[WIP] Implement smartcard section form save/load_device.

AureliaDolo · AureliaDolo · commit 00d299f8994d · 2025-09-18T14:42:48.000+02:00
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -99,6 +99,7 @@ libparsec_platform_device_loader = { path = "libparsec/crates/platform_device_lo
 libparsec_platform_http_proxy = { path = "libparsec/crates/platform_http_proxy", default-features = false }
 libparsec_platform_ipc = { path = "libparsec/crates/platform_ipc", default-features = false }
 libparsec_platform_mountpoint = { path = "libparsec/crates/platform_mountpoint", default-features = false }
+libparsec_platform_pki = { path = "libparsec/crates/platform_pki", default-features = false }
 libparsec_platform_realm_export = { path = "libparsec/crates/platform_realm_export", default-features = false }
 libparsec_platform_storage = { path = "libparsec/crates/platform_storage", default-features = false }
 libparsec_protocol = { path = "libparsec/crates/protocol", default-features = false }
diff --git a/cli/src/commands/device/change_authentication.rs b/cli/src/commands/device/change_authentication.rs
@@ -53,9 +53,13 @@ pub async fn main(args: Args) -> anyhow::Result<()> {
             }
         }
 
-        AvailableDeviceType::Smartcard => DeviceAccessStrategy::Smartcard {
-            key_file: device.key_file_path.clone(),
-        },
+        AvailableDeviceType::Smartcard => {
+            todo!("read smartcard");
+            DeviceAccessStrategy::Smartcard {
+                certificate_reference: todo!(),
+                key_file: device.key_file_path.clone(),
+            }
+        }
 
         AvailableDeviceType::Keyring => DeviceAccessStrategy::Keyring {
             key_file: device.key_file_path.clone(),
diff --git a/cli/src/commands/device/overwrite_server_url.rs b/cli/src/commands/device/overwrite_server_url.rs
@@ -34,6 +34,7 @@ pub async fn main(args: Args) -> anyhow::Result<()> {
 
         AvailableDeviceType::Smartcard => DeviceAccessStrategy::Smartcard {
             key_file: device.key_file_path.clone(),
+            certificate_reference: todo!("read smartcard"),
         },
 
         AvailableDeviceType::Keyring => DeviceAccessStrategy::Keyring {
diff --git a/cli/src/utils.rs b/cli/src/utils.rs
@@ -248,6 +248,7 @@ pub async fn load_and_unlock_device(
         }
         AvailableDeviceType::Smartcard => DeviceAccessStrategy::Smartcard {
             key_file: device.key_file_path.clone(),
+            certificate_reference: todo!("read smartcard"),
         },
         AvailableDeviceType::Keyring => DeviceAccessStrategy::Keyring {
             key_file: device.key_file_path.clone(),
diff --git a/libparsec/crates/platform_device_loader/Cargo.toml b/libparsec/crates/platform_device_loader/Cargo.toml
@@ -18,6 +18,7 @@ vendored-dbus = ["keyring/vendored"]
 [dependencies]
 libparsec_crypto = { workspace = true }
 libparsec_platform_async = { workspace = true }
+libparsec_platform_pki = { workspace = true }
 libparsec_testbed = { workspace = true, optional = true }
 libparsec_types = { workspace = true }
 
diff --git a/libparsec/crates/platform_device_loader/src/native/mod.rs b/libparsec/crates/platform_device_loader/src/native/mod.rs
@@ -6,13 +6,13 @@ use libparsec_platform_async::future::FutureExt as _;
 use std::path::{Path, PathBuf};
 use uuid::Uuid;
 
-use libparsec_types::prelude::*;
-
 use crate::{
-    get_device_archive_path, ArchiveDeviceError, ListAvailableDeviceError, LoadCiphertextKeyError,
-    LoadDeviceError, ReadFileError, RemoveDeviceError, SaveDeviceError, UpdateDeviceError,
-    DEVICE_FILE_EXT,
+    encrypt_device, get_device_archive_path, ArchiveDeviceError, ListAvailableDeviceError,
+    LoadCiphertextKeyError, LoadDeviceError, ReadFileError, RemoveDeviceError, SaveDeviceError,
+    UpdateDeviceError, DEVICE_FILE_EXT,
 };
+use libparsec_platform_pki::{decrypt_secret_key, encrypt_secret_key};
+use libparsec_types::prelude::*;
 
 const KEYRING_SERVICE: &str = "parsec";
 
