Skip to content

chore(xtest): rename the hexless feature to hexless_integrity #662

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
pflynn-virtru wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

chore(xtest): rename the hexless feature to hexless_integrity #662

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions otdf-local/src/otdf_local/config/features.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@
"bulk_rewrap",
"connectrpc",
"ecwrap",
"hexless",
"hexless_integrity",
"hexaflexible",
"kasallowlist",
"key_management",
Expand Down Expand Up @@ -96,7 +96,7 @@ def _compute_features(semver: tuple[int, int, int]) -> set[FeatureType]:

# Hexless format support
if semver >= (0, 4, 39):
features.add("hexless")
features.add("hexless_integrity")
features.add("hexaflexible")

# Namespace grants
Expand Down
6 changes: 4 additions & 2 deletions xtest/fixtures/bench.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -235,7 +235,7 @@ def _spec_for(spec: str | None, sdk: str) -> str | None:
#: operation, and a timing difference between them is a difference in work,
#: not in speed.
_COMPARABILITY_FEATURES: tuple[tdfs.feature_type, ...] = (
"hexless",
"hexless_integrity",
"hexaflexible",
"autoconfigure",
)
Expand Down Expand Up @@ -270,7 +270,9 @@ def pinned_target_mode(arms: BenchArms) -> tdfs.container_version | None:
and arms.candidate.supports("hexaflexible")
):
return None
if arms.baseline.supports("hexless") and arms.candidate.supports("hexless"):
if arms.baseline.supports("hexless_integrity") and arms.candidate.supports(
"hexless_integrity"
):
return "4.3.0"
return "4.2.2"

Expand Down
2 changes: 1 addition & 1 deletion xtest/perf/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -438,7 +438,7 @@ delta reads zero.
Both arms get the same plaintext, the same attribute (explicit RSA, so an arm
does not silently switch to EC), the same container, and the same target mode.
`comparability_problem()` refuses the comparison outright when the two builds
disagree on `hexless`, `hexaflexible`, or `autoconfigure` — a timing difference
disagree on `hexless_integrity`, `hexaflexible`, or `autoconfigure` — a timing difference
there is a difference in *work*, not in speed.

For decrypt, both arms read one ciphertext produced by the baseline. If each arm
Expand Down
4 changes: 2 additions & 2 deletions xtest/sdk/go/cli.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,9 +77,9 @@ if [ "$1" == "supports" ]; then
exit 1
fi
;;
hexless)
hexless_integrity)
set -o pipefail
# Schema version 4.3.0 introduced hexless
# Schema version 4.3.0 introduced hexless integrity
"${cmd[@]}" --version --json | jq -re .schema_version | awk -F. '{ if ($1 > 4 || ($1 == 4 && $2 >= 2)) exit 0; else exit 1; }'
exit $?
;;
Expand Down
2 changes: 1 addition & 1 deletion xtest/sdk/java/cli.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,7 +104,7 @@ if [ "$1" == "supports" ]; then
fi
;;

hexless)
hexless_integrity)
set -o pipefail
java -jar "$SCRIPT_DIR"/cmdline.jar --version | jq -re .tdfSpecVersion | awk -F. '{ if ($1 > 4 || ($1 == 4 && $2 > 2) || ($1 == 4 && $2 == 3 && $3 >= 0)) exit 0; else exit 1; }'
exit $?
Expand Down
2 changes: 1 addition & 1 deletion xtest/sdk/js/cli.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,7 @@ if [[ "$1" == "supports" ]]; then
exit 1
fi
;;
hexless)
hexless_integrity)
set -o pipefail
npx $CTL --version | jq -re .tdfSpecVersion | awk -F. '{ if ($1 > 4 || ($1 == 4 && $2 > 2) || ($1 == 4 && $2 == 3 && $3 >= 0)) exit 0; else exit 1; }'
exit $?
Expand Down
20 changes: 13 additions & 7 deletions xtest/tdfs.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -166,7 +166,7 @@ def is_sdk_type(val: str) -> TypeIs[sdk_type]:
# unconditionally, which is how you get a red repro out of a build that is
# still vulnerable rather than a skip.
"gmac_root_rejected",
"hexless",
"hexless_integrity",
"hexaflexible",
"kasallowlist",
# Platform: resolve managed keys using the KAS URI from the KAO. Force-only
Expand Down Expand Up @@ -351,7 +351,7 @@ def __init__(self, **kwargs: dict[str, Any]):

