of key the pkcs11 URI represents in the HSM and be extended to unwrap an AES key with an AES key using AES-KW.

[JimmyTab]

the current pkcs11 support where AES key is wrapped/unwrapped with a RSA key... is the unwrapped AES key then used for decryption/encryption of the image layers? If so that is what I would like to implement... currently I have https://github.com/containers/ocicrypt/blob/main/docs/pkcs11.md this implementation using pkcs11 and an asymmetric RSA key working to decrypt/encrypt image layers. How do i extend that so It unwraps my AES key that will subsequently decrypt ?

Are there any plans to add the functionality be able to directly call a symmetric key for encryption through the pkcs11 uri?

[stefanberger]

the current pkcs11 support where AES key is wrapped/unwrapped with a RSA key... is the unwrapped AES key then used for decryption/encryption of the image layers? If so that is what I would like to implement...

Yes, that's what the pkcs11 support already does.

The unwrapping of the layer encryption AES key with the RSA key is implemented here (line 94 does the actual unwrapping):

ocicrypt/keywrap/pkcs11/keywrapper_pkcs11.go

Lines 64 to 100 in d808399

	func (kw *pkcs11KeyWrapper) UnwrapKey(dc *config.DecryptConfig, jsonString []byte) ([]byte, error) {
	var pkcs11PrivKeys []*pkcs11.Pkcs11KeyFileObject
	privKeys := kw.GetPrivateKeys(dc.Parameters)
	if len(privKeys) == 0 {
	return nil, errors.New("No private keys found for PKCS11 decryption")
	}
	p11conf, err := p11confFromParameters(dc.Parameters)
	if err != nil {
	return nil, err
	}
	for _, privKey := range privKeys {
	key, err := utils.ParsePrivateKey(privKey, nil, "PKCS11")
	if err != nil {
	return nil, err
	}
	switch pkcs11PrivKey := key.(type) {
	case *pkcs11.Pkcs11KeyFileObject:
	if p11conf != nil {
	pkcs11PrivKey.Uri.SetModuleDirectories(p11conf.ModuleDirectories)
	pkcs11PrivKey.Uri.SetAllowedModulePaths(p11conf.AllowedModulePaths)
	}
	pkcs11PrivKeys = append(pkcs11PrivKeys, pkcs11PrivKey)
	default:
	continue
	}
	}
	plaintext, err := pkcs11.Decrypt(pkcs11PrivKeys, jsonString)
	if err == nil {
	return plaintext, nil
	}
	return nil, fmt.Errorf("PKCS11: No suitable private key found for decryption: %w", err)
	}

The low level RSA OAEP decryption operation is here:

ocicrypt/crypto/pkcs11/pkcs11helpers.go

Line 310 in d808399

func privateDecryptOAEP(privKeyObj *Pkcs11KeyFileObject, ciphertext []byte, hashalg string) ([]byte, error) {

Are there any plans to add the functionality be able to directly call a symmetric key for encryption through the pkcs11 uri?

I have no plans for this and I am also not sure what you are missing in the current implementation.

[JimmyTab]

Okay cool, so when I use the pkcs11 interface for dec/enc it currently already wraps/unwraps an AES key which then encrypts/decrypts correct? apologies i thought the rsa key was directly enc/dec the image layers... is the wrapped AES key embedded in the image layers and only unwrapped by the RSA key in a HSM?

btw thanks for the quick responses and helping me with questions !

[stefanberger]

Okay cool, so when I use the pkcs11 interface for dec/enc it currently already wraps/unwraps an AES key which then encrypts/decrypts correct? apologies i thought the rsa key was directly enc/dec the image layers... is the wrapped AES key embedded in the image layers and only unwrapped by the RSA key in a HSM?

An image (layer) may have multiple recipients and each recipient is expected to have a private (RSA) key used for decrypting his/her designated encrypted data that, among a few other things, contain the symmetric key for decryption of a particular layer. All recipients will use the same AES key to decrypt a particular layer.

btw thanks for the quick responses and helping me with questions !

You are welcome.

[JimmyTab]

okay I think I understand now. And if I want to alter the operation used(changing from symmetric AES for whatever reason), I need to add a config file as per The settings/parameters to these functions can be specified via creation of an encryption config with the github.com/containers/ocicrypt/config package. We note that because setting of annotations and other fields of the layer descriptor is done through various means in different runtimes/build tools, it is the responsibility of the caller to still ensure that the layer descriptor follows the OCI specification (i.e. encoding, setting annotations, etc.). .. under config and rebuild ocicrypt ?

[stefanberger]

Since ocicrypt supports multiple different types of encryption technologies you have to provide the parameters for the one you would want use by using the function calls in this file here for example: https://github.com/containers/ocicrypt/blob/main/config/constructors.go

Have a look at this function here that calls these constructors from the parameters the user provided on the command line: https://github.com/containerd/imgcrypt/blob/main/images/encryption/parsehelpers/parsehelpers.go#L229

[JimmyTab]

If i wanted to change the underlying encryption scheme from AESCTR256 is that possible? Say If I wanted to use AESGCM is there a possible way to add that parameter or do I add that to the source file and rebuild.

[stefanberger]

You would have to change the sources (possibly with backwards compatibility in mind). The code does not allow you to configure this particular crypto algorithm with parameters passed in from the command line.

[JimmyTab]

ocicrypt/blockcipher/blockcipher.go

Line 37 in d808399

type PrivateLayerBlockCipherOptions struct {

, and where would I find this information which is added in the layers to confirm the encryption occurs on an image layer? and to confirm.. if we wanted to use AESGCM this would need to be an additional Go implementation to the code base correct.