@@ -152,9 +152,16 @@ pub(super) async fn load_ciphertext_key(
             Ok(key)
         }
 
-        (DeviceAccessStrategy::Smartcard { .. }, DeviceFile::Smartcard(_)) => {
-            todo!("Load smartcard device")
-        }
+        (
+            DeviceAccessStrategy::Smartcard {
+                certificate_reference,
+                ..
+            },
+            DeviceFile::Smartcard(device),
+        ) => Ok(
+            decrypt_secret_key(&device.encrypted_key, certificate_reference)
+                .map_err(|_| LoadCiphertextKeyError::InvalidData)?,
+        ),
 
         (
             DeviceAccessStrategy::AccountVault { ciphertext_key, .. },
@@ -303,8 +310,48 @@ pub(super) async fn save_device(
             save_content(key_file, &file_content).await?;
         }
 
-        DeviceAccessStrategy::Smartcard { .. } => {
-            todo!("Save smartcard device")
+        DeviceAccessStrategy::Smartcard {
+            key_file,
+            certificate_reference,
+        } => {
+            // Generate a random key
+            let secret_key = SecretKey::generate();
+
+            // Encrypt the key using the public key related to a certificate from the store
+
+            let (encrypted_key, certificate_id, certificate_sha1) =
+                encrypt_secret_key(&secret_key, certificate_reference)
+                    .map_err(|e| SaveDeviceError::Internal(e.into()))?;
+
+            // May check if we are able to decrypt the encrypted key from the previous step
+            assert_eq!(
+                decrypt_secret_key(&encrypted_key, certificate_reference)
+                    .map_err(|e| SaveDeviceError::Internal(e.into()))?,
+                secret_key
+            );
+
+            // Use the generated key to encrypt the device content
+            let ciphertext = encrypt_device(device, &secret_key);
+
+            // Save
+            let file_content = DeviceFile::Smartcard(DeviceFileSmartcard {
+                created_on,
+                protected_on,
+                server_url: server_url.clone(),
+                organization_id: device.organization_id().to_owned(),
+                user_id: device.user_id,
+                device_id: device.device_id,
+                human_handle: device.human_handle.to_owned(),
+                device_label: device.device_label.to_owned(),
+                certificate_id,
+                certificate_sha1: Some(Bytes::copy_from_slice(certificate_sha1.as_ref())),
+                encrypted_key,
+                ciphertext,
+            });
+
+            let file_content = file_content.dump();
+
+            save_content(key_file, &file_content).await?;
         }
 
         DeviceAccessStrategy::AccountVault {
diff --git a/libparsec/crates/platform_device_loader/src/testbed.rs b/libparsec/crates/platform_device_loader/src/testbed.rs
@@ -342,9 +342,12 @@ pub(crate) fn maybe_load_device(
                         }
                     }
                     (
-                        DeviceAccessStrategy::Smartcard { key_file: kf },
-                        DeviceAccessStrategy::Smartcard { key_file: c_kf },
-                    ) if c_kf == kf => Some(Ok(c_device.to_owned())),
+                        DeviceAccessStrategy::Smartcard { key_file: kf, .. },
+                        DeviceAccessStrategy::Smartcard { key_file: c_kf, .. },
+                    ) if c_kf == kf => {
+                        todo!("compare certificate reference");
+                        //Some(Ok(c_device.to_owned()))
+                    }
                     (
                         DeviceAccessStrategy::Keyring { key_file: kf },
                         DeviceAccessStrategy::Keyring { key_file: c_kf },
diff --git a/libparsec/crates/platform_device_loader/tests/units/list.rs b/libparsec/crates/platform_device_loader/tests/units/list.rs
@@ -165,7 +165,7 @@ async fn list_devices(tmp_path: TmpPath) {
             .parse()
             .unwrap(),
         device_label: "PC1".parse().unwrap(),
-        certificate_id: "Mallory's certificate".to_string(),
+        certificate_id: "Mallory's certificate".into(),
         certificate_sha1: Some(
             hex!("4682e01bc3e22fdfff1c33b551dfad8e49295005")
                 .as_ref()
diff --git a/libparsec/crates/platform_pki/Cargo.toml b/libparsec/crates/platform_pki/Cargo.toml
@@ -15,6 +15,9 @@ workspace = true
 thiserror = { workspace = true }
 bytes = { workspace = true }
 
