refactor: add cert validation to the acquisition, remove old enrollment

crypto/src/lib.rs

@@ -41,10 +41,7 @@ pub use openmls::{
         group_info::VerifiableGroupInfo,
     },
 };
-use wire_e2e_identity::{
-    legacy::{E2eiEnrollment, device_status::DeviceStatus},
-    pki_env::PkiEnvironment,
-};
+use wire_e2e_identity::{legacy::device_status::DeviceStatus, pki_env::PkiEnvironment};
 
 pub use crate::{
     build_metadata::{BUILD_METADATA, BuildMetadata},

crypto/src/mls/conversation/own_commit.rs

@@ -2,6 +2,7 @@ use core_crypto_keystore::Database;
 use openmls::prelude::{
     ConfirmationTag, ContentType, CredentialWithKey, FramedContentBodyIn, MlsMessageIn, MlsMessageInBody, Sender,
 };
+use openmls_traits::OpenMlsCryptoProvider as _;
 
 use super::{Error, Result};
 use crate::{
@@ -98,8 +99,9 @@ impl MlsConversation {
             credential: own_leaf.credential().clone(),
             signature_key: own_leaf.signature_key().clone(),
         };
+        let provider = client.crypto_provider.authentication_service();
         let identity = own_leaf_credential_with_key
-            .extract_identity(self.ciphersuite(), None)
+            .extract_identity(self.ciphersuite(), provider.borrow().await.as_ref())
             .map_err(RecursiveError::mls_credential("extracting identity"))?;
 
         Ok(MlsConversationDecryptMessage {

crypto/src/mls/conversation/pending_conversation.rs

@@ -184,9 +184,22 @@ impl PendingConversation {
             credential: own_leaf.credential().clone(),
             signature_key: own_leaf.signature_key().clone(),
         };
-        let identity = own_leaf_credential_with_key
-            .extract_identity(conversation.ciphersuite(), None)
-            .map_err(RecursiveError::mls_credential("extracting identity"))?;
+        let pki_env = self
+            .context
+            .pki_environment_option()
+            .await
+            .map_err(RecursiveError::transaction("getting PKI environment"))?;
+        let identity = match pki_env {
+            Some(pki_env) => {
+                let provider = pki_env.mls_pki_env_provider();
+                own_leaf_credential_with_key
+                    .extract_identity(conversation.ciphersuite(), provider.borrow().await.as_ref())
+                    .map_err(RecursiveError::mls_credential("extracting identity"))?
+            }
+            None => own_leaf_credential_with_key
+                .extract_identity(conversation.ciphersuite(), None)
+                .map_err(RecursiveError::mls_credential("extracting identity"))?,
+        };
 
         Ok(MlsConversationDecryptMessage {
             app_msg: None,

crypto/src/mls/credential/crl.rs

@@ -1,14 +1,13 @@
 use std::collections::HashSet;
 
-use core_crypto_keystore::{entities::E2eiCrl, traits::FetchFromDatabase};
 use openmls::{
     group::MlsGroup,
     prelude::{Certificate, MlsCredentialType},
 };
-use wire_e2e_identity::{NewCrlDistributionPoints, x509_check::extract_crl_uris};
+use wire_e2e_identity::x509_check::extract_crl_uris;
 
 use super::{Error, Result};
-use crate::{KeystoreError, RecursiveError};
+use crate::RecursiveError;
 
 #[derive(
     Debug,
@@ -52,24 +51,6 @@ pub(crate) fn extract_dp(cert: &Certificate) -> Result<CrlUris> {
         })
 }
 
-pub(crate) async fn get_new_crl_distribution_points(
-    database: &impl FetchFromDatabase,
-    mut crl_dps: HashSet<String>,
-) -> Result<NewCrlDistributionPoints> {
-    if crl_dps.is_empty() {
-        return Ok(None.into());
-    }
-
-    let stored_crls = database
-        .load_all::<E2eiCrl>()
-        .await
-        .map_err(KeystoreError::wrap("finding all e2e crl"))?;
-    let stored_crl_dps: HashSet<&str> = stored_crls.iter().map(|crl| crl.distribution_point.as_str()).collect();
-    crl_dps.retain(|dp| !stored_crl_dps.contains(&dp.as_str()));
-
-    Ok(Some(crl_dps).into())
-}
-
 impl CrlUris {
     fn new() -> Self {
         HashSet::new().into()

