decrypt cannot read private key

[apoorvmote]

I am following decrypt with tinkey official guide for golang.

https://github.com/google/tink/blob/master/docs/GOLANG-HOWTO.md#decryption

	pk, pkErr := base64.StdEncoding.DecodeString(privateKey)

	if pkErr != nil {

		fmt.Printf("decoding private key failed, %v\n", pkErr)

		return
	}

	fmt.Println(string(pk))

	khPriv, khPrivErr := insecurecleartextkeyset.Read(keyset.NewBinaryReader(bytes.NewReader(pk)))

	if khPrivErr != nil {

		fmt.Printf("reading private key fail, %v\n", khPrivErr)

		return
	}

Then it fails with message

reading private key fail, insecurecleartextkeyset: invalid keyset

I also tried adding key directly

	khPriv, khPrivErr := insecurecleartextkeyset.Read(keyset.NewBinaryReader(bytes.NewReader([]byte(privateKey))))

	if khPrivErr != nil {

		fmt.Printf("reading private key fail, %v\n", khPrivErr)

		return
	}

Then again it failed with same message

reading private key fail, insecurecleartextkeyset: invalid keyset

I am running this code on local playground because there are lots of warning saying DONT ADD PRIVATE KEY INTO SOURCE CODE.

Took me very long time to convert authorize lambda encpoint from NodeJS to golang. I do receive base64 encoded encrypted key as follows.

crypt := request.QueryStringParameters["crypt"]
	
fmt.Println(crypt)

AXW5Nb8EM4syiCgAWYoIcXTtGmDQ0qexeDisQPX3xhFvtb3iGUAvJa6/2kiBUQXMuQRjUpAk2JC01KmVfupNq5hmnckvdD17IBwijFIEtxzPX4OBpE5TXcTH1jpzn+RtDJCK5W1oWleBOKSZBvAS2EF9kxxXcvEOnMB1OrjtzT81gZK70HTNKIAELa9jzaLftQZUtcK1jI12HnUvWPrQkStrPHajByXyroryUZrgNlHvu+Y=

I can base64 decode it fine at lambda. But have trouble reading private key.

The private key is same generated from https://github.com/subscriptions-project/encryption/tree/master/golang/cmd/aws_key_gen

It generated one public and private key.

[elijahsoria]

Sorry you are running into these issues, Apoorv! Have you tried using the MemReaderWriter instead of NewBinaryReader? I see that the AWS script is using MemReaderWriter to write the private key:

encryption/golang/cmd/aws_key_gen/script.go

Line 79 in 8c592ef

exported := &keyset.MemReaderWriter{}

[apoorvmote]

I am not really sure how to put private key into MemReaderWriter.

In pseudo-code they have hybridDecrypter type that has this decrypt method that takes in encrypted key 🔑bytes and returns decrypted key 🔑 bytes.

I need help with this magical hybridDecrypter type. Then rest I can do.

[elijahsoria]

In your script from your first post, I see you are calling Read right after base64 decoding.

pk, pkErr := base64.StdEncoding.DecodeString(privateKey)
if pkErr != nil {
	fmt.Printf("decoding private key failed, %v\n", pkErr)
	return
}
fmt.Println(string(pk))
khPriv, khPrivErr := insecurecleartextkeyset.Read(keyset.NewBinaryReader(bytes.NewReader(pk)))

I think you will need to decrypt the private key first in order to get it from ciphertext into proper bytes, corresponding to this encrypt call in the aws_key_gen script.. Have you done that previously?

For the MemReaderWriter, you might be able to use the sample code found in the insecurecleartextkeyset_test.go within Tink's Github page.

[apoorvmote]

I am repeating the same steps as creating the key 🔑 just instead of a.Encrypt I am running a.Decrypt. Here is my code

	awsClient, err := awskms.NewClient(keyURI)

	if err != nil {

		fmt.Printf("creating aws kms client failed, %v\n", err)

		return
	}

	registry.RegisterKMSClient(awsClient)

	dek := aead.AES128CTRHMACSHA256KeyTemplate()

	khgcs, err := keyset.NewHandle(aead.KMSEnvelopeAEADKeyTemplate(keyURI, dek))

	if err != nil {

		fmt.Printf("new handle failed, %v", err)

		return
	}

	a, err := aead.New(khgcs)

	if err != nil {

		fmt.Printf("failed to create new aead, %v", err)

		return
	}

	pk, pkErr := base64.StdEncoding.DecodeString(privateKey)

	if pkErr != nil {

		fmt.Printf("decoding private key failed, %v\n", pkErr)

		return
	}

	plainBytesPk, err := a.Decrypt(pk, nil)

	if err != nil {

		fmt.Printf("decrypting private key failed, %v\n", err)

		return
	}

And the decryption fails with following error. Everything before that succeeds.

decrypting private key failed, aead_factory: decryption failed

Also there were huge warnings everywhere on hybrid decryption that never hardcode the private key into the source code and commit history. If my private key is already encrypted then I can hardcode the private key 🔑 right? I shouldn't probably go as far as posting my private key 🔑 into public github repo but at least I can commit that into my private source code.

[elijahsoria]

Sorry I am not sure what the issue is here. You might want to post this to Tink's Github since I think this mainly has to do with their tools. The only thing I can think of is ensuring that you are loading in the same key used during encryption with the AWS client.

I can't really comment on the key security. How secure you want to be with your private key is up to you and your use case.

[apoorvmote]

I ran it again and created new private key. It decrypts on the encryption script but won't decrypt on another script.
I think I am making some mistake but I have created issue with tink.
tink-crypto/tink#466

[apoorvmote]

This is taking way too long. So I will keep this on backburner. The alternative is https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html
Cloudfront CDN supports signed URL and signed Cookie auth at edge distribution location since 2015. I will have better luck here without compromizing the speed.