PD-103 — Agent Developer — Module M11 : capture-kek-keyring¶

let dekClear: Buffer | null = null;
try {
  dekClear = this.unwrapDekInternal(wrappedDek, kekId);
  // ... utilisation du DEK en clair ...
  return dekClear; // transfert de propriete a l'appelant (M9)
} catch (error) {
  if (dekClear) {
    dekClear.fill(0x00);
  }
  throw error; // propagation obligatoire (anti-catch-absorb)
}

// --- kek-keyring.service.ts ---

/** Erreur metier : unwrap DEK echoue (cle non trouvee ou echec crypto) */
export class UnwrapDekFailedError extends Error {
  readonly code = 'UNWRAP_DEK_FAILED';
  readonly httpStatus = 422;
}

/** Erreur metier : service de cle indisponible (Vault/HSM down) */
export class KeyServiceUnavailableError extends Error {
  readonly code = 'KEY_SERVICE_UNAVAILABLE';
  readonly httpStatus = 503;
}

/** Resultat de l'unwrap DEK */
export interface UnwrapDekResult {
  /** DEK en clair (Buffer 32 bytes). L'appelant DOIT zeroizer apres usage. */
  readonly dekClear: Buffer;
  /** kek_id effectivement utilise pour l'unwrap */
  readonly kekIdUsed: string;
}

@Injectable()
export class KekKeyringService implements OnModuleInit {
  /** Charge le keyring depuis Vault/HSM au demarrage */
  async onModuleInit(): Promise<void>;

  /**
   * Unwrappe le DEK via RSA-OAEP-SHA256 en utilisant le keyring.
   * Priorise la cle correspondant a kek_id, puis itere les autres cles du keyring.
   *
   * @throws UnwrapDekFailedError (422) si aucune cle ne peut unwrapper
   * @throws KeyServiceUnavailableError (503) si Vault/HSM est indisponible
   */
  unwrapDek(dekWrappedB64: string, kekId: string): UnwrapDekResult;

  /** Retourne true si le kek_id est present dans le keyring */
  hasKekId(kekId: string): boolean;

  /** Retourne le kek_id de la KEK courante */
  getActiveKekId(): string;

  /** Retourne la profondeur du keyring (nombre de cles chargees) */
  getKeyringDepth(): number;
}

import { Injectable, Logger, OnModuleInit } from '@nestjs/common';
import { ConfigService } from '@nestjs/config';
import {
  createPrivateKey,
  privateDecrypt,
  constants as cryptoConstants,
  KeyObject,
} from 'node:crypto';

const DEFAULT_KEYRING_DEPTH = 3;
const MIN_KEYRING_DEPTH = 1;
const MAX_KEYRING_DEPTH = 10;
const DEK_LENGTH_BYTES = 32;

interface KekEntry {
  readonly kekId: string;
  readonly privateKey: KeyObject;
  readonly isCurrent: boolean;
}

async onModuleInit(): Promise<void> {
  const maxDepth = this.getConfiguredDepth();
  this.logger.log(`Initializing KEK keyring (max depth: ${maxDepth})`);

  let vaultResponse: VaultKekResponse;
  try {
    vaultResponse = await this.loadKeysFromVault();
  } catch (error) {
    this.logger.error(`Failed to load KEK keyring from Vault: ${error.message}`);
    throw new KeyServiceUnavailableError(
      `Cannot initialize KEK keyring: ${error.message}`,
    );
  }

  // Charger la cle courante
  const currentKey = this.parsePrivateKey(vaultResponse.current.pem);
  this.keyring.set(vaultResponse.current.kek_id, {
    kekId: vaultResponse.current.kek_id,
    privateKey: currentKey,
    isCurrent: true,
  });
  this.activeKekId = vaultResponse.current.kek_id;

  // Charger les cles historiques (max N-1 anciennes)
  const previousKeys = (vaultResponse.previous || []).slice(0, maxDepth - 1);
  for (const prev of previousKeys) {
    this.keyring.set(prev.kek_id, {
      kekId: prev.kek_id,
      privateKey: this.parsePrivateKey(prev.pem),
      isCurrent: false,
    });
  }

  this.logger.log(
    `KEK keyring loaded: ${this.keyring.size} keys (active: ${this.activeKekId})`,
  );
}

unwrapDek(dekWrappedB64: string, kekId: string): UnwrapDekResult {
  if (this.keyring.size === 0) {
    throw new KeyServiceUnavailableError('KEK keyring is empty — service not initialized');
  }

  const wrappedDekBuffer = Buffer.from(dekWrappedB64, 'base64');

  // Strategie 1 : essayer la cle correspondant au kek_id fourni
  const primaryEntry = this.keyring.get(kekId);
  if (primaryEntry) {
    const result = this.tryUnwrap(wrappedDekBuffer, primaryEntry);
    if (result) {
      return result;
    }
  }

  // Strategie 2 : iterer les autres cles du keyring (courante en priorite)
  const sortedEntries = this.getSortedEntries(kekId);
  for (const entry of sortedEntries) {
    const result = this.tryUnwrap(wrappedDekBuffer, entry);
    if (result) {
      this.logger.warn(
        `DEK unwrapped with fallback kek_id=${entry.kekId} (requested: ${kekId})`,
      );
      return result;
    }
  }