+libparsec_crypto = { workspace = true }
+
+
 [target.'cfg(target_os = "windows")'.dependencies]
 schannel = { workspace = true }
 windows-sys = { workspace = true, features = ["Win32_Security_Cryptography_UI"] }
diff --git a/libparsec/crates/platform_pki/src/lib.rs b/libparsec/crates/platform_pki/src/lib.rs
@@ -3,12 +3,14 @@
 #[cfg(target_os = "windows")]
 mod windows;
 
+pub use platform::{decrypt_secret_key, encrypt_secret_key};
+
 use bytes::Bytes;
 
 #[cfg(target_os = "windows")]
 pub(crate) use windows as platform;
 
-#[derive(Debug, Clone)]
+#[derive(Debug, Clone, PartialEq, Eq)]
 pub enum CertificateHash {
     SHA256(Box<[u8; 32]>),
 }
@@ -21,6 +23,7 @@ impl AsRef<[u8]> for CertificateHash {
     }
 }
 
+#[derive(Debug, Clone, PartialEq)]
 pub enum CertificateReference {
     Id(Bytes),
     Hash(CertificateHash),
@@ -33,6 +36,7 @@ impl From<CertificateReferenceIdOrHash> for CertificateReference {
     }
 }
 
+#[derive(Debug, Clone, PartialEq)]
 pub struct CertificateReferenceIdOrHash {
     pub id: Bytes,
     pub hash: CertificateHash,
@@ -44,13 +48,39 @@ pub use windows::show_certificate_selection_dialog;
 // Mock module for unsupported platform
 #[cfg(not(target_os = "windows"))]
 mod platform {
-    use crate::{CertificateDer, CertificateReference, GetDerEncodedCertificateError};
+    use bytes::Bytes;
+    use libparsec_crypto::SecretKey;
+
+    use crate::{
+        CertificateDer, CertificateHash, CertificateReference, DecryptSecretKeyError,
+        EncryptSecretKeyError, GetDerEncodedCertificateError,
+    };
     pub fn get_der_encoded_certificate(
         certificate_ref: &CertificateReference,
     ) -> Result<CertificateDer, GetDerEncodedCertificateError> {
         let _ = certificate_ref;
         unimplemented!("platform not supported")
     }
+
+    /// returns encrypted key, certificated id and certificate hash
+    pub fn encrypt_secret_key(
+        key: &SecretKey,
+        certificate_ref: &CertificateReference,
+    ) -> Result<(Bytes, Bytes, CertificateHash), EncryptSecretKeyError> {
+        let _ = certificate_ref;
+        let _ = key;
+
+        unimplemented!()
+    }
+
+    pub fn decrypt_secret_key(
+        encrypted_key: &Bytes,
+        certificate_ref: &CertificateReference,
+    ) -> Result<SecretKey, DecryptSecretKeyError> {
+        let _ = certificate_ref;
+        let _ = encrypted_key;
+        unimplemented!()
+    }
 }
 
 #[derive(Debug, thiserror::Error)]
@@ -69,3 +99,9 @@ pub struct CertificateDer {
     pub cert_ref: CertificateReferenceIdOrHash,
     pub der_content: Bytes,
 }
+
+#[derive(Debug, thiserror::Error)]
+pub enum EncryptSecretKeyError {}
+
+#[derive(Debug, thiserror::Error)]
+pub enum DecryptSecretKeyError {}
diff --git a/libparsec/crates/types/Cargo.toml b/libparsec/crates/types/Cargo.toml
@@ -19,6 +19,7 @@ test-fixtures = ["dep:hex-literal", "dep:rstest"]
 libparsec_crypto = { workspace = true }
 libparsec_serialization_format = { workspace = true }
 libparsec_platform_async = { workspace = true }
+libparsec_platform_pki = { workspace = true }
 libparsec_zstd = { workspace = true }
 
