Feat/azure_ekm_proxy_api_version=0.1-preview by HatemMn · Pull Request #601 · Cosmian/kms

HatemMn · 2025-11-18T15:47:57Z

Issue #653

Overview :

Basically an implementation of Azure EKM API as following in a loyal manner the specifications. This is version 0.1-preview, the code is flexible for future versions

What's done :

Added the necessary configs as well as the possibility to enable/disable azure EKM
Implemented the info / get metadata / Wrap / unwrap endpoints like specified
created all specified error responses, despite some of them being currently un-used
authentification ( mTLS )
Tests
About timeout : no more guards about it. The KMS does "his best"
Small refactoring with MS DKE

Otherwise :

the "1. Prerequisites" (read page 6) is not documented in the docs, users should refer to azure docs I guess

Closes #653

Appendix

Following are the docs diagrams

HatemMn · 2026-01-09T17:06:35Z

Needs a rebase

Otherwise this will stop at this stage until an azure prod env is available to test

Manuthor · 2026-01-09T17:40:41Z

Needs a rebase

Otherwise this will stop at this stage until an azure prod env is available to test

I believe you can rebase from now since #658 has been merged to develop

HatemMn · 2026-01-12T07:46:21Z

Just rebased

HatemMn · 2026-02-09T14:12:29Z

.cargo/config.toml

 #   "target_cpu=native",
 # ]
+
+# can increase build time for system that support mold


this was added intentionally

Could you please remove this? If needed, add an internal README with specific build instructions

HatemMn · 2026-02-09T14:12:57Z

.vscode/settings.json

    "non-fips"
-  ]
+  ],
+  "rust-analyzer.cargo.extraEnv": {


this was also added intentionally

Same here, remove it and add it to an internal README. IMHO, .vscode/settings.json should be removed completely.

feat: DONE rfc5649 fix: fix problematic test feat: finish up fix: major bugé feat: add a lot of things fis: add back provider for ci tests fix:clip fix: a lot more stuff fix: a lot more stuff2 fix: some fixes fix: finish up feat: reviews fixes + ui fixes + migrate fixes + a test feat: missing file fix: ui fix: review fixes fix: grammar fixes feat: add azure ekm configs feat: wip on errors feat: finish start file feat: big advance on metadata endpoint feat: finish metadata but the code is ugly refactor: HUGE refactoring of that huge nested code induced by the errors (I used handlers) feat: more advance feat: finish the api and fix compiler problems feat: multiple improvements for endpoints feat: more improvements feat: auth OK feat: auth seems ok ...? feat: first refactor fix: improve fix: add missing files fix: commit first files fix: add the rest fix: rfc algorithms Revert "fix: rfc algorithms" This reverts commit e5d9737. fix: add rfc algos feat: rfc3394 algo postfixes feat: post review fixes and some new feats to AES habndlers feat: final commits that got lost before finish fix: test fixes

feat: finish docs and fix some more todos2

Manuthor · 2026-02-08T20:34:20Z

.cargo/config.toml

+
+# [target.x86_64-unknown-linux-gnu] # TODO: uncomment this after dev is finished
+# linker = "clang"
+# rustflags = ["-C", "link-arg=-fuse-ld=mold"]


Just a comment to remember to revert this changes

Manuthor · 2026-02-08T20:35:05Z

.vscode/settings.json

  "rust-analyzer.cargo.features": [
    "non-fips"
-  ]
+  ],


Revert (and make it a user only configuration)

Manuthor · 2026-02-08T20:35:22Z

crate/crypto/src/crypto/symmetric/rfc5649.rs

    Ok(plaintext)
 }

+//             // Encrypt block using AES with ECB mode i.e. raw AES as specified in


Manuthor · 2026-02-18T12:56:28Z

.cargo/config.toml

 #   "target_cpu=native",
 # ]
+
+# can increase build time for system that support mold


Could you please remove this? If needed, add an internal README with specific build instructions

Manuthor · 2026-02-18T12:57:25Z

.vscode/settings.json

    "non-fips"
-  ]
+  ],
+  "rust-analyzer.cargo.extraEnv": {


Same here, remove it and add it to an internal README. IMHO, .vscode/settings.json should be removed completely.

