feat: add Azure Key Vault support for payload encryption#14
Conversation
Add an Azure Key Vault adapter for the MaterialsManager interface, enabling payload encryption/decryption using Azure Key Vault's WrapKey/UnwrapKey operations with RSA-OAEP-256.
|
|
||
| azureMaterialsManager := crypto.NewAzureKeyVaultProvider(azAdapter, crypto.AzureKeyVaultOptions{ | ||
| KeyID: keyID, | ||
| Algorithm: "RSA-OAEP-256", |
There was a problem hiding this comment.
I thought we need a symmetric algorithm here?
There was a problem hiding this comment.
This is envelope encryption: we generate a random 256-bit AES (symmetric) data key locally, that's the key actually encrypting the payload, see crypto/azure_keyvault_provider.go:50. The Algorithm parameter is just the wrapping algorithm Azure Key Vault uses to encrypt that data key for storage.
RSA-OAEP-256 is the right default for Azure Key Vault because standard-tier vaults only support RSA and EC keys, symmetric (oct) keys are exclusive to the Premium SKU and Managed HSM. Wrapping a symmetric data key with an asymmetric KMS key is a standard pattern (it's what most Azure Key Vault envelope-encryption examples do). Although if we want to support customers on Premium / Managed HSM (probably do) with oct keys, we can thread algorithm through from YAML, AzureKeyVaultOptions.Algorithm already supports it, it's just hardcoded in codec.go:170 today. I didn't do this because it's one more setting that could go wrong, but in a banking context it should be there.
The AWS/GCP AES_256 settings aren't directly analogous: AWS's KeySpec describes the data key GenerateDataKey returns and wrapping is opaque inside KMS; it looks like GCP's Algorithm field is actually unused in gcp_kms_provider.go. Azure exposes wrap/unwrap directly, so we have to name the wrap algorithm explicitly.
There was a problem hiding this comment.
Makes sense. Thanks @jdswain. I think we can leave this one hard-coded for now.
Happy to merge once "Manual integration test with an Azure Key Vault instance" is ticked.
2 participants
Summary
MaterialsManagerinterface using WrapKey/UnwrapKey with RSA-OAEP-256azure-keyvaultprovider in the codec factory withazidentity.NewDefaultAzureCredentialfor authenticationConfiguration
Set encryption type to
azure-keyvaultwith akey-idconfig value, and set theAZURE_VAULT_URLenvironment variable to the vault URL.Test plan