 serde = { workspace = true, features = ["derive"] }
diff --git a/libparsec/crates/types/schema/local_device/device_file_smartcard.json5 b/libparsec/crates/types/schema/local_device/device_file_smartcard.json5
@@ -43,7 +43,7 @@
             // Certificate here refers to the X509 certificate that describes what is
             // in the smartcard.
             "name": "certificate_id",
-            "type": "String"
+            "type": "Bytes"
         },
         {
             // Certificate here refers to the X509 certificate that describes what is
diff --git a/libparsec/crates/types/src/local_device_file.rs b/libparsec/crates/types/src/local_device_file.rs
@@ -5,6 +5,7 @@ use serde::{Deserialize, Serialize};
 use std::path::{Path, PathBuf};
 
 use libparsec_crypto::{Password, SecretKey};
+use libparsec_platform_pki::CertificateReference;
 use libparsec_serialization_format::parsec_data;
 
 use crate::{self as libparsec_types};
@@ -120,7 +121,7 @@ pub struct DeviceFileSmartcard {
     pub device_id: DeviceID,
     pub human_handle: HumanHandle,
     pub device_label: DeviceLabel,
-    pub certificate_id: String,
+    pub certificate_id: Bytes,
     pub certificate_sha1: Option<Bytes>,
     pub encrypted_key: Bytes,
     pub ciphertext: Bytes,
@@ -226,7 +227,9 @@ pub enum DeviceSaveStrategy {
     Password {
         password: Password,
     },
-    Smartcard,
+    Smartcard {
+        certificate_reference: CertificateReference,
+    },
     AccountVault {
         /// This key is the one stored in the account vault.
         ///
@@ -244,7 +247,12 @@ impl DeviceSaveStrategy {
             DeviceSaveStrategy::Password { password } => {
                 DeviceAccessStrategy::Password { key_file, password }
             }
-            DeviceSaveStrategy::Smartcard => DeviceAccessStrategy::Smartcard { key_file },
+            DeviceSaveStrategy::Smartcard {
+                certificate_reference,
+            } => DeviceAccessStrategy::Smartcard {
+                key_file,
+                certificate_reference,
+            },
             DeviceSaveStrategy::AccountVault {
                 ciphertext_key_id,
                 ciphertext_key,
@@ -269,6 +277,7 @@ pub enum DeviceAccessStrategy {
     },
     Smartcard {
         key_file: PathBuf,
+        certificate_reference: CertificateReference,
     },
     AccountVault {
         key_file: PathBuf,
@@ -286,7 +295,7 @@ impl DeviceAccessStrategy {
         match self {
             Self::Keyring { key_file } => key_file,
             Self::Password { key_file, .. } => key_file,
-            Self::Smartcard { key_file } => key_file,
+            Self::Smartcard { key_file, .. } => key_file,
             Self::AccountVault { key_file, .. } => key_file,
         }
     }

Original file line number	Diff line number	Diff line change
`@@ -248,6 +248,7 @@ pub async fn load_and_unlock_device(`
`248`	`248`	`}`
`249`	`249`	`AvailableDeviceType::Smartcard => DeviceAccessStrategy::Smartcard {`
`250`	`250`	`key_file: device.key_file_path.clone(),`
	`251`	`+ certificate_reference: todo!("read smartcard"),`
`251`	`252`	`},`
`252`	`253`	`AvailableDeviceType::Keyring => DeviceAccessStrategy::Keyring {`
`253`	`254`	`key_file: device.key_file_path.clone(),`
Original file line number	Diff line number	Diff line change
`@@ -342,9 +342,12 @@ pub(crate) fn maybe_load_device(`
`342`	`342`	`}`
`343`	`343`	`}`
`344`	`344`	`(`
`345`		`- DeviceAccessStrategy::Smartcard { key_file: kf },`
`346`		`- DeviceAccessStrategy::Smartcard { key_file: c_kf },`
`347`		`- ) if c_kf == kf => Some(Ok(c_device.to_owned())),`
	`345`	`+ DeviceAccessStrategy::Smartcard { key_file: kf, .. },`
	`346`	`+ DeviceAccessStrategy::Smartcard { key_file: c_kf, .. },`
	`347`	`+ ) if c_kf == kf => {`
	`348`	`+ todo!("compare certificate reference");`
	`349`	`+ //Some(Ok(c_device.to_owned()))`
	`350`	`+ }`
`348`	`351`	`(`
`349`	`352`	`DeviceAccessStrategy::Keyring { key_file: kf },`
`350`	`353`	`DeviceAccessStrategy::Keyring { key_file: c_kf },`