Add decryption callback to CryptoHandler

Author: tadfisher

app/build.gradle.kts

@@ -57,6 +57,7 @@ dependencies {
   coreLibraryDesugaring(libs.android.desugarJdkLibs)
   implementation(projects.autofillParser)
   implementation(projects.coroutineUtils)
+  implementation(projects.cryptoHwsecurity)
   implementation(projects.cryptoPgpainless)
   implementation(projects.formatCommonImpl)
   implementation(projects.passgen.diceware)

app/src/main/java/app/passwordstore/Application.kt

@@ -7,7 +7,12 @@ package app.passwordstore
 import android.content.SharedPreferences
 import android.os.Build
 import android.os.StrictMode
-import androidx.appcompat.app.AppCompatDelegate.*
+import androidx.appcompat.app.AppCompatDelegate.MODE_NIGHT_AUTO_BATTERY
+import androidx.appcompat.app.AppCompatDelegate.MODE_NIGHT_FOLLOW_SYSTEM
+import androidx.appcompat.app.AppCompatDelegate.MODE_NIGHT_NO
+import androidx.appcompat.app.AppCompatDelegate.MODE_NIGHT_YES
+import androidx.appcompat.app.AppCompatDelegate.setDefaultNightMode
+import app.passwordstore.crypto.HWSecurityManager
 import app.passwordstore.injection.context.FilesDirPath
 import app.passwordstore.injection.prefs.SettingsPreferences
 import app.passwordstore.util.extensions.getString
@@ -42,16 +47,18 @@ class Application : android.app.Application(), SharedPreferences.OnSharedPrefere
   @Inject lateinit var proxyUtils: ProxyUtils
   @Inject lateinit var gitSettings: GitSettings
   @Inject lateinit var features: Features
+  @Inject lateinit var deviceManager: HWSecurityManager
 
   override fun onCreate() {
     super.onCreate()
     instance = this
     LeakCanary.config =
       LeakCanary.config.copy(eventListeners = LeakCanary.config.eventListeners + SentryLeakUploader)
-    if (
+
+    val enableLogging =
       BuildConfig.ENABLE_DEBUG_FEATURES ||
         prefs.getBoolean(PreferenceKeys.ENABLE_DEBUG_LOGGING, false)
-    ) {
+    if (enableLogging) {
       LogcatLogger.install(AndroidLogcatLogger(DEBUG))
       AppWatcher.manualInstall(this)
       setVmPolicy()
@@ -62,6 +69,7 @@ class Application : android.app.Application(), SharedPreferences.OnSharedPrefere
     runMigrations(filesDirPath, prefs, gitSettings)
     proxyUtils.setDefaultProxy()
     DynamicColors.applyToActivitiesIfAvailable(this)
+    deviceManager.init(enableLogging)
     Sentry.configureScope { scope ->
       val user = User()
       user.data =

app/src/main/java/app/passwordstore/data/crypto/CryptoRepository.kt

@@ -7,6 +7,7 @@ package app.passwordstore.data.crypto
 
 import android.content.SharedPreferences
 import app.passwordstore.crypto.GpgIdentifier
+import app.passwordstore.crypto.HWSecurityDeviceHandler
 import app.passwordstore.crypto.PGPDecryptOptions
 import app.passwordstore.crypto.PGPEncryptOptions
 import app.passwordstore.crypto.PGPKeyManager
@@ -16,11 +17,13 @@ import app.passwordstore.injection.prefs.SettingsPreferences
 import app.passwordstore.util.settings.PreferenceKeys
 import com.github.michaelbull.result.Result
 import com.github.michaelbull.result.getAll
+import com.github.michaelbull.result.getOrThrow
 import com.github.michaelbull.result.unwrap
 import java.io.ByteArrayInputStream
 import java.io.ByteArrayOutputStream
 import javax.inject.Inject
 import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.runBlocking
 import kotlinx.coroutines.withContext
 
 class CryptoRepository
@@ -29,6 +32,7 @@ constructor(
   private val pgpKeyManager: PGPKeyManager,
   private val pgpCryptoHandler: PGPainlessCryptoHandler,
   @SettingsPreferences private val settings: SharedPreferences,
+  private val deviceHandler: HWSecurityDeviceHandler,
 ) {
 
   suspend fun decrypt(
@@ -50,7 +54,10 @@ constructor(
   ): Result<Unit, CryptoHandlerException> {
     val decryptionOptions = PGPDecryptOptions.Builder().build()
     val keys = pgpKeyManager.getAllKeys().unwrap()
-    return pgpCryptoHandler.decrypt(keys, password, message, out, decryptionOptions)
+    return pgpCryptoHandler.decrypt(keys, password, message, out, decryptionOptions) {
+      encryptedSessionKey ->
+      runBlocking { deviceHandler.decryptSessionKey(encryptedSessionKey).getOrThrow() }
+    }
   }
 
