Merge branch 'master' into master

gogit · Nov 25, 2019 · 0bfc6dc · 0bfc6dc
2 parents 7eb7ec5 + e09cd45
commit 0bfc6dc
Show file tree

Hide file tree

Showing 39 changed files with 1,369 additions and 182 deletions.
diff --git a/WORKSPACE b/WORKSPACE
@@ -292,20 +292,20 @@ apple_support_dependencies()
 http_archive(
     name = "io_bazel_rules_go",
     urls = [
-        "https://storage.googleapis.com/bazel-mirror/github.com/bazelbuild/rules_go/releases/download/v0.20.0/rules_go-v0.20.0.tar.gz",
-        "https://github.com/bazelbuild/rules_go/releases/download/v0.20.0/rules_go-v0.20.0.tar.gz",
+        "https://storage.googleapis.com/bazel-mirror/github.com/bazelbuild/rules_go/releases/download/v0.20.2/rules_go-v0.20.2.tar.gz",
+        "https://github.com/bazelbuild/rules_go/releases/download/v0.20.2/rules_go-v0.20.2.tar.gz",
     ],
-    sha256 = "078f2a9569fa9ed846e60805fb5fb167d6f6c4ece48e6d409bf5fb2154eaf0d8",
+    sha256 = "b9aa86ec08a292b97ec4591cf578e020b35f98e12173bbd4a921f84f583aebd9",
 )
 
 # Release from 2019-10-14
 http_archive(
     name = "bazel_gazelle",
     urls = [
-        "https://storage.googleapis.com/bazel-mirror/github.com/bazelbuild/bazel-gazelle/releases/download/v0.19.0/bazel-gazelle-v0.19.0.tar.gz",
-        "https://github.com/bazelbuild/bazel-gazelle/releases/download/v0.19.0/bazel-gazelle-v0.19.0.tar.gz",
+        "https://storage.googleapis.com/bazel-mirror/github.com/bazelbuild/bazel-gazelle/releases/download/v0.19.1/bazel-gazelle-v0.19.1.tar.gz",
+        "https://github.com/bazelbuild/bazel-gazelle/releases/download/v0.19.1/bazel-gazelle-v0.19.1.tar.gz",
     ],
-    sha256 = "41bff2a0b32b02f20c227d234aa25ef3783998e5453f7eade929704dcff7cd4b",
+    sha256 = "86c6d481b3f7aedc1d60c1c211c6f76da282ae197c3b3160f54bd3a8f847896f",
 )
 
 load("@io_bazel_rules_go//go:deps.bzl", "go_rules_dependencies", "go_register_toolchains")
@@ -337,8 +337,8 @@ go_repository(
 go_repository(
     name = "com_github_aws_aws_sdk_go",
     importpath = "github.com/aws/aws-sdk-go",
-    sum = "h1:k7Fy6T/uNuLX6zuayU/TJoP7yMgGcJSkZpF7QVjwYpA=",
-    version = "v1.25.16",
+    sum = "h1:1xxya3nsUaFlEZuoE5PWsIEd47RoDV/kkOGt0qEuwNw=",
+    version = "v1.25.39",
 )
 
 go_repository(
@@ -491,8 +491,8 @@ go_repository(
 go_repository(
     name = "org_golang_google_api",
     importpath = "google.golang.org/api",
-    sum = "h1:n/qM3q0/rV2F0pox7o0CvNhlPvZAo7pLbef122cbLJ0=",
-    version = "v0.11.0",
+    sum = "h1:uMf5uLi4eQMRrMKhCplNik4U4H8Z6C1br3zOtAa/aDE=",
+    version = "v0.14.0",
 )
 
 go_repository(
@@ -519,8 +519,8 @@ go_repository(
 go_repository(
     name = "org_golang_x_crypto",
     importpath = "golang.org/x/crypto",
-    sum = "h1:ObdrDkeb4kJdCP557AjRjq69pTHfNouLtWZG7j9rPN8=",
-    version = "v0.0.0-20191011191535-87dc89f01550",
+    sum = "h1:9bFeDpN3gTqNanMVqNcoR/pJQuP5uroC3t1D7eXozTE=",
+    version = "v0.0.0-20191119213627-4f8c1d86b1ba",
 )
 
 go_repository(
@@ -606,9 +606,14 @@ http_archive(
     ],
 )
 
