Visitar URL original
fix(spanner): update Omni login client and tests for 32-byte cryptogr… · googleapis/google-cloud-java@9161519 · GitHub
Skip to content

Commit 9161519

Browse files
sagnghossagnghos
committed
fix(spanner): update Omni login client and tests for 32-byte cryptographic constants
1 parent e3672ac commit 9161519

4 files changed

Lines changed: 27 additions & 11 deletions

File tree

‎java-spanner/google-cloud-spanner/src/main/java/com/google/cloud/spanner/omni/LoginClient.java‎

Lines changed: 13 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,9 @@
4444
public class LoginClient {
4545
private static final SecureRandom SECURE_RANDOM = new SecureRandom();
4646

47+
static final int EXPECTED_ENVELOPE_SIZE =
48+
OpaqueUtil.PUBLIC_KEY_LENGTH + OpaqueUtil.NONCE_LENGTH + OpaqueUtil.MAC_TAG_LENGTH;
49+
4750
private final LoginServiceGrpc.LoginServiceStub stub;
4851

4952
public LoginClient(ManagedChannel channel) {
@@ -132,7 +135,7 @@ public AccessToken login(String username, SecretBytes password) throws SpannerEx
132135
initialResponse.getOpaqueResponse().getInitialResponse();
133136

134137
ByteString envelope = initialOpaqueResponse.getMaskedResponse();
135-
if (envelope.size() != 65) {
138+
if (envelope.size() != EXPECTED_ENVELOPE_SIZE) {
136139
throw new GeneralSecurityException("Invalid envelope size: " + envelope.size());
137140
}
138141

@@ -236,17 +239,21 @@ private byte[] generateClientMac(
236239
OpaqueUtil.concat(
237240
initialOpaqueResponse.getMaskingNonce().toByteArray(),
238241
"CredentialResponsePad".getBytes(java.nio.charset.StandardCharsets.UTF_8)),
239-
16 + 33 + 16);
242+
OpaqueUtil.NONCE_LENGTH + OpaqueUtil.PUBLIC_KEY_LENGTH + OpaqueUtil.MAC_TAG_LENGTH);
240243
byte[] serializedEnvelope =
241244
OpaqueUtil.xorBytes(
242245
initialOpaqueResponse.getMaskedResponse().toByteArray(), credentialResponsePad);
243246
ByteString envelope = ByteString.copyFrom(serializedEnvelope);
244-
if (envelope.size() != 65) {
247+
if (envelope.size() != EXPECTED_ENVELOPE_SIZE) {
245248
throw new GeneralSecurityException("Invalid envelope size: " + envelope.size());
246249
}
247-
ByteString serverPublicKey = envelope.substring(0, 33);
248-
ByteString envelopeNonce = envelope.substring(33, 33 + 16);
249-
ByteString authTag = envelope.substring(33 + 16, 33 + 16 + 16);
250+
ByteString serverPublicKey = envelope.substring(0, OpaqueUtil.PUBLIC_KEY_LENGTH);
251+
ByteString envelopeNonce =
252+
envelope.substring(
253+
OpaqueUtil.PUBLIC_KEY_LENGTH, OpaqueUtil.PUBLIC_KEY_LENGTH + OpaqueUtil.NONCE_LENGTH);
254+
ByteString authTag =
255+
envelope.substring(
256+
OpaqueUtil.PUBLIC_KEY_LENGTH + OpaqueUtil.NONCE_LENGTH, EXPECTED_ENVELOPE_SIZE);
250257

251258
authKey =
252259
OpaqueUtil.expand(

‎java-spanner/google-cloud-spanner/src/main/java/com/google/cloud/spanner/omni/OpaqueUtil.java‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,8 +45,9 @@ public class OpaqueUtil {
4545
public static final String DIFFIE_HELLMAN_KEY_INFO = "OPAQUE-DeriveDiffieHellmanKeyPair";
4646
public static final String HMAC_SHA256 = "HmacSHA256";
4747

48-
private static final int NONCE_LENGTH = 16;
49-
private static final int MAC_TAG_LENGTH = 16;
48+
static final int NONCE_LENGTH = 32;
49+
static final int MAC_TAG_LENGTH = 32;
50+
static final int PUBLIC_KEY_LENGTH = 33;
5051
private static final int EXTRACT_OUTPUT_LENGTH = 32;
5152

5253
// Argon2ID parameters.

‎java-spanner/google-cloud-spanner/src/test/java/com/google/cloud/spanner/omni/LoginClientTest.java‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,4 +34,12 @@ public void testConstructor() {
3434
LoginClient client = new LoginClient(channel);
3535
assertNotNull(client);
3636
}
37+
38+
@Test
39+
public void testExpectedEnvelopeSize() {
40+
// The envelope size must match the sum of the public key, nonce, and auth tag lengths.
41+
// If the server changes the lengths in cl/940065095, this test will catch any mismatch.
42+
org.junit.Assert.assertEquals(
43+
"Envelope size should be 97 bytes (33 + 32 + 32)", 97, LoginClient.EXPECTED_ENVELOPE_SIZE);
44+
}
3745
}

‎java-spanner/google-cloud-spanner/src/test/java/com/google/cloud/spanner/omni/OpaqueUtilTest.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -40,8 +40,8 @@ public class OpaqueUtilTest {
4040
public void testNonce() {
4141
byte[] nonce1 = OpaqueUtil.nonce();
4242
byte[] nonce2 = OpaqueUtil.nonce();
43-
assertEquals(16, nonce1.length);
44-
assertEquals(16, nonce2.length);
43+
assertEquals(32, nonce1.length);
44+
assertEquals(32, nonce2.length);
4545
assertTrue(!Arrays.equals(nonce1, nonce2));
4646
}
4747

@@ -90,7 +90,7 @@ public void testMac() throws Exception {
9090
byte[] mac1 = OpaqueUtil.mac(keys[i], data[i]);
9191
byte[] mac2 = OpaqueUtil.mac(keys[i], data[i]);
9292
assertArrayEquals(mac1, mac2);
93-
assertEquals(16, mac1.length);
93+
assertEquals(32, mac1.length);
9494
}
9595
}
9696

0 commit comments

Comments
 (0)