   private suspend fun encryptPgp(

app/src/main/java/app/passwordstore/injection/crypto/CryptoHandlerModule.kt

@@ -5,14 +5,31 @@
 
 package app.passwordstore.injection.crypto
 
+import android.app.Activity
+import androidx.fragment.app.FragmentActivity
+import app.passwordstore.crypto.HWSecurityDeviceHandler
+import app.passwordstore.crypto.HWSecurityManager
 import app.passwordstore.crypto.PGPainlessCryptoHandler
 import dagger.Module
 import dagger.Provides
 import dagger.hilt.InstallIn
-import dagger.hilt.components.SingletonComponent
+import dagger.hilt.android.components.ActivityComponent
+import dagger.hilt.android.scopes.ActivityScoped
 
 @Module
-@InstallIn(SingletonComponent::class)
+@InstallIn(ActivityComponent::class)
 object CryptoHandlerModule {
+
+  @Provides
+  @ActivityScoped
+  fun provideDeviceHandler(
+    activity: Activity,
+    deviceManager: HWSecurityManager
+  ): HWSecurityDeviceHandler =
+    HWSecurityDeviceHandler(
+      deviceManager = deviceManager,
+      fragmentManager = (activity as FragmentActivity).supportFragmentManager
+    )
+
   @Provides fun providePgpCryptoHandler() = PGPainlessCryptoHandler()
 }

crypto-common/src/main/kotlin/app/passwordstore/crypto/CryptoHandler.kt

@@ -11,7 +11,13 @@ import java.io.InputStream
 import java.io.OutputStream
 
 /** Generic interface to implement cryptographic operations on top of. */
-public interface CryptoHandler<Key, EncOpts : CryptoOptions, DecryptOpts : CryptoOptions> {
+public interface CryptoHandler<
+  Key,
+  EncOpts : CryptoOptions,
+  DecryptOpts : CryptoOptions,
+  EncryptedSessionKey,
+  DecryptedSessionKey,
+> {
 
   /**
    * Decrypt the given [ciphertextStream] using a set of potential [keys] and [passphrase], and
@@ -25,6 +31,7 @@ public interface CryptoHandler<Key, EncOpts : CryptoOptions, DecryptOpts : Crypt
     ciphertextStream: InputStream,
     outputStream: OutputStream,
     options: DecryptOpts,
+    onDecryptSessionKey: (EncryptedSessionKey) -> DecryptedSessionKey,
   ): Result<Unit, CryptoHandlerException>
 
   /**

crypto-common/src/main/kotlin/app/passwordstore/crypto/errors/CryptoException.kt

@@ -6,7 +6,8 @@ public sealed class CryptoException(message: String? = null, cause: Throwable? =
   Exception(message, cause)
 
 /** Sealed exception types for [KeyManager]. */
-public sealed class KeyManagerException(message: String? = null, cause: Throwable? = null) : CryptoException(message, cause)
+public sealed class KeyManagerException(message: String? = null, cause: Throwable? = null) :
+  CryptoException(message, cause)
 
 /** Store contains no keys. */
 public object NoKeysAvailableException : KeyManagerException("No keys were found")
@@ -46,13 +47,12 @@ public class NoKeysProvided(message: String?) : CryptoHandlerException(message,
 /** An unexpected error that cannot be mapped to a known type. */
 public class UnknownError(cause: Throwable) : CryptoHandlerException(null, cause)
 
-public class KeySpecific(public val key: Any, cause: Throwable?) : CryptoHandlerException(key.toString(), cause)
+public class KeySpecific(public val key: Any, cause: Throwable?) :
+  CryptoHandlerException(key.toString(), cause)
 
 /** Wrapper containing possibly multiple child exceptions via [suppressedExceptions]. */
-public class MultipleKeySpecific(
-  message: String?,
-  public val errors: List<KeySpecific>
-) : CryptoHandlerException(message) {
+public class MultipleKeySpecific(message: String?, public val errors: List<KeySpecific>) :
+  CryptoHandlerException(message) {
   init {
     for (error in errors) {
       addSuppressed(error)
@@ -68,7 +68,8 @@ public sealed class DeviceHandlerException(message: String? = null, cause: Throw
 public class DeviceOperationCanceled(message: String) : DeviceHandlerException(message, null)
 
 /** The device crypto operation failed. */
-public class DeviceOperationFailed(message: String?, cause: Throwable? = null) : DeviceHandlerException(message, cause)
+public class DeviceOperationFailed(message: String?, cause: Throwable? = null) :
+  DeviceHandlerException(message, cause)
 
