diff --git a/spring-vault-core/src/main/java/org/springframework/vault/core/VaultTransitTemplate.java b/spring-vault-core/src/main/java/org/springframework/vault/core/VaultTransitTemplate.java index 19fd9893..c9586579 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/core/VaultTransitTemplate.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/core/VaultTransitTemplate.java @@ -439,6 +439,8 @@ public class VaultTransitTemplate implements VaultTransitOperations { @Data static class VaultTransitKeyImpl implements VaultTransitKey { + private String name; + @JsonProperty("cipher_mode") private String cipherMode; @@ -460,7 +462,20 @@ public class VaultTransitTemplate implements VaultTransitOperations { @JsonProperty("min_decryption_version") private int minDecryptionVersion; - private String name; + @JsonProperty("min_encryption_version") + private int minEncryptionVersion; + + @JsonProperty("supports_decryption") + private boolean supportsDecryption; + + @JsonProperty("supports_encryption") + private boolean supportsEncryption; + + @JsonProperty("supports_derivation") + private boolean supportsDerivation; + + @JsonProperty("supports_signing") + private boolean supportsSigning; @Override public String getType() { @@ -471,6 +486,26 @@ public class VaultTransitTemplate implements VaultTransitOperations { return this.cipherMode; } + + @Override + public boolean supportsDecryption() { + return isSupportsDecryption(); + } + + @Override + public boolean supportsEncryption() { + return isSupportsEncryption(); + } + + @Override + public boolean supportsDerivation() { + return isSupportsDerivation(); + } + + @Override + public boolean supportsSigning() { + return isSupportsSigning(); + } } @Data diff --git a/spring-vault-core/src/main/java/org/springframework/vault/support/VaultTransitKey.java b/spring-vault-core/src/main/java/org/springframework/vault/support/VaultTransitKey.java index 0d435080..026795bf 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/support/VaultTransitKey.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/support/VaultTransitKey.java @@ -25,6 +25,16 @@ import java.util.Map; */ public interface VaultTransitKey { + /** + * @return name of the key + */ + String getName(); + + /** + * @return the key type ({@code aes-gcm}, {@code ecdsa-p256}, ...). + */ + String getType(); + /** * @return {@literal true} if deletion of the key is allowed. Key deletion must be * turned on to make keys deletable. @@ -57,12 +67,32 @@ public interface VaultTransitKey { int getMinDecryptionVersion(); /** - * @return name of the key + * @return required key version to encrypt data. + * @since 1.1 */ - String getName(); + int getMinEncryptionVersion(); /** - * @return the key type ({@code aes-gcm}, {@code ecdsa-p256}, ...). + * @return whether the key supports decryption. + * @since 1.1 */ - String getType(); + boolean supportsDecryption(); + + /** + * @return whether the key supports encryption. + * @since 1.1 + */ + boolean supportsEncryption(); + + /** + * @return whether the key supports derivation. + * @since 1.1 + */ + boolean supportsDerivation(); + + /** + * @return whether the key supports signing. + * @since 1.1 + */ + boolean supportsSigning(); } diff --git a/spring-vault-core/src/main/java/org/springframework/vault/support/VaultTransitKeyConfiguration.java b/spring-vault-core/src/main/java/org/springframework/vault/support/VaultTransitKeyConfiguration.java index 53267d38..cb7e0d95 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/support/VaultTransitKeyConfiguration.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/support/VaultTransitKeyConfiguration.java @@ -1,5 +1,5 @@ /* - * Copyright 2016 the original author or authors. + * Copyright 2016-2017 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -30,9 +30,19 @@ public class VaultTransitKeyConfiguration { @JsonProperty("latest_version") private final Integer latestVersion; - private VaultTransitKeyConfiguration(Boolean deletionAllowed, Integer latestVersion) { + @JsonProperty("min_decryption_version") + private final Integer minDecryptionVersion; + + @JsonProperty("min_encryption_version") + private final Integer minEncryptionVersion; + + private VaultTransitKeyConfiguration(Boolean deletionAllowed, Integer latestVersion, + Integer minDecryptionVersion, Integer minEncryptionVersion) { + this.deletionAllowed = deletionAllowed; this.latestVersion = latestVersion; + this.minDecryptionVersion = minDecryptionVersion; + this.minEncryptionVersion = minEncryptionVersion; } /** @@ -51,11 +61,30 @@ public class VaultTransitKeyConfiguration { /** * @return latest key version + * @deprecated since 1.1, property does not exist. */ + @Deprecated public Integer getLatestVersion() { return latestVersion; } + /** + * @return the minimum version of ciphertext allowed to be decrypted. + * @since 1.1 + */ + public Integer getMinDecryptionVersion() { + return minDecryptionVersion; + } + + /** + * @return the minimum