Move HPKE encryption handler to SDK

This change moves HPKE encryption handlers out of the `oak_attestation`
crate to corresponding SDKs (RKernel and Containers). Later these
handlers can be merged with the new Oak SDK.

Fixes: 365039516

Change-Id: Ibf8953e05ce54f0605caf355875306113b9c4a93

oak_attestation/BUILD

@@ -31,7 +31,6 @@ rust_library(
     ]),
     deps = [
         "//micro_rpc",
-        "//oak_crypto",
         "//oak_dice",
         "//oak_proto_rust",
         "@oak_crates_index//:anyhow",

oak_attestation/Cargo.toml

@@ -8,7 +8,6 @@ license = "Apache-2.0"
 anyhow = { version = "*", default-features = false }
 ciborium = { version = "*", default-features = false }
 coset = { version = "*", default-features = false }
-oak_crypto = { workspace = true }
 oak_dice = { workspace = true }
 oak_proto_rust = { workspace = true }
 prost = { workspace = true }

oak_attestation/src/lib.rs

@@ -20,4 +20,3 @@ extern crate alloc;
 
 pub mod attester;
 pub mod dice;
-pub mod handler;

oak_containers_sdk/BUILD

@@ -25,6 +25,7 @@ rust_library(
     name = "oak_containers_sdk",
     srcs = [
         "src/crypto.rs",
+        "src/handler.rs",
         "src/lib.rs",
         "src/oak_session_context.rs",
         "src/orchestrator_client.rs",

oak_attestation/src/handler.rs → oak_containers_sdk/src/handler.rs

@@ -14,49 +14,15 @@
 // limitations under the License.
 //
 
-use alloc::{sync::Arc, vec::Vec};
 use core::future::Future;
+use std::{sync::Arc, vec::Vec};
 
 use anyhow::Context;
 use oak_crypto::{
-    encryption_key::{AsyncEncryptionKeyHandle, EncryptionKeyHandle},
-    encryptor::ServerEncryptor,
-    EMPTY_ASSOCIATED_DATA,
+    encryption_key::AsyncEncryptionKeyHandle, encryptor::ServerEncryptor, EMPTY_ASSOCIATED_DATA,
 };
 use oak_proto_rust::oak::crypto::v1::{EncryptedRequest, EncryptedResponse};
 
-/// Wraps a closure to an underlying function with request encryption and
-/// response decryption logic, based on the provided encryption key.
-pub struct EncryptionHandler<H: FnOnce(Vec<u8>) -> Vec<u8>> {
-    encryption_key_handle: Arc<dyn EncryptionKeyHandle>,
-    request_handler: H,
-}
-
-impl<H: FnOnce(Vec<u8>) -> Vec<u8>> EncryptionHandler<H> {
-    pub fn create(encryption_key_handle: Arc<dyn EncryptionKeyHandle>, request_handler: H) -> Self {
-        Self { encryption_key_handle, request_handler }
-    }
-}
-
-impl<H: FnOnce(Vec<u8>) -> Vec<u8>> EncryptionHandler<H> {
-    pub fn invoke(self, encrypted_request: &EncryptedRequest) -> anyhow::Result<EncryptedResponse> {
-        // Decrypt request.
-        let (server_encryptor, request, _) =
-            ServerEncryptor::decrypt(encrypted_request, self.encryption_key_handle.as_ref())
-                .context("couldn't create server encryptor")?;
-
-        // Handle request.
-        let response = (self.request_handler)(request);
-
-        // Encrypt and serialize response.
-        // The resulting decryptor for subsequent requests is discarded because we don't
-        // expect another message from the stream.
-        server_encryptor
-            .encrypt(&response, EMPTY_ASSOCIATED_DATA)
-            .context("couldn't encrypt response")
-    }
-}
-
 /// Wraps a closure to an underlying function with request encryption and
 /// response decryption logic, based on the provided encryption key.
 /// [`AsyncEncryptionHandler`] can be used when an [`AsyncEncryptionKeyHandle`]

oak_containers_sdk/src/lib.rs

@@ -14,6 +14,7 @@
 // limitations under the License.
 