 /** The device's key fingerprint doesn't match the fingerprint we are trying to pair it to. */
 public class DeviceFingerprintMismatch(

crypto-hwsecurity/src/main/kotlin/app/passwordstore/crypto/DeviceIdentifier.kt

@@ -1,52 +1,56 @@
 @file:Suppress("MagicNumber")
+
 package app.passwordstore.crypto
 
 @JvmInline
-public value class DeviceIdentifier(
-    private val aid: ByteArray
-) {
-    init {
-        require(aid.size == 16) { "Invalid device application identifier" }
-    }
+public value class DeviceIdentifier(private val aid: ByteArray) {
+  init {
+    require(aid.size == 16) { "Invalid device application identifier" }
+  }
 
-    public val openPgpVersion: String get() = "${aid[6]}.${aid[7]}"
+  public val openPgpVersion: String
+    get() = "${aid[6]}.${aid[7]}"
 
-    public val manufacturer: Int
-        get() = ((aid[8].toInt() and 0xff) shl 8) or (aid[9].toInt() and 0xff)
+  public val manufacturer: Int
+    get() = ((aid[8].toInt() and 0xff) shl 8) or (aid[9].toInt() and 0xff)
 
-    public val serialNumber: ByteArray get() = aid.sliceArray(10..13)
-  }
+  public val serialNumber: ByteArray
+    get() = aid.sliceArray(10..13)
+}
 
 // https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=scd/app-openpgp.c;hb=HEAD#l292
-public val DeviceIdentifier.manufacturerName: String get() = when (manufacturer) {
-    0x0001 -> "PPC Card Systems"
-    0x0002 -> "Prism"
-    0x0003 -> "OpenFortress"
-    0x0004 -> "Wewid"
-    0x0005 -> "ZeitControl"
-    0x0006 -> "Yubico"
-    0x0007 -> "OpenKMS"
-    0x0008 -> "LogoEmail"
-    0x0009 -> "Fidesmo"
-    0x000A -> "VivoKey"
-    0x000B -> "Feitian Technologies"
-    0x000D -> "Dangerous Things"
-    0x000E -> "Excelsecu"
-    0x000F -> "Nitrokey"
-    0x002A -> "Magrathea"
-    0x0042 -> "GnuPG e.V."
-    0x1337 -> "Warsaw Hackerspace"
-    0x2342 -> "warpzone"
-    0x4354 -> "Confidential Technologies"
-    0x5343 -> "SSE Carte à puce"
-    0x5443 -> "TIF-IT e.V."
-    0x63AF -> "Trustica"
-    0xBA53 -> "c-base e.V."
-    0xBD0E -> "Paranoidlabs"
-    0xCA05 -> "Atos CardOS"
-    0xF1D0 -> "CanoKeys"
-    0xF517 -> "FSIJ"
-    0xF5EC -> "F-Secure"
-    0x0000, 0xFFFF -> "test card"
-    else -> "unknown"
-}
+public val DeviceIdentifier.manufacturerName: String
+  get() =
+    when (manufacturer) {
+      0x0001 -> "PPC Card Systems"
+      0x0002 -> "Prism"
+      0x0003 -> "OpenFortress"
+      0x0004 -> "Wewid"
+      0x0005 -> "ZeitControl"
+      0x0006 -> "Yubico"
+      0x0007 -> "OpenKMS"
+      0x0008 -> "LogoEmail"
+      0x0009 -> "Fidesmo"
+      0x000A -> "VivoKey"
+      0x000B -> "Feitian Technologies"
+      0x000D -> "Dangerous Things"
+      0x000E -> "Excelsecu"
+      0x000F -> "Nitrokey"
+      0x002A -> "Magrathea"
+      0x0042 -> "GnuPG e.V."
+      0x1337 -> "Warsaw Hackerspace"
+      0x2342 -> "warpzone"
+      0x4354 -> "Confidential Technologies"
+      0x5343 -> "SSE Carte à puce"
+      0x5443 -> "TIF-IT e.V."
+      0x63AF -> "Trustica"
+      0xBA53 -> "c-base e.V."
+      0xBD0E -> "Paranoidlabs"
+      0xCA05 -> "Atos CardOS"
+      0xF1D0 -> "CanoKeys"
+      0xF517 -> "FSIJ"
+      0xF5EC -> "F-Secure"
+      0x0000,
+      0xFFFF -> "test card"
+      else -> "unknown"
+    }

crypto-hwsecurity/src/main/kotlin/app/passwordstore/crypto/DeviceKeyInfo.kt

@@ -4,14 +4,15 @@ import org.pgpainless.algorithm.PublicKeyAlgorithm
 import org.pgpainless.key.OpenPgpFingerprint
 
 public data class DeviceKeyInfo(
-    public val algorithm: PublicKeyAlgorithm,
-    public val fingerprint: OpenPgpFingerprint
+  public val algorithm: PublicKeyAlgorithm,
+  public val fingerprint: OpenPgpFingerprint
 ) {
-    override fun toString(): String = "${algorithm.displayName()} ${fingerprint.prettyPrint()}"
+  override fun toString(): String = "${algorithm.displayName()} ${fingerprint.prettyPrint()}"
 }
 