version of the key that can be used to encrypt plaintext, sign + * payloads, or generate HMACs. + * @since 1.1 + */ + public Integer getMinEncryptionVersion() { + return minEncryptionVersion; + } + /** * Builder for {@link VaultTransitKeyConfiguration}. */ @@ -65,6 +94,10 @@ public class VaultTransitKeyConfiguration { private Integer latestVersion; + private Integer minDecryptionVersion; + + private Integer minEncryptionVersion; + VaultTransitKeyConfigurationBuilder() { } @@ -84,19 +117,55 @@ public class VaultTransitKeyConfiguration { * * @param latestVersion key version. * @return {@code this} {@link VaultTransitKeyConfigurationBuilder}. + * @deprecated since 1.1, property does not exist. */ + @Deprecated public VaultTransitKeyConfigurationBuilder latestVersion(int latestVersion) { this.latestVersion = latestVersion; return this; } + /** + * Specifies the minimum version of ciphertext allowed to be decrypted. Adjusting + * this as part of a key rotation policy can prevent old copies of ciphertext from + * being decrypted, should they fall into the wrong hands. For signatures, this + * value controls the minimum version of signature that can be verified against. + * For HMACs, this controls the minimum version of a key allowed to be used as the + * key for verification. + * + * @param minDecryptionVersion key version. + * @return {@code this} {@link VaultTransitKeyConfigurationBuilder}. + * @since 1.1 + */ + public VaultTransitKeyConfigurationBuilder minDecryptionVersion( + int minDecryptionVersion) { + this.minDecryptionVersion = minDecryptionVersion; + return this; + } + + /** + * Specifies the minimum version of the key that can be used to encrypt plaintext, + * sign payloads, or generate HMACs. Must be 0 (which will use the latest version) + * or a value greater or equal to {@link #minDecryptionVersion(int)}. + * + * @param minEncryptionVersion key version. + * @return {@code this} {@link VaultTransitKeyConfigurationBuilder}. + * @since 1.1 + */ + public VaultTransitKeyConfigurationBuilder minEncryptionVersion( + int minEncryptionVersion) { + this.minEncryptionVersion = minEncryptionVersion; + return this; + } + /** * Build a new {@link VaultTransitKeyConfiguration} instance. * * @return a new {@link VaultTransitKeyConfiguration}. */ public VaultTransitKeyConfiguration build() { - return new VaultTransitKeyConfiguration(deletionAllowed, latestVersion); + return new VaultTransitKeyConfiguration(deletionAllowed, latestVersion, + minDecryptionVersion, minEncryptionVersion); } } } diff --git a/spring-vault-core/src/test/java/org/springframework/vault/core/VaultTransitTemplateIntegrationTests.java b/spring-vault-core/src/test/java/org/springframework/vault/core/VaultTransitTemplateIntegrationTests.java index 3fd647ab..4858c012 100644 --- a/spring-vault-core/src/test/java/org/springframework/vault/core/VaultTransitTemplateIntegrationTests.java +++ b/spring-vault-core/src/test/java/org/springframework/vault/core/VaultTransitTemplateIntegrationTests.java @@ -60,6 +60,8 @@ public class VaultTransitTemplateIntegrationTests extends IntegrationTestSupport private VaultOperations vaultOperations; private VaultTransitOperations transitOperations; + private Version vaultVersion; + @Before public void before() { @@ -69,6 +71,8 @@ public class VaultTransitTemplateIntegrationTests extends IntegrationTestSupport vaultOperations.opsForSys().mount("transit", VaultMount.create("transit")); } + vaultVersion = prepare().getVersion(); + removeKeys(); } @@ -121,6 +125,14 @@ public class VaultTransitTemplateIntegrationTests extends IntegrationTestSupport assertThat(mykey.isDerived()).isFalse(); assertThat(mykey.getMinDecryptionVersion()).isEqualTo(1); assertThat(mykey.isLatestVersion()).isTrue(); + + if (vaultVersion.isGreaterThanOrEqualTo(Version.parse("0.7.0"))) { + + assertThat(mykey.supportsDecryption()).isTrue(); + assertThat(mykey.supportsEncryption()).isTrue(); + assertThat(mykey.supportsDerivation()).isTrue(); + assertThat(mykey.supportsSigning()).isFalse(); + } } @Test @@ -142,6 +154,31 @@ public class VaultTransitTemplateIntegrationTests extends IntegrationTestSupport assertThat(mykey.isLatestVersion()).isTrue(); } + @Test + public void shouldConfigureKey() { + + transitOperations.createKey("mykey"); + transitOperations.rotate("mykey"); + transitOperations.rotate("mykey"); + + VaultTransitKeyConfiguration configuration = VaultTransitKeyConfiguration + .builder().deletionAllowed(true).minDecryptionVersion(1) + .minEncryptionVersion(2).build(); + + transitOperations.configureKey("mykey", configuration); + + VaultTransitKey mykey = transitOperations.getKey("mykey"); + + assertThat(mykey.getMinDecryptionVersion()).isEqualTo(1); + + if (vaultVersion.isGreaterThanOrEqualTo(Version.parse("0.8.0"))) { + assertThat(mykey.getMinEncryptionVersion()).isEqualTo(2); + } + else { + assertThat(mykey.getMinEncryptionVersion()).isEqualTo(0); + } + } + @Test public void shouldEnumerateKey() {