# Included in SDK 0.3.27, service 0.4.39
if self.semver >= (0, 4, 39):
self.features.add("hexless")
self.features.add("hexless_integrity")
self.features.add("hexaflexible")

if self.semver >= (0, 4, 19):
Expand Down Expand Up @@ -1041,12 +1041,14 @@ def skip_if_unsupported(sdk: SDK, *features: feature_type):
sdk.skip_if_unsupported(*features)


def skip_hexless_skew(encrypt_sdk: SDK, decrypt_sdk: SDK):
def skip_hexless_integrity_skew(encrypt_sdk: SDK, decrypt_sdk: SDK):
if encrypt_sdk.supports("hexaflexible"):
return
if encrypt_sdk.supports("hexless") and not decrypt_sdk.supports("hexless"):
if encrypt_sdk.supports("hexless_integrity") and not decrypt_sdk.supports(
"hexless_integrity"
):
pytest.skip(
f"{decrypt_sdk} sdk doesn't yet support [hexless], but {encrypt_sdk} does"
f"{decrypt_sdk} sdk doesn't yet support hexless integrity, but {encrypt_sdk} does"
)


Expand Down Expand Up @@ -1191,8 +1193,12 @@ def skip_pqc_hybrid_format_skew(encrypt_sdk: SDK | None = None) -> None:
def select_target_version(
encrypt_sdk: SDK, decrypt_sdk: SDK
) -> container_version | None:
if encrypt_sdk.supports("hexaflexible") and not decrypt_sdk.supports("hexless"):
if encrypt_sdk.supports("hexaflexible") and not decrypt_sdk.supports(
"hexless_integrity"
):
return "4.2.2"
if encrypt_sdk.supports("hexaflexible") and decrypt_sdk.supports("hexless"):
if encrypt_sdk.supports("hexaflexible") and decrypt_sdk.supports(
"hexless_integrity"
):
return "4.3.0"
return None
40 changes: 20 additions & 20 deletions xtest/test_abac.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,7 +93,7 @@ def test_key_mapping_multiple_mechanisms(
tdfs.skip_if_unsupported(encrypt_sdk, "autoconfigure")
pfs = tdfs.get_platform_features()
tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs)
tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk)
tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk)

# Currently, we only support rsa:2048 and ec:secp256r1
vals = [
Expand Down Expand Up @@ -145,7 +145,7 @@ def test_key_mapping_extended_mechanisms(
)
pfs = tdfs.get_platform_features()
tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs)
tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk)
tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk)
skip_dspx1153(encrypt_sdk, decrypt_sdk)

attr, key_ids = attribute_allof_with_extended_mechanisms
Expand Down Expand Up @@ -208,7 +208,7 @@ def test_key_mapping_extended_ec_mechanisms(
"key_management", "autoconfigure", "mechanism-ec-curves-384-521"
)
tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs)
tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk)
tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk)
skip_dspx1153(encrypt_sdk, decrypt_sdk)

attr, key_ids = attribute_allof_with_extended_mechanisms
Expand Down Expand Up @@ -266,7 +266,7 @@ def test_key_mapping_extended_rsa_mechanisms(
encrypt_sdk.skip_if_unsupported("mechanism-rsa-4096")
pfs = tdfs.get_platform_features()
tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs)
tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk)
tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk)
skip_dspx1153(encrypt_sdk, decrypt_sdk)

