Use AES/GCM for the JWE encrypted message as suggested by the Nimbus team

app-domain/src/main/java/mobi/lab/keyimportdemo/domain/DomainConstants.kt

@@ -1,6 +1,8 @@
 package mobi.lab.keyimportdemo.domain
 
 object DomainConstants {
+    const val TEK_KEY_SIZE_BITS = 256
+    const val CEK_KEY_SIZE_BITS = 256
     const val DEVICE_TEE_WRAPPING_KEY_ALIAS = "device_wrapping_key_alias"
     const val DEVICE_TEE_IMPORT_KEY_ALIAS = "device_wrapped_key_alias"
 }

app-domain/src/main/java/mobi/lab/keyimportdemo/domain/entities/DomainException.kt

@@ -31,5 +31,13 @@ class DomainException(
         fun noSuchImportedKeyFound(keyAlias: String): DomainException {
             return DomainException(ErrorCode.NO_SUCH_IMPORTED_KEY_FOUND, keyAlias)
         }
+
+        fun noSuchServerKeyFound(keyAlias: String): DomainException {
+            return DomainException(ErrorCode.NO_SUCH_SERVER_KEY_FOUND, keyAlias)
+        }
+
+        fun decryptedMessageDoesNotMatchTheOriginalMessage(message: String): DomainException {
+            return DomainException(ErrorCode.DECRYPTED_MESSAGE_DOES_NOT_MATCH_THE_ORIGINAL_MESSAGE, message)
+        }
     }
 }

app-domain/src/main/java/mobi/lab/keyimportdemo/domain/entities/ErrorCode.kt

@@ -6,6 +6,8 @@ enum class ErrorCode(val code: String) {
     LOCAL_UNAUTHORIZED("local-unauthorized"),
     LOCAL_NO_NETWORK("local-no-network"),
     NO_SUCH_IMPORTED_KEY_FOUND("no-such-imported-key-found"),
+    NO_SUCH_SERVER_KEY_FOUND("no-such-server-key-found"),
+    DECRYPTED_MESSAGE_DOES_NOT_MATCH_THE_ORIGINAL_MESSAGE("decrypted-message-does-not-match-the-original-message"),
     LOCAL_INVALID_CREDENTIALS("local-invalid-credentials");
 
     companion object {

app-domain/src/main/java/mobi/lab/keyimportdemo/domain/entities/KeyImportTestResult.kt

@@ -1,10 +1,7 @@
 package mobi.lab.keyimportdemo.domain.entities
 
 sealed class KeyImportTestResult {
-    data class SuccessHardwareTeeStrongBox(val message: String) : KeyImportTestResult()
-    data class SuccessHardwareTeeNoStrongbox(val message: String) : KeyImportTestResult()
-    data class SuccessSoftwareTeeOnly(val message: String) : KeyImportTestResult()
-    data class SuccessTeeUnknown(val message: String) : KeyImportTestResult()
+    data class Success(val keyTestResult: KeyUsageTestResult) : KeyImportTestResult()
     object FailedKeyImportNotSupportedOnThisApiLevel : KeyImportTestResult()
     object FailedKeyImportNotAvailableOnThisDevice : KeyImportTestResult()
     object FailedTestDecryptionResultDifferentThanInput : KeyImportTestResult()

app-domain/src/main/java/mobi/lab/keyimportdemo/domain/entities/KeyUsageTestResult.kt

@@ -0,0 +1,14 @@
+package mobi.lab.keyimportdemo.domain.entities
+
+import mobi.lab.keyimportdemo.domain.gateway.CryptoClientGateway
+
+sealed class KeyUsageTestResult {
+    data class UsageSuccess(
+        val keyLevel: CryptoClientGateway.KeyTeeSecurityLevel,
+        val serverToClientMessage: String,
+        val clientToServerMessage: String
+    ) : KeyUsageTestResult()
+
+    object UsageFailedNoSuchKey : KeyUsageTestResult()
+    data class UsageFailedGeneric(val throwable: Throwable) : KeyUsageTestResult()
+}

app-domain/src/main/java/mobi/lab/keyimportdemo/domain/gateway/CryptoClientGateway.kt

@@ -1,62 +1,37 @@
 package mobi.lab.keyimportdemo.domain.gateway
 
-import java.security.NoSuchAlgorithmException
-import java.security.NoSuchProviderException
 import java.security.PublicKey
-import java.security.spec.InvalidKeySpecException
 