crypto/src/mls/credential/error.rs

@@ -15,6 +15,8 @@ pub enum Error {
     InvalidIdentity,
     #[error("No credential for the given public key ({0:?}) was found in this database")]
     CredentialNotFound(SignaturePublicKey),
+    #[error("missing PKI environment")]
+    MissingPKIEnvironment,
     /// Unsupported credential type.
     ///
     /// Supported credential types:

crypto/src/mls/credential/ext.rs

@@ -115,6 +115,7 @@ impl CredentialExt for openmls::prelude::Certificate {
         cs: Ciphersuite,
         env: Option<&wire_e2e_identity::x509_check::revocation::PkiEnvironment>,
     ) -> Result<WireIdentity> {
+        let env = env.ok_or_else(|| Error::MissingPKIEnvironment)?;
         let leaf = self.certificates.first().ok_or(Error::InvalidIdentity)?;
         let leaf = leaf.as_slice();
         use wire_e2e_identity::WireIdentityReader as _;

crypto/src/mls/credential/x509.rs

@@ -69,7 +69,11 @@ impl fmt::Debug for CertificateBundle {
 
 impl CertificateBundle {
     /// Reads the client_id from the leaf certificate
-    pub fn get_client_id(&self) -> Result<ClientId> {
+    pub fn get_client_id(
+        &self,
+        env: Option<&wire_e2e_identity::x509_check::revocation::PkiEnvironment>,
+    ) -> Result<ClientId> {
+        let env = env.ok_or_else(|| Error::MissingPKIEnvironment)?;
         let leaf = self.certificate_chain.first().ok_or(Error::InvalidIdentity)?;
 
         let hash_alg = match self.signature_scheme {
@@ -79,7 +83,7 @@ impl CertificateBundle {
         };
 
         let identity = leaf
-            .extract_identity(None, hash_alg)
+            .extract_identity(env, hash_alg)
             .map_err(|_| Error::InvalidIdentity)?;
 
         use wire_e2e_identity::legacy::id as legacy_id;

crypto/src/mls/mod.rs

@@ -117,8 +117,9 @@ mod tests {
                     CertificateBundle::rand_identifier(&session_id, &[x509_test_chain.find_local_intermediate_ca()])
                 }
             };
+            let provider = cc.get_pki_environment().await.unwrap().mls_pki_env_provider();
             let session_id = identifier
-                .get_id()
+                .get_id(provider.borrow().await.as_ref())
                 .expect("get session_id from identifier")
                 .into_owned();
             context

crypto/src/mls/session/e2e_identity.rs

@@ -119,6 +119,11 @@ impl<D> Session<D> {
         _credential_type: CredentialType,
         env: Option<&wire_e2e_identity::x509_check::revocation::PkiEnvironment>,
     ) -> E2eiConversationState {
+        let env = match env {
+            Some(e) => e,
+            None => return E2eiConversationState::NotEnabled,
+        };
+
         let mut is_e2ei = false;
         let mut state = E2eiConversationState::Verified;
 
@@ -138,10 +143,7 @@ impl<D> Session<D> {
             use openmls_x509_credential::X509Ext as _;
             let is_time_valid = cert.is_time_valid().unwrap_or(false);
             let is_time_invalid = !is_time_valid;
-            let is_revoked_or_invalid = env
-                .map(|e| e.validate_cert_and_revocation(&cert).is_err())
-                .unwrap_or(false);
-
+            let is_revoked_or_invalid = env.validate_cert_and_revocation(&cert).is_err();
             let is_invalid = invalid_identity || is_time_invalid || is_revoked_or_invalid;
             if is_invalid {
                 state = E2eiConversationState::NotVerified;

