[PM-115] Cipher key encryption update

src/Core/Constants.cs

@@ -59,6 +59,7 @@ public static class Constants
         public const int Argon2MemoryInMB = 64;
         public const int Argon2Parallelism = 4;
         public const int MasterPasswordMinimumChars = 12;
+        public const int CipherKeyRandomBytesLength = 64;
 
         public static readonly string[] AndroidAllClearCipherCacheKeys =
         {

src/Core/Models/Data/CipherData.cs

@@ -26,6 +26,8 @@ public CipherData(CipherResponse response, string userId = null, HashSet<string>
             Notes = response.Notes;
             CollectionIds = collectionIds?.ToList() ?? response.CollectionIds;
             Reprompt = response.Reprompt;
+            Key = response.Key;
+            ForceKeyRotation = response.ForceKeyRotation;
 
             try // Added to address Issue (https://github.com/bitwarden/mobile/issues/1006)
             {
@@ -86,5 +88,7 @@ public CipherData(CipherResponse response, string userId = null, HashSet<string>
         public List<string> CollectionIds { get; set; }
         public DateTime? DeletedDate { get; set; }
         public Enums.CipherRepromptType Reprompt { get; set; }
+        public string Key { get; set; }
+        public bool ForceKeyRotation { get; set; }
     }
 }

src/Core/Models/Domain/Attachment.cs

@@ -1,8 +1,10 @@
-using System.Collections.Generic;
+using System;
+using System.Collections.Generic;
 using System.Threading.Tasks;
 using Bit.Core.Abstractions;
 using Bit.Core.Models.Data;
 using Bit.Core.Models.View;
+using Bit.Core.Services;
 using Bit.Core.Utilities;
 
 namespace Bit.Core.Models.Domain
@@ -11,19 +13,19 @@ public class Attachment : Domain
     {
         private HashSet<string> _map = new HashSet<string>
         {
-            "Id",
-            "Url",
-            "SizeName",
-            "FileName",
-            "Key"
+            nameof(Id),
+            nameof(Url),
+            nameof(SizeName),
+            nameof(FileName),
+            nameof(Key)
         };
 
         public Attachment() { }
 
         public Attachment(AttachmentData obj, bool alreadyEncrypted = false)
         {
             Size = obj.Size;
-            BuildDomainModel(this, obj, _map, alreadyEncrypted, new HashSet<string> { "Id", "Url", "SizeName" });
+            BuildDomainModel(this, obj, _map, alreadyEncrypted, new HashSet<string> { nameof(Id), nameof(Url), nameof(SizeName) });
         }
 
         public string Id { get; set; }
@@ -33,25 +35,26 @@ public Attachment(AttachmentData obj, bool alreadyEncrypted = false)
         public EncString Key { get; set; }
         public EncString FileName { get; set; }
 
-        public async Task<AttachmentView> DecryptAsync(string orgId)
+        public async Task<AttachmentView> DecryptAsync(string orgId, SymmetricCryptoKey key = null)
         {
             var view = await DecryptObjAsync(new AttachmentView(this), this, new HashSet<string>
             {
-                "FileName"
-            }, orgId);
+                nameof(FileName)
+            }, orgId, key);
 
             if (Key != null)
             {
-                var cryptoService = ServiceContainer.Resolve<ICryptoService>("cryptoService");
                 try
                 {
-                    var orgKey = await cryptoService.GetOrgKeyAsync(orgId);
-                    var decValue = await cryptoService.DecryptToBytesAsync(Key, orgKey);
+                    var cryptoService = ServiceContainer.Resolve<ICryptoService>();
+
+                    var decryptKey = key ?? await cryptoService.GetOrgKeyAsync(orgId);
+                    var decValue = await cryptoService.DecryptToBytesAsync(Key, decryptKey);
                     view.Key = new SymmetricCryptoKey(decValue);
                 }
-                catch
+                catch (Exception ex)
                 {
-                    // TODO: error?
+                    LoggerHelper.LogEvenIfCantBeResolved(ex);
                 }
             }
             return view;
@@ -61,7 +64,7 @@ public AttachmentData ToAttachmentData()
         {
             var a = new AttachmentData();
             a.Size = Size;
-            BuildDataModel(this, a, _map, new HashSet<string> { "Id", "Url", "SizeName" });
+            BuildDataModel(this, a, _map, new HashSet<string> { nameof(Id), nameof(Url), nameof(SizeName) });
             return a;
         }
     }

src/Core/Models/Domain/Card.cs

@@ -31,9 +31,9 @@ public Card(CardData obj, bool alreadyEncrypted = false)
         public EncString ExpYear { get; set; }
         public EncString Code { get; set; }
 