  // Aucune cle n'a pu unwrapper
  throw new UnwrapDekFailedError(
    `Cannot unwrap DEK: no compatible key found in keyring (requested kek_id=${kekId})`,
  );
}

private tryUnwrap(wrappedDek: Buffer, entry: KekEntry): UnwrapDekResult | null {
  try {
    const dekClear = privateDecrypt(
      {
        key: entry.privateKey,
        padding: cryptoConstants.RSA_PKCS1_OAEP_PADDING,
        oaepHash: 'sha256',
      },
      wrappedDek,
    );

    if (dekClear.length !== DEK_LENGTH_BYTES) {
      // DEK de taille incorrecte apres unwrap — cle incompatible
      dekClear.fill(0x00);
      return null;
    }

    return {
      dekClear,
      kekIdUsed: entry.kekId,
    };
  } catch {
    // Echec cryptographique (padding invalide, cle incompatible) — essayer la suivante
    return null;
  }
}

private getSortedEntries(excludeKekId: string): KekEntry[] {
  const entries: KekEntry[] = [];
  for (const entry of this.keyring.values()) {
    if (entry.kekId !== excludeKekId) {
      entries.push(entry);
    }
  }
  // KEK courante en premier (plus probable)
  entries.sort((a, b) => (b.isCurrent ? 1 : 0) - (a.isCurrent ? 1 : 0));
  return entries;
}

private parsePrivateKey(pem: string): KeyObject {
  try {
    return createPrivateKey({
      key: pem,
      format: 'pem',
      type: 'pkcs8',
    });
  } catch (error) {
    throw new KeyServiceUnavailableError(
      `Invalid RSA private key PEM: ${error.message}`,
    );
  }
}

private async loadKeysFromVault(): Promise<VaultKekResponse> {
  const vaultUrl = this.configService.get<string>('VAULT_URL');
  const vaultToken = this.configService.get<string>('VAULT_TOKEN');
  const vaultPath = this.configService.get<string>(
    'CAPTURE_KEK_VAULT_PATH',
    'kv/data/ci/capture-kek',
  );

  const response = await fetch(`${vaultUrl}/v1/${vaultPath}`, {
    headers: { 'X-Vault-Token': vaultToken },
    signal: AbortSignal.timeout(5000),
  });

  if (!response.ok) {
    throw new Error(`Vault returned ${response.status}: ${response.statusText}`);
  }

  const body = await response.json();
  return body.data.data as VaultKekResponse;
}

interface VaultKekResponse {
  current: { kek_id: string; pem: string };
  previous: Array<{ kek_id: string; pem: string }>;
}

hasKekId(kekId: string): boolean {
  return this.keyring.has(kekId);
}

getActiveKekId(): string {
  if (!this.activeKekId) {
    throw new KeyServiceUnavailableError('KEK keyring not initialized');
  }
  return this.activeKekId;
}

getKeyringDepth(): number {
  return this.keyring.size;
}

private getConfiguredDepth(): number {
  const depth = this.configService.get<number>(
    'CAPTURE_KEK_KEYRING_DEPTH',
    DEFAULT_KEYRING_DEPTH,
  );
  if (depth < MIN_KEYRING_DEPTH || depth > MAX_KEYRING_DEPTH) {
    this.logger.warn(
      `KEK keyring depth ${depth} out of bounds [${MIN_KEYRING_DEPTH},${MAX_KEYRING_DEPTH}], clamping to ${DEFAULT_KEYRING_DEPTH}`,
    );
    return DEFAULT_KEYRING_DEPTH;
  }
  return depth;
}

// Dans CaptureIngestService (M9)
try {
  const { dekClear, kekIdUsed } = this.kekKeyringService.unwrapDek(
    dto.dekWrappedB64,
    dto.kekId,
  );

  try {
    // Utiliser dekClear pour dechiffrer/verifier si necessaire
    // ... persistance capture_events ...
  } finally {
    // Zeroization obligatoire (CLAUDE.md regles crypto PD-242)
    dekClear.fill(0x00);
  }
} catch (error) {
  if (error instanceof UnwrapDekFailedError) {
    throw new HttpException(
      { code: 'UNWRAP_DEK_FAILED', message: error.message },
      422,
    );
  }
  if (error instanceof KeyServiceUnavailableError) {
    throw new HttpException(
      { code: 'KEY_SERVICE_UNAVAILABLE', message: error.message },
      503,
    );
  }
  throw error;
}

// Fixture de test : generation de paire RSA pour keyring mock
import { generateKeyPairSync, publicEncrypt, constants } from 'node:crypto';

function generateTestKekPair(kekId: string) {
  const { publicKey, privateKey } = generateKeyPairSync('rsa', {
    modulusLength: 2048,
    publicKeyEncoding: { type: 'spki', format: 'pem' },
    privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
  });
  return { kekId, publicKeyPem: publicKey, privateKeyPem: privateKey };
}

function wrapDekForTest(dek: Buffer, publicKeyPem: string): string {
  const wrapped = publicEncrypt(
    {
      key: publicKeyPem,
      padding: constants.RSA_PKCS1_OAEP_PADDING,
      oaepHash: 'sha256',
    },
    dek,
  );
  return wrapped.toString('base64');
}