crypto/src/mls/session/identifier.rs

@@ -19,7 +19,10 @@ pub enum ClientIdentifier {
 impl ClientIdentifier {
     /// Extract the unique [ClientId] from an identifier. Use with parsimony as, in case of a x509
     /// certificate this leads to parsing the certificate
-    pub fn get_id(&self) -> Result<std::borrow::Cow<'_, ClientIdRef>> {
+    pub fn get_id(
+        &self,
+        env: Option<&wire_e2e_identity::x509_check::revocation::PkiEnvironment>,
+    ) -> Result<std::borrow::Cow<'_, ClientIdRef>> {
         match self {
             ClientIdentifier::Basic(id) => Ok(std::borrow::Cow::Borrowed(id)),
             ClientIdentifier::X509(certs) => {
@@ -28,7 +31,7 @@ impl ClientIdentifier {
                 // that's not a getter's job
                 let cert = certs.values().next().ok_or(Error::NoX509CertificateBundle)?;
                 let id = cert
-                    .get_client_id()
+                    .get_client_id(env)
                     .map_err(RecursiveError::mls_credential("getting client id"))?;
                 Ok(std::borrow::Cow::Owned(id))
             }

crypto/src/mls_provider/crypto_provider.rs

@@ -65,6 +65,9 @@ impl RustCrypto {
         Ok(())
     }
 
+    // TODO: remove this expect(unused) once we start using it again or we drop
+    // it completely (see WPB-23594)
+    #[expect(unused)]
     pub(crate) fn normalize_p521_secret_key(sk: &[u8]) -> zeroize::Zeroizing<[u8; 66]> {
         normalize_p521_secret_key(sk)
     }

crypto/src/proteus.rs

@@ -645,8 +645,9 @@ mod tests {
                 CertificateBundle::rand_identifier(&session_id, &[x509_test_chain.find_local_intermediate_ca()])
             }
         };
+        let provider = cc.get_pki_environment().await.unwrap().mls_pki_env_provider();
         let session_id = identifier
-            .get_id()
+            .get_id(provider.borrow().await.as_ref())
             .expect("Getting session id from identifier")
             .into_owned();
         transaction.mls_init(session_id, transport).await.unwrap();

crypto/src/test_utils/context.rs

@@ -230,15 +230,22 @@ impl SessionContext {
         if let openmls::prelude::MlsCredentialType::X509(certificate) =
             &expected_credential.mls_credential().mls_credential()
         {
-            let mls_identity = certificate.extract_identity(case.ciphersuite(), None).unwrap();
+            let session = self.session().await;
+            let provider = session.crypto_provider;
+            let guard = provider.authentication_service().borrow().await;
+            let env = match guard.as_ref() {
+                Some(env) => env,
+                None => unreachable!("PKI environment must be set"),
+            };
+            let mls_identity = certificate.extract_identity(case.ciphersuite(), Some(env)).unwrap();
             let mls_client_id = mls_identity.client_id.as_bytes();
 
             let decrypted_identity = &decrypted.identity;
 
             let leaf: Vec<u8> = certificate.certificates.first().unwrap().clone().into();
             let identity = leaf
                 .as_slice()
-                .extract_identity(None, case.ciphersuite().e2ei_hash_alg())
+                .extract_identity(env, case.ciphersuite().e2ei_hash_alg())
                 .unwrap();
             let identity = WireIdentity::try_from((identity, leaf.as_slice())).unwrap();
 
@@ -263,7 +270,7 @@ impl SessionContext {
             );
             let chain = x509_cert::Certificate::load_pem_chain(decrypted_x509_identity.certificate.as_bytes()).unwrap();
             let leaf = chain.first().unwrap();
-            let cert_identity = leaf.extract_identity(None, case.ciphersuite().e2ei_hash_alg()).unwrap();
+            let cert_identity = leaf.extract_identity(env, case.ciphersuite().e2ei_hash_alg()).unwrap();
 
             let cert_identity = WireIdentity::try_from((cert_identity, leaf.to_der().unwrap().as_slice())).unwrap();
             assert_eq!(cert_identity.client_id, identity.client_id);

crypto/src/test_utils/mod.rs

@@ -18,6 +18,7 @@ use std::{collections::HashMap, sync::Arc};
 
 use async_lock::RwLock;
 use openmls::framing::MlsMessageOut;
+use openmls_traits::OpenMlsCryptoProvider as _;
 pub use openmls_traits::types::SignatureScheme;
 use wire_e2e_identity::pki_env::PkiEnvironment;
 
@@ -118,18 +119,8 @@ impl SessionContext {
             .unwrap();
 
         let core_crypto = CoreCrypto::new(db.clone());
-
         let transaction = core_crypto.new_transaction().await.unwrap();
 