-        public Task<CardView> DecryptAsync(string orgId)
+        public Task<CardView> DecryptAsync(string orgId, SymmetricCryptoKey key = null)
         {
-            return DecryptObjAsync(new CardView(this), this, _map, orgId);
+            return DecryptObjAsync(new CardView(this), this, _map, orgId, key);
         }
 
         public CardData ToCardData()

src/Core/Models/Domain/Cipher.cs

@@ -1,10 +1,13 @@
 using System;
 using System.Collections.Generic;
 using System.Linq;
+using System.Security.Cryptography;
 using System.Threading.Tasks;
+using Bit.Core.Abstractions;
 using Bit.Core.Enums;
 using Bit.Core.Models.Data;
 using Bit.Core.Models.View;
+using Bit.Core.Utilities;
 
 namespace Bit.Core.Models.Domain
 {
@@ -16,12 +19,12 @@ public Cipher(CipherData obj, bool alreadyEncrypted = false, Dictionary<string,
         {
             BuildDomainModel(this, obj, new HashSet<string>
             {
-                "Id",
-                "OrganizationId",
-                "FolderId",
-                "Name",
-                "Notes"
-            }, alreadyEncrypted, new HashSet<string> { "Id", "OrganizationId", "FolderId" });
+                nameof(Id),
+                nameof(OrganizationId),
+                nameof(FolderId),
+                nameof(Name),
+                nameof(Notes)
+            }, alreadyEncrypted, new HashSet<string> { nameof(Id), nameof(OrganizationId), nameof(FolderId) });
 
             Type = obj.Type;
             Favorite = obj.Favorite;
@@ -32,6 +35,12 @@ public Cipher(CipherData obj, bool alreadyEncrypted = false, Dictionary<string,
             CollectionIds = obj.CollectionIds != null ? new HashSet<string>(obj.CollectionIds) : null;
             LocalData = localData;
             Reprompt = obj.Reprompt;
+            ForceKeyRotation = obj.ForceKeyRotation;
+
+            if (obj.Key != null)
+            {
+                Key = new EncString(obj.Key);
+            }
 
             switch (Type)
             {
@@ -79,29 +88,44 @@ public Cipher(CipherData obj, bool alreadyEncrypted = false, Dictionary<string,
         public HashSet<string> CollectionIds { get; set; }
         public DateTime? DeletedDate { get; set; }
         public CipherRepromptType Reprompt { get; set; }
+        public EncString Key { get; set; }
+        public bool ForceKeyRotation { get; set; }
 
         public async Task<CipherView> DecryptAsync()
         {
             var model = new CipherView(this);
+
+            if (Key != null)
+            {
+                // HACK: I don't like resolving this here but I can't see a better way without
+                // refactoring a lot of things.
+                var cryptoService = ServiceContainer.Resolve<ICryptoService>();
+
+                var orgKey = await cryptoService.GetOrgKeyAsync(OrganizationId);
+
+                var key = await cryptoService.DecryptToBytesAsync(Key, orgKey);
+                model.Key = new SymmetricCryptoKey(key);
+            }
+
             await DecryptObjAsync(model, this, new HashSet<string>
             {
-                "Name",
-                "Notes"
-            }, OrganizationId);
+                nameof(Name),
+                nameof(Notes)
+            }, OrganizationId, model.Key);
 
