Skip to content

Commit 604b0fb

Browse files
migueldemouramigueldemoura
authored
Add support for upcoming encryption format v3 (#6)
* Bump clap version * Add support for upcoming encryption format v3 Bumps the version of the generated encrypted blob from `2` to `3`. To allow decryption of the older version `2` encrypted blobs with the same binary, we import both versions of the `hpke` crate. This is behind the optional `blob_legacy_version` cargo feature, enabled by default. Decryption of both blob versions will happen transparently by leveraging the prepended version byte. We're keeping most of this as copy-paste, but may eventually encapsulate it properly if the upgrade path continues to resemble this one, i.e., same interface but different types. * Update README with v3 encrypted blob examples * Run tests in CI for build without default features
1 parent 510fd02 commit 604b0fb

File tree

7 files changed

+266
-92
lines changed

7 files changed

+266
-92
lines changed

‎.github/workflows/test.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,5 +33,7 @@ jobs:
3333
run: |
3434
cargo build
3535
cargo test
36+
cargo build --no-default-features
37+
cargo test --no-default-features
3638
env:
3739
RUST_BACKTRACE: 1

‎Cargo.lock‎

Lines changed: 108 additions & 59 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Cargo.toml‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,16 +5,22 @@ authors = ["Miguel de Moura <mdemoura@cloudflare.com>"]
55
description = "Tool to interact with the firewall matched data feature"
66
edition = "2018"
77

8+
[features]
9+
default = ["blob_legacy_version"]
10+
blob_legacy_version = ["hpke_legacy"]
11+
812
[dependencies]
913
assert_cmd = "1.0.2"
1014
bincode = "1.3.1"
11-
clap = "3.0.0-beta.1"
15+
clap = "3.0.0-beta.2"
1216
generic-array = { version = "0.14.4", features = ["serde"] }
13-
hpke = { version = "0.4.1", features = ["serde_impls"] }
17+
hpke = { version = "0.5.0", default-features = false, features = ["x25519", "serde_impls"] }
1418
radix64 = "0.6.2"
1519
rand = "0.7.3"
1620
serde = { version = "1.0.117", features = ["derive"] }
1721
serde_json = "1.0.59"
1822

23+
hpke_legacy = { package = "hpke", version = "0.4.1", default-features = false, features = ["x25519", "serde_impls"], optional = true }
24+
1925
[profile.release]
2026
lto = true

‎README.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ Tool to interact with the firewall matched data feature.
1212

1313
## Usage
1414

15-
```
15+
``` plain
1616
USAGE:
1717
matched-data-cli <SUBCOMMAND>
1818
@@ -39,13 +39,13 @@ $ matched-data-cli generate-key-pair
3939
To decrypt an encrypted matched data blob:
4040

4141
``` shell
42-
$ matched-data-cli decrypt -d AdfVn7odpamJGeFAGj0iW2oTtoXOjVnTFT2x4l+cHKJsEQAAAAAAAAB+zDygjV2aUI92FV4cHMkp+4u37JHnH4fUkRqasPYaCgk= -k $PRIVATE_KEY
42+
$ matched-data-cli decrypt -d AzTY6FHajXYXuDMUte82wrd+1n5CEHPoydYiyd3FMg5IEQAAAAAAAAA0lOhGXBclw8pWU5jbbYuepSIJN5JohTtZekLliJBlVWk= -k $PRIVATE_KEY
4343
test matched data
4444
```
4545

4646
or using stdin, for example:
4747

4848
``` shell
49-
$ printf $PRIVATE_KEY | matched-data-cli decrypt -d AdfVn7odpamJGeFAGj0iW2oTtoXOjVnTFT2x4l+cHKJsEQAAAAAAAAB+zDygjV2aUI92FV4cHMkp+4u37JHnH4fUkRqasPYaCgk= --private-key-stdin
49+
$ printf $PRIVATE_KEY | matched-data-cli decrypt -d AzTY6FHajXYXuDMUte82wrd+1n5CEHPoydYiyd3FMg5IEQAAAAAAAAA0lOhGXBclw8pWU5jbbYuepSIJN5JohTtZekLliJBlVWk= --private-key-stdin
5050
test matched data
5151
```

0 commit comments

Comments
 (0)