-load("@io_bazel_rules_closure//closure:repositories.bzl",
-     "rules_closure_dependencies", "rules_closure_toolchains")
+load(
+    "@io_bazel_rules_closure//closure:repositories.bzl",
+    "rules_closure_dependencies",
+    "rules_closure_toolchains",
+)
+
 rules_closure_dependencies()
+
 rules_closure_toolchains()
 
 #-----------------------------------------------------------------------------
@@ -652,3 +657,4 @@ load("@bazel_toolchains//rules:rbe_repo.bzl", "rbe_autoconfig")
 # Use this as is if you are using the rbe_ubuntu16_04 container,
 # otherwise refer to RBE docs.
 rbe_autoconfig(name = "rbe_default")
+
diff --git a/cc/core/primitive_set_test.cc b/cc/core/primitive_set_test.cc
@@ -18,6 +18,7 @@
 
 #include <thread>  // NOLINT(build/c++11)
 
+#include "gmock/gmock.h"
 #include "gtest/gtest.h"
 #include "tink/crypto_format.h"
 #include "tink/mac.h"
@@ -26,10 +27,11 @@
 #include "proto/tink.pb.h"
 
 using ::crypto::tink::test::DummyMac;
+using ::crypto::tink::test::IsOk;
 using ::google::crypto::tink::Keyset;
 using ::google::crypto::tink::KeyStatusType;
 using ::google::crypto::tink::OutputPrefixType;
-using ::crypto::tink::test::IsOk;
+using ::testing::UnorderedElementsAreArray;
 
 namespace crypto {
 namespace tink {
@@ -206,10 +208,12 @@ TEST_F(PrimitiveSetTest, Basic) {
     EXPECT_EQ(DummyMac(mac_name_4).ComputeMac(data).ValueOrDie(),
               primitives[0]->get_primitive().ComputeMac(data).ValueOrDie());
     EXPECT_EQ(KeyStatusType::ENABLED, primitives[0]->get_status());
+    EXPECT_EQ(key_4.key_id(), primitives[0]->get_key_id());
     EXPECT_EQ(OutputPrefixType::RAW, primitives[0]->get_output_prefix_type());
     EXPECT_EQ(DummyMac(mac_name_5).ComputeMac(data).ValueOrDie(),
               primitives[1]->get_primitive().ComputeMac(data).ValueOrDie());
     EXPECT_EQ(KeyStatusType::ENABLED, primitives[1]->get_status());
+    EXPECT_EQ(key_5.key_id(), primitives[1]->get_key_id());
     EXPECT_EQ(OutputPrefixType::RAW, primitives[1]->get_output_prefix_type());
   }
 
@@ -220,10 +224,12 @@ TEST_F(PrimitiveSetTest, Basic) {
     EXPECT_EQ(DummyMac(mac_name_1).ComputeMac(data).ValueOrDie(),
               primitives[0]->get_primitive().ComputeMac(data).ValueOrDie());
     EXPECT_EQ(KeyStatusType::ENABLED, primitives[0]->get_status());
+    EXPECT_EQ(key_1.key_id(), primitives[0]->get_key_id());
     EXPECT_EQ(OutputPrefixType::TINK, primitives[0]->get_output_prefix_type());
     EXPECT_EQ(DummyMac(mac_name_6).ComputeMac(data).ValueOrDie(),
               primitives[1]->get_primitive().ComputeMac(data).ValueOrDie());
     EXPECT_EQ(KeyStatusType::ENABLED, primitives[1]->get_status());
+    EXPECT_EQ(key_1.key_id(), primitives[1]->get_key_id());
     EXPECT_EQ(OutputPrefixType::TINK, primitives[1]->get_output_prefix_type());
   }
 