             switch (Type)
             {
                 case Enums.CipherType.Login:
-                    model.Login = await Login.DecryptAsync(OrganizationId);
+                    model.Login = await Login.DecryptAsync(OrganizationId, model.Key);
                     break;
                 case Enums.CipherType.SecureNote:
-                    model.SecureNote = await SecureNote.DecryptAsync(OrganizationId);
+                    model.SecureNote = await SecureNote.DecryptAsync(OrganizationId, model.Key);
                     break;
                 case Enums.CipherType.Card:
-                    model.Card = await Card.DecryptAsync(OrganizationId);
+                    model.Card = await Card.DecryptAsync(OrganizationId, model.Key);
                     break;
                 case Enums.CipherType.Identity:
-                    model.Identity = await Identity.DecryptAsync(OrganizationId);
+                    model.Identity = await Identity.DecryptAsync(OrganizationId, model.Key);
                     break;
                 default:
                     break;
@@ -113,7 +137,7 @@ public async Task<CipherView> DecryptAsync()
                 var tasks = new List<Task>();
                 async Task decryptAndAddAttachmentAsync(Attachment attachment)
                 {
-                    var decAttachment = await attachment.DecryptAsync(OrganizationId);
+                    var decAttachment = await attachment.DecryptAsync(OrganizationId, model.Key);
                     model.Attachments.Add(decAttachment);
                 }
                 foreach (var attachment in Attachments)
@@ -128,7 +152,7 @@ async Task decryptAndAddAttachmentAsync(Attachment attachment)
                 var tasks = new List<Task>();
                 async Task decryptAndAddFieldAsync(Field field)
                 {
-                    var decField = await field.DecryptAsync(OrganizationId);
+                    var decField = await field.DecryptAsync(OrganizationId, model.Key);
                     model.Fields.Add(decField);
                 }
                 foreach (var field in Fields)
@@ -143,7 +167,7 @@ async Task decryptAndAddFieldAsync(Field field)
                 var tasks = new List<Task>();
                 async Task decryptAndAddHistoryAsync(PasswordHistory ph)
                 {
-                    var decPh = await ph.DecryptAsync(OrganizationId);
+                    var decPh = await ph.DecryptAsync(OrganizationId, model.Key);
                     model.PasswordHistory.Add(decPh);
                 }
                 foreach (var ph in PasswordHistory)
@@ -171,11 +195,13 @@ public CipherData ToCipherData(string userId)
                 CollectionIds = CollectionIds.ToList(),
                 DeletedDate = DeletedDate,
                 Reprompt = Reprompt,
+                Key = Key?.EncryptedString,
+                ForceKeyRotation = ForceKeyRotation
             };
             BuildDataModel(this, c, new HashSet<string>
             {
-                "Name",
-                "Notes"
+                nameof(Name),
+                nameof(Notes)
             });
             switch (c.Type)
             {

src/Core/Models/Domain/Field.cs

@@ -28,9 +28,9 @@ public Field(FieldData obj, bool alreadyEncrypted = false)
         public FieldType Type { get; set; }
         public LinkedIdType? LinkedId { get; set; }
 
-        public Task<FieldView> DecryptAsync(string orgId)
+        public Task<FieldView> DecryptAsync(string orgId, SymmetricCryptoKey key = null)
         {
-            return DecryptObjAsync(new FieldView(this), this, _map, orgId);
+            return DecryptObjAsync(new FieldView(this), this, _map, orgId, key);
         }
 
         public FieldData ToFieldData()

src/Core/Models/Domain/Identity.cs

@@ -55,9 +55,9 @@ public Identity(IdentityData obj, bool alreadyEncrypted = false)
         public EncString PassportNumber { get; set; }
         public EncString LicenseNumber { get; set; }
 
-        public Task<IdentityView> DecryptAsync(string orgId)
+        public Task<IdentityView> DecryptAsync(string orgId, SymmetricCryptoKey key = null)
         {
-            return DecryptObjAsync(new IdentityView(this), this, _map, orgId);
+            return DecryptObjAsync(new IdentityView(this), this, _map, orgId, key);
         }
 
         public IdentityData ToIdentityData()

src/Core/Models/Domain/Login.cs

@@ -29,20 +29,20 @@ public Login(LoginData obj, bool alreadyEncrypted = false)
         public DateTime? PasswordRevisionDate { get; set; }
         public EncString Totp { get; set; }
 
