Merge branch 'main' into nano-base-key

Author: mkleene

.github/workflows/codeql.yaml

@@ -4,8 +4,6 @@ on:
   schedule:
     - cron: '0 13 * * 1' # At 1:00 PM UTC every Monday
   pull_request:
-    paths:
-      - '.github/workflows/codeql.yaml'
 
 jobs:
   analyze:

sdk/src/main/java/io/opentdf/platform/sdk/ECKeyPair.java

@@ -29,6 +29,8 @@
 
 public class ECKeyPair {
 
+    private static final int SHA256_BYTES = 32;
+
     static {
         Security.addProvider(new BouncyCastleProvider());
     }
@@ -232,8 +234,12 @@ public static byte[] computeECDHKey(ECPublicKey publicKey, ECPrivateKey privateK
         }
     }
 
+    /**
+     * Returns a HKDF key derived from the provided salt and secret
+     * that is 32 bytes (256 bits) long.
+     */
     public static byte[] calculateHKDF(byte[] salt, byte[] secret) {
-        byte[] key = new byte[secret.length];
+        byte[] key = new byte[SHA256_BYTES];
         HKDFParameters params = new HKDFParameters(secret, salt, null);
 
         HKDFBytesGenerator hkdf = new HKDFBytesGenerator(SHA256Digest.newInstance());

sdk/src/test/java/io/opentdf/platform/sdk/ECKeyPairTest.java

@@ -13,6 +13,7 @@
 import java.util.Base64;
 
 import static io.opentdf.platform.sdk.NanoTDFType.ECCurve.SECP256R1;
+import static org.assertj.core.api.AssertionsForClassTypes.assertThat;
 import static org.junit.jupiter.api.Assertions.assertArrayEquals;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 
@@ -117,6 +118,19 @@ void extractPemPubKeyFromX509() throws CertificateException, IOException, NoSuch
         byte[] key = ECKeyPair.calculateHKDF(ECKeys.salt.getBytes(StandardCharsets.UTF_8), symmetricKey);
         System.out.println(Arrays.toString(key));
         System.out.println(key.length);
+
+        assertThat(key.length).isEqualTo(32); // SHA-256 produces a 32-byte key
+    }
+
+    @Test
+    void createSymmetricKeysWithOtherCurves() {
+        ECKeyPair pubPair = new ECKeyPair(NanoTDFType.ECCurve.SECP384R1, ECKeyPair.ECAlgorithm.ECDH);
+        ECKeyPair keyPair = new ECKeyPair(NanoTDFType.ECCurve.SECP384R1, ECKeyPair.ECAlgorithm.ECDH);
+
+        byte[] sharedSecret = ECKeyPair.computeECDHKey(pubPair.getPublicKey(), keyPair.getPrivateKey());
+        byte[] encryptionKey = ECKeyPair.calculateHKDF(ECKeys.salt.getBytes(StandardCharsets.UTF_8), sharedSecret);
+
+        assertThat(encryptionKey).hasSize(32); // SHA-256 produces a 32-byte key
     }
 
     @Test