@@ -234,6 +240,7 @@ TEST_F(PrimitiveSetTest, Basic) {
     EXPECT_EQ(DummyMac(mac_name_3).ComputeMac(data).ValueOrDie(),
               primitives[0]->get_primitive().ComputeMac(data).ValueOrDie());
     EXPECT_EQ(KeyStatusType::ENABLED, primitives[0]->get_status());
+    EXPECT_EQ(key_3.key_id(), primitives[0]->get_key_id());
     EXPECT_EQ(OutputPrefixType::TINK, primitives[0]->get_output_prefix_type());
   }
 
@@ -244,6 +251,7 @@ TEST_F(PrimitiveSetTest, Basic) {
     EXPECT_EQ(DummyMac(mac_name_2).ComputeMac(data).ValueOrDie(),
               primitives[0]->get_primitive().ComputeMac(data).ValueOrDie());
     EXPECT_EQ(KeyStatusType::ENABLED, primitives[0]->get_status());
+    EXPECT_EQ(key_2.key_id(), primitives[0]->get_key_id());
     EXPECT_EQ(OutputPrefixType::LEGACY,
               primitives[0]->get_output_prefix_type());
   }
@@ -367,6 +375,66 @@ TEST_F(PrimitiveSetTest, DisabledKey) {
   EXPECT_FALSE(add_primitive_result.ok());
 }
 
+Keyset::Key CreateKey(uint32_t key_id,
+                      google::crypto::tink::OutputPrefixType output_prefix_type,
+                      google::crypto::tink::KeyStatusType key_status) {
+  Keyset::Key key;
+  key.set_output_prefix_type(output_prefix_type);
+  key.set_key_id(key_id);
+  key.set_status(key_status);
+  return key;
+}
+
+TEST_F(PrimitiveSetTest, GetAll) {
+  PrimitiveSet<Mac> pset;
+  EXPECT_THAT(pset.AddPrimitive(absl::make_unique<DummyMac>("MAC1"),
+                                CreateKey(0x01010101, OutputPrefixType::TINK,
+                                          KeyStatusType::ENABLED))
+                  .status(),
+              IsOk());
+
+  EXPECT_THAT(pset.AddPrimitive(absl::make_unique<DummyMac>("MAC2"),
+                                CreateKey(0x02020202, OutputPrefixType::TINK,
+                                          KeyStatusType::ENABLED))
+                  .status(),
+              IsOk());
+  // Add primitive and make it primary.
+  auto entry_or = pset.AddPrimitive(
+      absl::make_unique<DummyMac>("MAC3"),
+      CreateKey(0x02020202, OutputPrefixType::TINK, KeyStatusType::ENABLED));
+  ASSERT_THAT(entry_or.status(), IsOk());
+  EXPECT_THAT(pset.set_primary(entry_or.ValueOrDie()), IsOk());
+
+  EXPECT_THAT(pset.AddPrimitive(absl::make_unique<DummyMac>("MAC4"),
+                                CreateKey(0x02020202, OutputPrefixType::RAW,
+                                          KeyStatusType::ENABLED))
+                  .status(),
+              IsOk());
+
+  EXPECT_THAT(pset.AddPrimitive(absl::make_unique<DummyMac>("MAC5"),
+                                CreateKey(0x01010101, OutputPrefixType::TINK,
+                                          KeyStatusType::ENABLED))
+                  .status(),
+              IsOk());
+
+  std::vector<std::pair<std::string, std::string>> mac_and_id;
+  for (auto* entry : pset.get_all()) {
+    auto mac_or = entry->get_primitive().ComputeMac("");
+    ASSERT_THAT(mac_or.status(), IsOk());
+    mac_and_id.push_back({mac_or.ValueOrDie(), entry->get_identifier()});
+  }
+
+  // In the following id part, the first byte is 1 for Tink.
+  std::vector<std::pair<std::string, std::string>> expected_result = {
+      {"13:0:DummyMac:MAC1", absl::StrCat("\1\1\1\1\1")},
+      {"13:0:DummyMac:MAC2", absl::StrCat("\1\2\2\2\2")},
+      {"13:0:DummyMac:MAC3", absl::StrCat("\1\2\2\2\2")},
+      {"13:0:DummyMac:MAC4", absl::StrCat("")},
+      {"13:0:DummyMac:MAC5", absl::StrCat("\1\1\1\1\1")}};
+
+  EXPECT_THAT(mac_and_id, UnorderedElementsAreArray(expected_result));
+}
+
 }  // namespace
 }  // namespace tink
 }  // namespace crypto
diff --git a/cc/prf/BUILD.bazel b/cc/prf/BUILD.bazel
@@ -25,6 +25,33 @@ cc_library(
     ],
 )
 