attr, key_ids = attribute_allof_with_extended_mechanisms
Expand Down Expand Up @@ -321,7 +321,7 @@ def test_autoconfigure_one_attribute_standard(
tdfs.skip_if_unsupported(encrypt_sdk, "autoconfigure")
pfs = tdfs.get_platform_features()
tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs)
tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk)
tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk)

ct_file = encrypted_tdf(
encrypt_sdk,
Expand Down Expand Up @@ -368,7 +368,7 @@ def test_autoconfigure_two_kas_or_standard(
tdfs.skip_if_unsupported(encrypt_sdk, "autoconfigure")
pfs = tdfs.get_platform_features()
tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs)
tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk)
tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk)

ct_file = encrypted_tdf(
encrypt_sdk,
Expand Down Expand Up @@ -421,7 +421,7 @@ def test_autoconfigure_double_kas_and(
tdfs.skip_if_unsupported(encrypt_sdk, "autoconfigure")
pfs = tdfs.get_platform_features()
tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs)
tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk)
tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk)

ct_file = encrypted_tdf(
encrypt_sdk,
Expand Down Expand Up @@ -473,7 +473,7 @@ def test_autoconfigure_one_attribute_attr_grant(
tdfs.skip_if_unsupported(encrypt_sdk, "autoconfigure")
pfs = tdfs.get_platform_features()
tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs)
tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk)
tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk)

ct_file = encrypted_tdf(
encrypt_sdk,
Expand Down Expand Up @@ -511,7 +511,7 @@ def test_autoconfigure_two_kas_or_attr_and_value_grant(
tdfs.skip_if_unsupported(encrypt_sdk, "autoconfigure")
pfs = tdfs.get_platform_features()
tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs)
tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk)
tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk)

ct_file = encrypted_tdf(
encrypt_sdk,
Expand Down Expand Up @@ -556,7 +556,7 @@ def test_autoconfigure_two_kas_and_attr_and_value_grant(
tdfs.skip_if_unsupported(encrypt_sdk, "autoconfigure")
pfs = tdfs.get_platform_features()
tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs)
tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk)
tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk)

ct_file = encrypted_tdf(
encrypt_sdk,
Expand Down Expand Up @@ -600,7 +600,7 @@ def test_autoconfigure_one_attribute_ns_grant(
tdfs.skip_if_unsupported(encrypt_sdk, "autoconfigure", "ns_grants")
pfs = tdfs.get_platform_features()
tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs)
tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk)
tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk)

ct_file = encrypted_tdf(
encrypt_sdk,
Expand Down Expand Up @@ -638,7 +638,7 @@ def test_autoconfigure_two_kas_or_ns_and_value_grant(
tdfs.skip_if_unsupported(encrypt_sdk, "autoconfigure", "ns_grants")
pfs = tdfs.get_platform_features()
tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs)
tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk)
tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk)

ct_file = encrypted_tdf(
encrypt_sdk,
Expand Down Expand Up @@ -683,7 +683,7 @@ def test_autoconfigure_two_kas_and_ns_and_value_grant(
tdfs.skip_if_unsupported(encrypt_sdk, "autoconfigure", "ns_grants")
pfs = tdfs.get_platform_features()
tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs)
tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk)
tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk)

ct_file = encrypted_tdf(
encrypt_sdk,
Expand Down Expand Up @@ -953,7 +953,7 @@ def test_decrypt_uses_kao_kas_registration(
pytest.skip("Not in focus")
encrypt_sdk.skip_if_unsupported("key_management", "autoconfigure")
decrypt_sdk.skip_if_unsupported("key_management")
tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk)
tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk)

attr, key = attribute_with_alternate_kas_registration
ct_file = encrypted_tdf(
Expand Down Expand Up @@ -1030,7 +1030,7 @@ def test_decrypt_rejects_kao_kas_registration_when_disabled(
pytest.skip("Not in focus")
encrypt_sdk.skip_if_unsupported("key_management", "autoconfigure")
decrypt_sdk.skip_if_unsupported("key_management")
tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk)
tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk)