-        let session_id = identifier
-            .get_id()
-            .map_err(RecursiveError::mls_client("getting client id"))?
-            .into_owned();
-        transaction
-            .mls_init(session_id, context.transport.clone())
-            .await
-            .map_err(RecursiveError::transaction("mls init"))?;
-
         // Setup the X509 PKI environment
         if let Some(chain) = chain.as_ref() {
             let dummy_hooks = Arc::new(DummyPkiEnvironmentHooks);
@@ -143,6 +134,25 @@ impl SessionContext {
             chain.register_with_central(&transaction).await;
         }
 
+        let pki_env = core_crypto.get_pki_environment().await;
+        let session_id = match pki_env {
+            Some(pki_env) => {
+                let provider = pki_env.mls_pki_env_provider();
+                identifier
+                    .get_id(provider.borrow().await.as_ref())
+                    .map_err(RecursiveError::mls_client("getting client id"))?
+                    .into_owned()
+            }
+            None => identifier
+                .get_id(None)
+                .map_err(RecursiveError::mls_client("getting client id"))?
+                .into_owned(),
+        };
+        transaction
+            .mls_init(session_id, context.transport.clone())
+            .await
+            .map_err(RecursiveError::transaction("mls init"))?;
+
         let session = transaction.session().await.unwrap();
 
         let credential = Credential::from_identifier(&identifier, context.ciphersuite())
@@ -306,7 +316,11 @@ impl SessionContext {
             CredentialType::X509 => {
                 let signer = signer.expect("Missing intermediate CA");
                 let cert = CertificateBundle::rand(&session_id, signer);
-                let session_id = cert.get_client_id().expect("Getting client id from certificate bundle");
+                let session = self.session.read().await;
+                let guard = session.crypto_provider.authentication_service().borrow().await;
+                let session_id = cert
+                    .get_client_id(guard.as_ref())
+                    .expect("Getting client id from certificate bundle");
 
                 let credential = Credential::x509(case.ciphersuite(), cert).expect("creating  x509 credential");
 

crypto/src/test_utils/test_conversation/mod.rs

@@ -1,6 +1,7 @@
 use std::sync::Arc;
 
 use openmls::{group::QueuedProposal, prelude::group_info::VerifiableGroupInfo};
+use openmls_traits::OpenMlsCryptoProvider as _;
 
 use super::{CredentialType, MessageExt as _, MlsTransportTestExt, SessionContext, TestContext, TestError};
 use crate::{
@@ -385,7 +386,11 @@ impl<'a> TestConversation<'a> {
         let credential = credential_ref.load(&database).await.unwrap();
         let mls_credential_with_key = credential.to_mls_credential_with_key();
         let ciphersuite = self.case.ciphersuite();
-        let local_identity = mls_credential_with_key.extract_identity(ciphersuite, None).unwrap();
+        let session = self.actor().session().await;
+        let provider = session.crypto_provider.authentication_service();
+        let local_identity = mls_credential_with_key
+            .extract_identity(ciphersuite, provider.borrow().await.as_ref())
+            .unwrap();
 
         assert_eq!(&local_identity.client_id.as_bytes(), &cid.0);
         assert_eq!(
@@ -404,7 +409,9 @@ impl<'a> TestConversation<'a> {
         };
 
         assert_eq!(credential.credential.identity(), &cid.0);
-        let keystore_identity = credential.extract_identity(ciphersuite, None).unwrap();
+        let keystore_identity = credential
+            .extract_identity(ciphersuite, provider.borrow().await.as_ref())
+            .unwrap();
         assert_eq!(
             keystore_identity.x509_identity.as_ref().unwrap().display_name,
             new_display_name

crypto/src/transaction_context/e2e_identity/init_certificates.rs

@@ -82,11 +82,6 @@ impl TransactionContext {
         self.e2ei_register_intermediate_ca(inter_ca).await
     }
 
-    pub(crate) async fn e2ei_register_intermediate_ca_der(&self, cert_der: &[u8]) -> Result<NewCrlDistributionPoints> {
-        let inter_ca = x509_cert::Certificate::from_der(cert_der)?;
-        self.e2ei_register_intermediate_ca(inter_ca).await
-    }
-
     async fn e2ei_register_intermediate_ca(
         &self,
         inter_ca: x509_cert::Certificate,