+cc_library(
+    name = "prf_config",
+    srcs = ["prf_config.cc"],
+    hdrs = ["prf_config.h"],
+    include_prefix = "tink",
+    strip_include_prefix = "/cc",
+    deps = [
+        ":hkdf_prf_key_manager",
+        "//cc:registry",
+        "//cc/util:status",
+        "//proto:tink_cc_proto",
+    ],
+)
+
+cc_library(
+    name = "prf_key_templates",
+    srcs = ["prf_key_templates.cc"],
+    hdrs = ["prf_key_templates.h"],
+    include_prefix = "tink",
+    strip_include_prefix = "/cc",
+    deps = [
+        ":hkdf_prf_key_manager",
+        "//proto:hkdf_prf_cc_proto",
+        "//proto:tink_cc_proto",
+    ],
+)
+
 cc_test(
     name = "hkdf_prf_key_manager_test",
     srcs = ["hkdf_prf_key_manager_test.cc"],
@@ -38,3 +65,14 @@ cc_test(
         "@com_google_googletest//:gtest_main",
     ],
 )
+
+cc_test(
+    name = "prf_key_templates_test",
+    srcs = ["prf_key_templates_test.cc"],
+    deps = [
+        ":hkdf_prf_key_manager",
+        ":prf_key_templates",
+        "//cc/util:test_matchers",
+        "@com_google_googletest//:gtest_main",
+    ],
+)
diff --git a/cc/prf/CMakeLists.txt b/cc/prf/CMakeLists.txt
@@ -20,6 +20,29 @@ tink_cc_library(
     tink::proto::tink_cc_proto
 )
 
+tink_cc_library(
+  NAME prf_config
+  SRCS
+    prf_config.cc
+    prf_config.h
+  DEPS
+    tink::prf::hkdf_prf_key_manager
+    tink::core::registry
+    tink::util::status
+    tink::proto::tink_cc_proto
+)
+
+tink_cc_library(
+  NAME prf_key_templates
+  SRCS
+    prf_key_templates.h
+    prf_key_templates.cc
+  DEPS
+    tink::prf::hkdf_prf_key_manager
+    tink::proto::hkdf_prf_cc_proto
+    tink::proto::tink_cc_proto
+)
+
 tink_cc_test(
   NAME hkdf_prf_key_manager_test
   SRCS hkdf_prf_key_manager_test.cc
@@ -34,3 +57,14 @@ tink_cc_test(
     tink::proto::common_cc_proto
     gmock
 )
+
+tink_cc_test(
+  NAME prf_key_templates_test
+  SRCS prf_key_templates_test.cc
+  DEPS
+    tink::prf::hkdf_prf_key_manager
+    tink::prf::prf_key_templates
+    tink::util::test_matchers
+    gmock
+)
+
diff --git a/cc/prf/hkdf_prf_key_manager.h b/cc/prf/hkdf_prf_key_manager.h
@@ -108,8 +108,11 @@ class HkdfPrfKeyManager
     return crypto::tink::util::Status::OK;
   }
 
-  // Tink specific minimum key size.
-  const int kMinKeySizeBytes = 16;
+  // We use a somewhat larger minimum key size than usual, because PRFs might be
+  // used by many users, in which case the security can degrade by a factor
+  // depending on the number of users. (Discussed for example in
+  // https://eprint.iacr.org/2012/159)
+  const int kMinKeySizeBytes = 32;
   const std::string key_type_ = absl::StrCat(
       kTypeGoogleapisCom, google::crypto::tink::HkdfPrfKey().GetTypeName());
 };