Skip to content

Feat/crypto jwe api#929

Open
HatemMn wants to merge 19 commits into
developfrom
feat/crypto_JWE_api
Open

Feat/crypto jwe api#929
HatemMn wants to merge 19 commits into
developfrom
feat/crypto_JWE_api

Conversation

@HatemMn
Copy link
Copy Markdown
Contributor

@HatemMn HatemMn commented Apr 24, 2026

JOSE stands for JSON Object Signing and Encryption.
It groups together 4 core RFCs:

  1. JWS (RFC 7515) : signing
  2. JWE (RFC 7516) : encryption
  3. JWK (RFC 7517) : key representation
  4. JWA (RFC 7518) : algorithm identifiers

Another document will be followed: RFC 7519 - which sits on top of JOSE - it uses the JOSE Header and JOSE cryptographic operations, but adds the concept of claims.

In depth details are cited in the related issue : https://github.com/Cosmian/kms/issues/

How this was implemented :

First layer : crate/server/src/start_kms_server.rs

let crypto_scope = web::scope("/v1/crypto")
    .wrap(EnsureAuth::new(...))   // same auth middleware as KMIP
    .service(encrypt_handler)
    .service(decrypt_handler)
    .service(sign_handler)
    .service(verify_handler)
    .service(mac_handler);
app = app.service(crypto_scope);

The new API was registred the same way as other APIs such as CSE, DKE, etc.

Second layer : Hanlers, routes/crypto/*.rs

Each of these handlers :
Each handler does three things, nothing more:

  1. Parses the JOSE request: decode base64url fields, extract alg/enc/kid from the protected header or request body
  2. Convert JOSE identifiers to a KMIP operation struct
  3. Forwards the call the its KMIP counterpart

Third layer : translation

This is the only new logic.
The KMS doesn't know what "ES256" is, or what a JOSE alg is. The file crate/server/src/routes/crypto/algorithm.rs translates the JOSE specs to a KMIP struct

Final layers : KMS Core

Nothing fundamental changes withing the KMS or crypto ops. Most the other diffs are wiring and plumbing and error handling (according to the request in the issue)

Closes #868

@HatemMn HatemMn self-assigned this Apr 24, 2026
@HatemMn HatemMn linked an issue Apr 24, 2026 that may be closed by this pull request
@HatemMn HatemMn marked this pull request as ready for review April 29, 2026 11:16
@HatemMn HatemMn force-pushed the feat/crypto_JWE_api branch from 20c6cab to 36c6d69 Compare April 30, 2026 16:50
@Manuthor Manuthor force-pushed the feat/crypto_JWE_api branch 2 times, most recently from 26bf912 to ce5326e Compare May 21, 2026 19:07
HatemMn and others added 17 commits May 22, 2026 16:04
This reverts commit bba8366.
…ypto routes

Replace string-typed algorithm fields with typed enums (JoseAlgorithm,
JoseEncAlgorithm) across all /v1/crypto route handlers. Invalid algorithm
values are now rejected at serde deserialization time (400 Bad Request)
instead of at handler level (422).

- Add JoseAlgorithm enum: Dir, RS256..512, PS256..512, ES256..512,
  HS256..512, EdDSA (non-fips), MLDSA44 (non-fips)
- Add JoseEncAlgorithm enum: A128GCM, A192GCM, A256GCM
- Convert jose_to_kmip_params and all helpers to pattern matching
- Add custom JsonConfig error handler for consistent JSON error bodies
- Update unit tests and bash test expectations (422 -> 400)
@Manuthor Manuthor force-pushed the feat/crypto_JWE_api branch from ce5326e to e697ea6 Compare May 22, 2026 14:09
Manuthor added 2 commits May 22, 2026 18:49
- POST /v1/crypto/keys: generate symmetric (oct), RSA, EC, OKP keys
- DELETE /v1/crypto/keys/{kid}: revoke + destroy with cascade
- Rewrite jose_vectors.rs as generic auto-discovery test runner
- Migrate test vectors: key_spec -> key (JWK request format)
- Add pre-computed signing input to rfc7520_s4_4 KAT vector
- Update REST crypto API documentation
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

JOSE - REST native crypto API

2 participants