Manuthor · 2026-02-18T13:03:43Z

crate/server/src/config/command_line/azure_ekm_config.rs

+    /// WARNING: This bypasses mTLS authentication entirely. Only use for testing!
+    #[clap(
+        long,
+        env = "KMS_AZURE_EKM_DISABLE_CLIENT_AUTH",
+        default_value = "false"
+    )]
+    // serde does not support skipping booleans out of the box so a custom function is used
+    #[serde(skip_serializing_if = "is_false")]
+    pub azure_ekm_disable_client_auth: bool,


Is this parameter really required?
If during testing, mTLS must be disabled, I would advise to disable this TLS configuration:

[tls] # Your server certificate and private key (PKCS#12 format) tls_p12_file = "/etc/cosmian/server-cert.p12" tls_p12_password = "your-secure-password" # The certificate downloaded in the previous section # This validates the client certificate presented by Azure MHSM clients_ca_cert_file = "/etc/cosmian/mhsm-root-ca.pem"

Isn't it enough?

Manuthor · 2026-02-18T13:16:57Z

crate/server/src/routes/azure_ekm/error.rs

+        let status_code = e.status_code().as_u16();
+
+        // Mapping non-internal errors status numeric code to an error code string
+        let code = match status_code {


Do not convert to u16 and match directly on e.status_code()?

crate/server/src/routes/azure_ekm/handlers.rs

Manuthor · 2026-02-18T13:28:44Z

crate/server/src/routes/azure_ekm/handlers.rs

+                    // Check algorithm and build response
+                    match algorithm {
+                        CryptographicAlgorithm::AES => {
+                            if key_length == 256 {


Add a const variable for this 256-value and mention on it that is a Azure ProxyEKM restriction.

Manuthor · 2026-02-18T13:40:55Z

crate/server/src/routes/ms_dke/mod.rs

+        )
+    })?;
+    let (modulus, public_exponent) =
+        get_rsa_key_metadata_from_public_key(kms, key_id, &user).await?;


Watch out here.
Even your changes seem to be correct, there are currently no tests to validate if MS DKE encryption is broken or not.

HatemMn self-assigned this Nov 18, 2025

HatemMn marked this pull request as ready for review November 22, 2025 12:43

This was referenced Dec 24, 2025

Support RFC 3394 (AESKeyWrap with **no** padding) #658

Merged

Support EKM Azure #653

Open

HatemMn changed the base branch from develop to feat/support_RFC3394 January 9, 2026 17:03

HatemMn removed their assignment Jan 9, 2026

HatemMn added the Blocked Development can't advance until external conditions are met label Jan 9, 2026

Base automatically changed from feat/support_RFC3394 to develop January 9, 2026 17:12

HatemMn force-pushed the feat/ekm_proxy_api branch from 06af9e2 to 7cb2714 Compare January 12, 2026 07:45

HatemMn removed the Blocked Development can't advance until external conditions are met label Feb 3, 2026

HatemMn force-pushed the feat/ekm_proxy_api branch 2 times, most recently from 0d7c643 to 641d677 Compare February 9, 2026 16:14

HatemMn commented Feb 10, 2026

View reviewed changes

HatemMn force-pushed the feat/ekm_proxy_api branch from 2b05b39 to ac1d664 Compare February 10, 2026 15:13

bgrieder assigned HatemMn Feb 12, 2026

HatemMn added 12 commits February 16, 2026 18:25

fix: fixes

a226d27

feat: ssl fix

6419eb9

feat: fmt fix

2a7401f

feat: stuff fix

fa2edb2

feat: add docs

81fc9b1

feat: add docs AND IMAGE

a98b99d

feat: finish docs and fix some more todos

86a0120

feat: finish docs and fix some more todos2

feat: finish docs and fix some more todos3

ad620ed

feat: stop timing out

df5893f

fix: still messy

120bfb1

feat: finish the refactor and the fix and the documentation

50f3e87

feat: useless comment

be8da0c

HatemMn force-pushed the feat/ekm_proxy_api branch from 64fe211 to be8da0c Compare February 16, 2026 19:34

HatemMn added 2 commits February 16, 2026 20:56

feat: ufix

ce0b0c3

feat: fortmat????

f339056

Manuthor reviewed Feb 18, 2026

View reviewed changes

HatemMn added 3 commits February 19, 2026 13:12

feat: review fixes

8843491

feat: review fixes even mroe

2a30553

feat: review fixes are never over

b7ec711

Comments

Conversation

HatemMn commented Nov 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Overview :

What's done :

Otherwise :

Appendix

Uh oh!

HatemMn commented Jan 9, 2026

Uh oh!

Manuthor commented Jan 9, 2026

Uh oh!

HatemMn commented Jan 12, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

HatemMn commented Nov 18, 2025 •

edited

Loading