 pub mod crypto;
+pub mod handler;
 pub mod oak_session_context;
 pub mod orchestrator_client;
 pub mod standalone;

oak_functions_containers_app/Cargo.toml

@@ -20,7 +20,6 @@ anyhow = "*"
 clap = { version = "*", features = ["derive"] }
 libloading = { version = "*", optional = true }
 http = "0.2.11"
-oak_attestation = { workspace = true }
 oak_containers_agent = { workspace = true }
 oak_containers_sdk = { workspace = true }
 oak_debug_service = { workspace = true }

oak_functions_containers_app/src/lib.rs

@@ -22,8 +22,8 @@ use std::{
 };
 
 use anyhow::Context;
-use oak_attestation::handler::AsyncEncryptionHandler;
 use oak_containers_agent::metrics::OakObserver;
+use oak_containers_sdk::handler::AsyncEncryptionHandler;
 use oak_crypto::encryption_key::AsyncEncryptionKeyHandle;
 use oak_functions_service::{instance::OakFunctionsInstance, Handler, Observer};
 use oak_proto_rust::oak::functions::{

oak_functions_enclave_service/src/lib.rs

@@ -20,7 +20,7 @@ extern crate alloc;
 
 use alloc::{format, string::ToString, sync::Arc, vec::Vec};
 
-use oak_attestation::{dice::evidence_to_proto, handler::EncryptionHandler};
+use oak_attestation::dice::evidence_to_proto;
 use oak_core::sync::OnceCell;
 use oak_crypto::encryption_key::EncryptionKeyHandle;
 use oak_functions_service::{instance::OakFunctionsInstance, Handler, Observer};
@@ -31,6 +31,7 @@ use oak_proto_rust::oak::functions::{
     FinishNextLookupDataResponse, InitializeRequest, InitializeResponse, InvokeRequest,
     InvokeResponse, LookupDataChunk, ReserveRequest, ReserveResponse,
 };
+use oak_restricted_kernel_sdk::handler::EncryptionHandler;
 use prost::Message;
 
 pub struct OakFunctionsService<EKH, EP, H>

oak_restricted_kernel_sdk/src/handler.rs

@@ -0,0 +1,55 @@
+//
+// Copyright 2022 The Project Oak Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+use alloc::{sync::Arc, vec::Vec};
+
+use anyhow::Context;
+use oak_crypto::{
+    encryption_key::EncryptionKeyHandle, encryptor::ServerEncryptor, EMPTY_ASSOCIATED_DATA,
+};
+use oak_proto_rust::oak::crypto::v1::{EncryptedRequest, EncryptedResponse};
+
+/// Wraps a closure to an underlying function with request encryption and
+/// response decryption logic, based on the provided encryption key.
+pub struct EncryptionHandler<H: FnOnce(Vec<u8>) -> Vec<u8>> {
+    encryption_key_handle: Arc<dyn EncryptionKeyHandle>,
+    request_handler: H,
+}
+
+impl<H: FnOnce(Vec<u8>) -> Vec<u8>> EncryptionHandler<H> {
+    pub fn create(encryption_key_handle: Arc<dyn EncryptionKeyHandle>, request_handler: H) -> Self {
+        Self { encryption_key_handle, request_handler }
+    }
+}
+
+impl<H: FnOnce(Vec<u8>) -> Vec<u8>> EncryptionHandler<H> {
+    pub fn invoke(self, encrypted_request: &EncryptedRequest) -> anyhow::Result<EncryptedResponse> {
+        // Decrypt request.
+        let (server_encryptor, request, _) =
+            ServerEncryptor::decrypt(encrypted_request, self.encryption_key_handle.as_ref())
+                .context("couldn't create server encryptor")?;
+
+        // Handle request.
+        let response = (self.request_handler)(request);
+
+        // Encrypt and serialize response.
+        // The resulting decryptor for subsequent requests is discarded because we don't
+        // expect another message from the stream.
+        server_encryptor
+            .encrypt(&response, EMPTY_ASSOCIATED_DATA)
+            .context("couldn't encrypt response")
+    }
+}

oak_restricted_kernel_sdk/src/lib.rs

@@ -24,6 +24,7 @@ extern crate alloc;
 pub mod attestation;
 pub mod channel;
 pub mod crypto;
+pub mod handler;
 #[cfg(any(feature = "testing", doc))]
 #[doc(cfg(feature = "testing"))]
 pub mod testing;