-        public async Task<LoginView> DecryptAsync(string orgId)
+        public async Task<LoginView> DecryptAsync(string orgId, SymmetricCryptoKey key = null)
         {
             var view = await DecryptObjAsync(new LoginView(this), this, new HashSet<string>
             {
                 "Username",
                 "Password",
                 "Totp"
-            }, orgId);
+            }, orgId, key);
             if (Uris != null)
             {
                 view.Uris = new List<LoginUriView>();
                 foreach (var uri in Uris)
                 {
-                    view.Uris.Add(await uri.DecryptAsync(orgId));
+                    view.Uris.Add(await uri.DecryptAsync(orgId, key));
                 }
             }
             return view;

src/Core/Models/Domain/LoginUri.cs

@@ -24,9 +24,9 @@ public LoginUri(LoginUriData obj, bool alreadyEncrypted = false)
         public EncString Uri { get; set; }
         public UriMatchType? Match { get; set; }
 
-        public Task<LoginUriView> DecryptAsync(string orgId)
+        public Task<LoginUriView> DecryptAsync(string orgId, SymmetricCryptoKey key = null)
         {
-            return DecryptObjAsync(new LoginUriView(this), this, _map, orgId);
+            return DecryptObjAsync(new LoginUriView(this), this, _map, orgId, key);
         }
 
         public LoginUriData ToLoginUriData()

src/Core/Models/Domain/PasswordHistory.cs

@@ -24,9 +24,9 @@ public PasswordHistory(PasswordHistoryData obj, bool alreadyEncrypted = false)
         public EncString Password { get; set; }
         public DateTime LastUsedDate { get; set; }
 
-        public Task<PasswordHistoryView> DecryptAsync(string orgId)
+        public Task<PasswordHistoryView> DecryptAsync(string orgId, SymmetricCryptoKey key = null)
         {
-            return DecryptObjAsync(new PasswordHistoryView(this), this, _map, orgId);
+            return DecryptObjAsync(new PasswordHistoryView(this), this, _map, orgId, key);
         }
 
         public PasswordHistoryData ToPasswordHistoryData()

src/Core/Models/Domain/SecureNote.cs

@@ -16,7 +16,7 @@ public SecureNote(SecureNoteData obj, bool alreadyEncrypted = false)
 
         public SecureNoteType Type { get; set; }
 
-        public Task<SecureNoteView> DecryptAsync(string orgId)
+        public Task<SecureNoteView> DecryptAsync(string orgId, SymmetricCryptoKey key = null)
         {
             return Task.FromResult(new SecureNoteView(this));
         }

src/Core/Models/Request/CipherRequest.cs

@@ -19,6 +19,8 @@ public CipherRequest(Cipher cipher)
             Favorite = cipher.Favorite;
             LastKnownRevisionDate = cipher.RevisionDate;
             Reprompt = cipher.Reprompt;
+            Key = cipher.Key?.EncryptedString;
+            ForceKeyRotation = cipher.ForceKeyRotation;
 
             switch (Type)
             {
@@ -124,5 +126,7 @@ public CipherRequest(Cipher cipher)
         public Dictionary<string, AttachmentRequest> Attachments2 { get; set; }
         public DateTime LastKnownRevisionDate { get; set; }
         public CipherRepromptType Reprompt { get; set; }
+        public string Key { get; set; }
+        public bool ForceKeyRotation { get; set; }
     }
 }

src/Core/Models/Response/CipherResponse.cs

@@ -28,5 +28,7 @@ public class CipherResponse
         public List<string> CollectionIds { get; set; }
         public DateTime? DeletedDate { get; set; }
         public CipherRepromptType Reprompt { get; set; }
+        public string Key { get; set; }
+        public bool ForceKeyRotation { get; set; }
     }
 }

src/Core/Models/View/CipherView.cs

@@ -25,6 +25,7 @@ public CipherView(Cipher c)
             RevisionDate = c.RevisionDate;
             DeletedDate = c.DeletedDate;
             Reprompt = c.Reprompt;
+            ForceKeyRotation = c.ForceKeyRotation;
         }
 
         public string Id { get; set; }
@@ -49,6 +50,8 @@ public CipherView(Cipher c)
         public DateTime RevisionDate { get; set; }
         public DateTime? DeletedDate { get; set; }
         public CipherRepromptType Reprompt { get; set; }
+        public SymmetricCryptoKey Key { get; set; }
+        public bool ForceKeyRotation { get; set; }
 
         public ItemView Item
         {