 @Suppress("DEPRECATION")
-private fun PublicKeyAlgorithm.displayName(): String = when (this) {
+private fun PublicKeyAlgorithm.displayName(): String =
+  when (this) {
     PublicKeyAlgorithm.RSA_GENERAL -> "RSA"
     PublicKeyAlgorithm.RSA_ENCRYPT -> "RSA (encrypt-only, deprecated)"
     PublicKeyAlgorithm.RSA_SIGN -> "RSA (sign-only, deprecated)"
@@ -23,4 +24,4 @@ private fun PublicKeyAlgorithm.displayName(): String = when (this) {
     PublicKeyAlgorithm.ELGAMAL_GENERAL -> "ElGamal (general, deprecated)"
     PublicKeyAlgorithm.DIFFIE_HELLMAN -> "Diffie-Hellman"
     PublicKeyAlgorithm.EDDSA -> "EDDSA"
-}
+  }

crypto-hwsecurity/src/main/kotlin/app/passwordstore/crypto/HWSecurityDevice.kt

@@ -8,39 +8,38 @@ import org.pgpainless.algorithm.PublicKeyAlgorithm
 import org.pgpainless.key.OpenPgpFingerprint
 
 public class HWSecurityDevice(
-    public val id: DeviceIdentifier,
-    public val name: String,
-    public val encryptKeyInfo: DeviceKeyInfo?,
-    public val signKeyInfo: DeviceKeyInfo?,
-    public val authKeyInfo: DeviceKeyInfo?,
+  public val id: DeviceIdentifier,
+  public val name: String,
+  public val encryptKeyInfo: DeviceKeyInfo?,
+  public val signKeyInfo: DeviceKeyInfo?,
+  public val authKeyInfo: DeviceKeyInfo?,
 )
 
 internal fun OpenPgpSecurityKey.toDevice(): HWSecurityDevice =
-    with (openPgpAppletConnection.openPgpCapabilities) {
-        HWSecurityDevice(
-            id = DeviceIdentifier(aid),
-            name = securityKeyName,
-            encryptKeyInfo = keyInfo(encryptKeyFormat, fingerprintEncrypt),
-            signKeyInfo = keyInfo(signKeyFormat, fingerprintSign),
-            authKeyInfo = keyInfo(authKeyFormat, fingerprintAuth)
-        )
-    }
+  with(openPgpAppletConnection.openPgpCapabilities) {
+    HWSecurityDevice(
+      id = DeviceIdentifier(aid),
+      name = securityKeyName,
+      encryptKeyInfo = keyInfo(encryptKeyFormat, fingerprintEncrypt),
+      signKeyInfo = keyInfo(signKeyFormat, fingerprintSign),
+      authKeyInfo = keyInfo(authKeyFormat, fingerprintAuth)
+    )
+  }
 
-internal fun keyInfo(
-    format: KeyFormat?,
-    fingerprint: ByteArray?
-): DeviceKeyInfo? {
-    if (format == null || fingerprint == null) return null
-    return DeviceKeyInfo(format.toKeyAlgorithm(), OpenPgpFingerprint.parseFromBinary(fingerprint))
+internal fun keyInfo(format: KeyFormat?, fingerprint: ByteArray?): DeviceKeyInfo? {
+  if (format == null || fingerprint == null) return null
+  return DeviceKeyInfo(format.toKeyAlgorithm(), OpenPgpFingerprint.parseFromBinary(fingerprint))
 }
 
-internal fun KeyFormat.toKeyAlgorithm(): PublicKeyAlgorithm = when (this) {
+internal fun KeyFormat.toKeyAlgorithm(): PublicKeyAlgorithm =
+  when (this) {
     is RsaKeyFormat -> PublicKeyAlgorithm.RSA_GENERAL
-    is EcKeyFormat -> when (val id = algorithmId()) {
+    is EcKeyFormat ->
+      when (val id = algorithmId()) {
         PublicKeyAlgorithm.ECDH.algorithmId -> PublicKeyAlgorithm.ECDH
         PublicKeyAlgorithm.ECDSA.algorithmId -> PublicKeyAlgorithm.ECDSA
         PublicKeyAlgorithm.EDDSA.algorithmId -> PublicKeyAlgorithm.EDDSA
         else -> throw IllegalArgumentException("Unknown EC algorithm ID: $id")
-    }
+      }
     else -> throw IllegalArgumentException("Unknown key format")
-}
+  }