attr, key = attribute_with_alternate_kas_registration_disabled
ct_file = encrypted_tdf(
Expand Down Expand Up @@ -1112,7 +1112,7 @@ def test_decrypt_same_kid_in_different_registries_with_cache(
pytest.skip("Not in focus")
encrypt_sdk.skip_if_unsupported("key_management", "autoconfigure")
decrypt_sdk.skip_if_unsupported("key_management")
tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk)
tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk)

ciphertexts = []
for attr, key in attributes_with_same_kid_in_different_registries:
Expand Down Expand Up @@ -1175,7 +1175,7 @@ def test_autoconfigure_key_management_two_kas_two_keys(
skip_dspx2457(encrypt_sdk)
pfs = tdfs.get_platform_features()
tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs)
tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk)
tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk)

ct_file = encrypted_tdf(
encrypt_sdk,
Expand Down Expand Up @@ -1246,8 +1246,8 @@ def test_import_legacy_golden_r1_key_and_decrypt_no_split(
if not in_focus & {decrypt_sdk}:
pytest.skip("Not in focus")
tdfs.skip_if_unsupported(decrypt_sdk, "key_management")
if not decrypt_sdk.supports("hexless"):
pytest.skip("Decrypting hexless files is not supported")
if not decrypt_sdk.supports("hexless_integrity"):
pytest.skip("Decrypting hexless integrity files is not supported")

from test_legacy import get_golden_file

Expand All @@ -1274,7 +1274,7 @@ def test_encrypt_decrypt_all_containers_with_base_key_e1(
tdfs.skip_if_unsupported(decrypt_sdk, "key_management")
pfs = tdfs.get_platform_features()
tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs)
tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk)
tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk)

sample_name = f"base-e1-{encrypt_sdk}"
ct_file = tmp_dir / f"{sample_name}.tdf"
Expand Down
12 changes: 6 additions & 6 deletions xtest/test_audit_logs_integration.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@ def test_rewrap_success_fields(
pytest.skip("Not in focus")
pfs = tdfs.get_platform_features()
tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs)
tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk)
tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk)

ct_file = tmp_dir / f"rewrap-success-{encrypt_sdk}.tdf"
encrypt_sdk.encrypt(
Expand Down Expand Up @@ -110,7 +110,7 @@ def test_rewrap_success_with_attributes(
pytest.skip("Not in focus")
pfs = tdfs.get_platform_features()
tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs)
tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk)
tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk)
tdfs.skip_if_unsupported(encrypt_sdk, "autoconfigure")

# Create a TDF with an attribute - the test client should have access
Expand Down Expand Up @@ -156,7 +156,7 @@ def test_multiple_kao_rewrap_audit(
pytest.skip("Not in focus")
pfs = tdfs.get_platform_features()
tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs)
tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk)
tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk)
tdfs.skip_if_unsupported(encrypt_sdk, "autoconfigure")

ct_file = tmp_dir / f"multi-kao-{encrypt_sdk}.tdf"
Expand Down Expand Up @@ -310,7 +310,7 @@ def test_decision_on_successful_access(
pytest.skip("Not in focus")
pfs = tdfs.get_platform_features()
tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs)
tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk)
tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk)
tdfs.skip_if_unsupported(encrypt_sdk, "autoconfigure")

ct_file = tmp_dir / f"decision-success-{encrypt_sdk}.tdf"
Expand Down Expand Up @@ -372,7 +372,7 @@ def test_audit_logs_on_tampered_file(
pytest.skip("Not in focus")
pfs = tdfs.get_platform_features()
tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs)
tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk)
tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk)

# Create valid TDF
ct_file = tmp_dir / f"tamper-audit-{encrypt_sdk}.tdf"
Expand Down Expand Up @@ -431,7 +431,7 @@ def test_audit_under_sequential_load(
pytest.skip("Not in focus")
pfs = tdfs.get_platform_features()
tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs)
tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk)
tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk)

num_decrypts = 5

Expand Down
Loading
Loading