 @Suppress("EmptyClassBlock")
 interface CryptoClientGateway {
-    @Throws(Exception::class)
     fun generateRsaKeyPairInDeviceTee(alias: String, isStrongBoxBacked: Boolean): PublicKey
-
-    @Throws(NoSuchAlgorithmException::class, NoSuchProviderException::class, InvalidKeySpecException::class)
-    fun getSecretKeySecurityLevel(keyStoreKeyAlias: String): KeySecurityLevel
-
-    @Throws(NoSuchAlgorithmException::class, NoSuchProviderException::class, InvalidKeySpecException::class)
-    fun getPrivateKeySecurityLevel(keyStoreKeyAlias: String): CryptoClientGateway.KeySecurityLevel
-
-    @Throws(Exception::class)
+    fun getSecretKeySecurityLevel(keyStoreKeyAlias: String): KeyTeeSecurityLevel
+    fun getPrivateKeySecurityLevel(keyStoreKeyAlias: String): KeyTeeSecurityLevel
     fun encodeRsaPublicKeyAsJwk(alias: String, publicKey: PublicKey): String
-
-    @Throws(Exception::class)
     fun importWrappedKeyFromServer(asn1DerEncodedWrappedKey: ByteArray, wrappingKeyAliasInKeysStore: String, wrappedKeyAlias: String)
+    fun decryptJWEWithImportedKey(keyStoreKeyAlias: String, messageWrappedTekEncryptedJWE: String): String
+    fun encryptMessageWithTekToJWE(message: String, keyStoreKeyAlias: String, keySizeBits: Int): String
 
-    @Throws(Exception::class)
-    fun decryptJWEWithImportedWrappedKey(keyStoreKeyAlias: String, messageWrappedTekEncryptedJWE: String): String
-
-    @Throws(Exception::class)
-    fun encryptTextWithImportedKey(keyStoreKeyAlias: String, secretMessage: String): ByteArray
-
-    @Throws(Exception::class)
-    fun decryptTextWithImportedKey(keyStoreKeyAlias: String, messageTekEncryptedAtClient: ByteArray): String
-
-    @Throws(Exception::class)
-    fun encryptTextWithWrappingKey(keyStoreKeyAlias: String, secretMessage: String): ByteArray
-
-    @Throws(Exception::class)
-    fun decryptTextWithWrappingKey(keyStoreKeyAlias: String, messageTekEncryptedAtClient: ByteArray): String
-
-    sealed class KeySecurityLevel {
-        object TeeStrongbox : KeySecurityLevel() {
+    sealed class KeyTeeSecurityLevel {
+        object TeeStrongbox : KeyTeeSecurityLevel() {
             override fun toString(): String {
                 return "KeySecurityLevel.TeeStrongbox"
             }
         }
 
-        object TeeHardwareNoStrongbox : KeySecurityLevel() {
+        object TeeHardwareNoStrongbox : KeyTeeSecurityLevel() {
             override fun toString(): String {
                 return "KeySecurityLevel.TeeHardwareNoStrongbox"
             }
         }
 
-        object TeeSoftware : KeySecurityLevel() {
+        object TeeSoftware : KeyTeeSecurityLevel() {
             override fun toString(): String {
                 return "KeySecurityLevel.TeeSoftware"
             }
         }
 
-        object Unknown : KeySecurityLevel() {
+        object Unknown : KeyTeeSecurityLevel() {
             override fun toString(): String {
                 return "KeySecurityLevel.Unknown"
             }

app-domain/src/main/java/mobi/lab/keyimportdemo/domain/gateway/CryptoServerGateway.kt

@@ -9,14 +9,14 @@ interface CryptoServerGateway {
 
     @Throws(Exception::class)
     fun decodeRsaPublicKeyFromJWKString(jwkString: String): PublicKey
-    fun generateAesTek(keySize: Int): SecretKeySpec
-    fun generateTekImportMetadata(keySizeBytes: Int, keyMasterAlgorithm: Int): DERSequence
-    fun generateAesCek(cekKeySizeBytes: Int): SecretKeySpec
+    fun generateAesTek(keySizeBits: Int): SecretKeySpec
+    fun generateTekImportMetadata(keySizeBits: Int, keyMasterAlgorithm: Int): DERSequence
+    fun generateAesCek(cekKeySizeBits: Int): SecretKeySpec
     fun encryptCekWithRsaPublicKey(cekAesKey: SecretKeySpec, rsaKeyPairPublicKey: PublicKey): ByteArray
     fun encryptTekWithCek(tekAesWrappedKey: SecretKeySpec, wrappedKeyDescription: DERSequence, cekAesKey: SecretKeySpec): EncryptedTekWrapper
     fun encodeTekAndCetToAsn1Der(tekEncryptedWrapper: EncryptedTekWrapper, cekEncrypted: ByteArray, tekImportMetadata: DERSequence): ByteArray
     fun encryptMessageWithTekToJWE(message: String, tekAesKeyAtServer: SecretKeySpec): String
-    fun encryptMessageWithTek(message: String, tekAesKeyAtServer: SecretKeySpec): ByteArray
+    fun decryptJWEWithImportedKey(messageWrappedTekEncryptedJWE: String, tekAesKeyAtServer: SecretKeySpec): String
 
     @Suppress("ArrayInDataClass")
     data class EncryptedTekWrapper(val encryptedTek: ByteArray, val tag: ByteArray, val initializationVector: ByteArray)

app-domain/src/main/java/mobi/lab/keyimportdemo/domain/storage/ServerSecretKeyStorage.kt

@@ -0,0 +1,7 @@
+package mobi.lab.keyimportdemo.domain.storage
+
+interface ServerSecretKeyStorage {
+    fun save(keyBytes: ByteArray)
+    fun load(): ByteArray?
+    fun clear()
+}